Security management in a networked computing environment

Patent metadata

Field	Value
Publication number	US-9998490-B2
Application number	US-201715632484-A
Country	US
Kind code	B2
Filing date	Jun 26, 2017
Priority date	Jan 2, 2013
Publication date	Jun 12, 2018
Grant date	Jun 12, 2018

Abstract

An approach for addressing (e.g., preventing) detected network intrusions in a virtualized/networked (e.g., cloud) computing environment is provided. In a typical embodiment, users may group components/systems of an environment/domain according to a range of security sensitivity levels/classifications. The users may further configure rules for responding to security threats for each security sensitivity level/classification. For example, if a “highly dangerous” security threat is detected in or near a network segment that contains highly sensitive systems, the user may configure rules that will automatically isolate those systems that fall under the high security classification. Such an approach allows for more granular optimization and/or management of system security/intrusion prevention that may be managed at a system level rather than at a domain level.

First claim

What is claimed is:

1. A computer-implemented method, for managing security in a networked computing environment, comprising:
detecting an attempted intrusion into at least one component of a plurality of components;
determining a threat level of the attempted intrusion;
performing a first action affecting at least one first component, based upon a security sensitivity level assigned to the at least one first component and the threat level, to address an attempted intrusion; and
performing a different second action affecting at least one second component, based upon a security sensitivity level assigned to the at least one second component and the threat level, of the plurality of components to address the attempted intrusion;
wherein the first action comprises blocking access to the at least one first component, and
wherein the second action comprises blocking one or more ports that are open between: a virtual local area network (VLAN) other than a VLAN containing the source of the attempted intrusion, and the VLAN containing the source of the attempted intrusion,
wherein the VLAN containing the source of the attempted intrusion includes the first component; and
wherein the VLAN other than the VLAN containing the source of the attempted intrusion includes the second component.

2. The computer-implemented method of claim 1 , wherein the determination of the threat level is based upon historical data.

3. The computer-implemented method of claim 2 , wherein the historical data comprises data including level of intrusion of previous intrusions and damage inflicted by previous intrusions.

4. The computer-implemented method of claim 1 , further comprising monitoring the networked computing environment for the attempted intrusion.

5. The computer-implemented method of claim 1 , wherein the performing steps are implemented according to a set of rules.

6. The computer-implemented method of claim 5 , wherein the set of rules is configured by a user.

7. The computer-implemented method of claim 1 , wherein a solution service provider provides a computer infrastructure operable to perform the computer-implemented method.

8. The computer-implemented method of claim 1 , the networked computing environment comprising a cloud computing environment.

9. A system for managing security in a networked computing environment, comprising:
a memory medium comprising instructions;
a bus coupled to the memory medium; and
a processor coupled to the bus that when executing the instructions causes the system to:
detect an attempted intrusion into at least one component of a plurality of components;
determine a threat level of the attempted intrusion;
perform a first action affecting at least one first component, based upon a security sensitivity level assigned to the at least one first component and the threat level, to address an attempted intrusion; and
perform a different second action affecting at least one second component, based upon a security sensitivity level assigned to the at least one second component and the threat level, of the plurality of components to address the attempted intrusion;
wherein the first action comprises blocking access to the at least one first component, and
wherein the second action comprises blocking one or more ports that are open between: a virtual local area network (VLAN) other than a VLAN containing the source of the attempted intrusion, and the VLAN containing the source of the attempted intrusion,
wherein the VLAN containing the source of the attempted intrusion includes the first component; and
wherein the VLAN other than the VLAN containing the source of the attempted intrusion includes the second component.

10. The system of claim 9 , wherein the determining is based upon historical data.

11. The system of claim 10 , wherein the historical data comprises data including level of intrusion of previous intrusions and damage inflicted by previous intrusions.

12. The system of claim 9 , the memory medium further comprising instructions for causing the system to monitor the networked computing environment for the attempted intrusion.

13. The system of claim 9 , wherein the performing steps are implemented according to a set of rules.

14. The system of claim 9 , the networked computing environment comprising a cloud computing environment.

15. A computer program product for managing security in a networked computing environment, the computer program product comprising a computer readable hardware storage device, and program instructions stored on the computer readable storage media, to:
detect an attempted intrusion into at least one component of a plurality of components;
determine a threat level of the attempted intrusion;
perform a first action affecting at least one first component, based upon a security sensitivity level assigned to the at least one first component and the threat level, to address an attempted intrusion; and
perform a different second action affecting at least one second component, based upon a security sensitivity level assigned to the at least one second component and the threat level, of the plurality of components to address the attempted intrusion;
wherein the first action comprises blocking access to the at least one first component, and
wherein the second action comprises blocking one or more ports that are open between: a virtual local area network (VLAN) other than a VLAN containing the source of the attempted intrusion, and the VLAN containing the source of the attempted intrusion,
wherein the VLAN containing the source of the attempted intrusion includes the at least one first component; and
wherein the VLAN other than the VLAN containing the source of the attempted intrusion includes the at least one second component.

16. The computer program product of claim 15 , wherein the determining is based upon historical data.

17. The computer program product of claim 16 , wherein the historical data comprises data including level of intrusion of previous intrusions and damage inflicted by previous intrusions.

18. The computer program product of claim 15 , the computer readable hardware storage device further comprising instructions to monitor the networked computing environment for the attempted intrusion.

19. The computer program product of claim 15 , wherein the performing steps are implemented according to a set of rules.

20. The computer program product of claim 15 , the networked computing environment comprising a cloud computing environment.

Assignees

• IBM

Inventors

• Abuelsaad Kelly
• Deluca Lisa Seacat
• Jang Soobaek
• Krook Daniel C

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title