METHOD AND SYSTEM FOR SECURING VIRTUAL MACHINES BY RESTRICTING ACCESS IN CONNECTION WITH A VULNERABILITY AUDIT

• US 20100199351A1
• Filed: 02/02/2009
• Published: 08/05/2010
• Est. Priority Date: 01/02/2009
• Status: Abandoned Application

• Current Assignee: eEye Incorporated (BeyondTrust Corp.)
• Original Assignee: eEye Incorporated (BeyondTrust Corp.)
• Inventors: Protas, Andre
• Application Number:
  US12/363,862
• Publication Number:
  US 20100199351A1
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

A method and system for securing a virtual machine is disclosed. An initiation signal from the host system that is generated upon startup of the virtual machine is intercepted, and a network connection on the host system accessible by the virtual machine is restricted in response. Then, the virtual machine is queried for preexisting vulnerabilities, and such data is received. Access by the virtual machine to the network connection is controlled based upon a comparison of a security policy, which is associated with the virtual machine, to the received preexisting vulnerabilities.

Claims

1. A method for securing a virtual machine on a host system, the method comprising:

intercepting an initiation signal from the host system generated upon startup of the virtual machine, a network connection on the host system being accessible by the virtual machine to communicate over a network;

restricting the network connection to the virtual machine in response to the initiation signal;

querying the virtual machine for preexisting vulnerabilities;

receiving the preexisting vulnerabilities from the virtual machine; and

controlling access by the virtual machine to the network connection on the host system based upon a comparison of a security policy to the received preexisting vulnerabilities, the security policy including vulnerability definitions associated with the virtual machine.

2. The method of claim 1, wherein controlling access includes restricting the virtual machine from accessing selected segments of the network through the network connection, and the received preexisting vulnerabilities are matched to at least one of the vulnerability definitions in the security policy.

3. The method of claim 2, further comprising:

initiating the application of revisions to the virtual machine, the revisions being associated with the received preexisting vulnerabilities.

4. The method of claim 1, wherein controlling access includes permitting the virtual machine to access the network connection, and the virtual machine has a lack of received preexisting vulnerabilities matched to at least one of the vulnerability definitions of the security policy.

5. The method of claim 1, wherein:

the preexisting vulnerabilities each has an assigned criticality level; and

the security policy further includes criticality levels corresponding to each of the vulnerability definitions and a combined threshold criticality level.

6. The method of claim 5, wherein controlling access includes restricting the virtual machine from accessing selected segments of the network through the network connection, a tally combining the criticality levels corresponding to matched ones of the received preexisting vulnerabilities exceeding the combined threshold criticality level.

7. The method of claim 5, wherein controlling access includes permitting the virtual machine to access the network connection, and a tally combining the criticality levels corresponding to the matched ones of the received preexisting vulnerabilities are less than the combined threshold criticality level.

8. The method of claim 5, wherein a first criticality level is assigned to a first one of the vulnerability definitions and a different second criticality level is assigned to a second one of the vulnerability definitions.

9. The method of claim 1, wherein the virtual machine is queried for preexisting vulnerabilities while the network connection to the virtual machine is restricted.

10. The method of claim 1, wherein after querying the virtual machine, the method includes generating a report of the discovered preexisting vulnerabilities of the virtual machine.

11. The method of claim 1, wherein a security audit module independent of the virtual machine queries the virtual machine for preexisting vulnerabilities.

12. The method of claim 11, wherein the security audit module runs on a remote system in network communication with the host system.

13. The method of claim 11, wherein the security audit module runs on the host system.

14. A virtual machine vulnerability assessment system comprising:

a monitor module in communication with a host system for a virtual machine, the host system being in communication with the virtual machine, and a startup signal being receivable by the monitor module at the instantiation of the virtual machine;

a scanning engine activatable by the monitor module, the scanning engine being in communication with the virtual machine to detect vulnerabilities of the virtual machine;

a security policy associated with the scanning engine and including a plurality of vulnerability definitions; and

a policy execution module in communication with the scanning engine, access to the network interface from the virtual machine being controlled based upon a correlation of the detected vulnerabilities to the vulnerability definitions.

15. The virtual machine vulnerability assessment system of claim 14 wherein:

the monitor module is in communication with the policy execution module; and

access to the network interface from the virtual machine is restricted to a network segment of the base system by the monitor module in response to the startup signal.

16. The virtual machine vulnerability assessment system of claim 14, further comprising an update module in communication with the policy execution module, revisions to the virtual machine addressing the detected vulnerabilities being applied to the virtual machine by the update module.

17. The virtual machine vulnerability assessment system of claim 14, wherein:

the host system is in communication with the virtual machine over a network interface; and

the scanning engine is in communication with the virtual machine over the network interface.

18. The virtual machine vulnerability assessment system of claim 14, wherein the scanning engine is in communication with the virtual machine over a local interface in a memory of the host system.

19. The virtual machine vulnerability assessment system of claim 14, wherein the base system includes a virtual machine manager for generating the startup signal and managing access to the network interface.

20. The virtual machine vulnerability assessment system of claim 14, wherein the monitor module, the scanning engine, and the policy execution module reside on the host system.

21. The virtual machine vulnerability assessment system of claim 14, wherein the monitor module, the scanning engine, and the policy execution module reside in a remote system in communication with the host system.

22. The virtual machine vulnerability assessment system of claim 14, wherein the known vulnerability identifiers each have a severity level associated therewith, the security policy configuration defining a maximum threshold level of detected vulnerabilities.

23. A computer readable medium having computer-executable instructions for performing a method for securing a virtual machine on a host system, the method comprising:

intercepting an initiation signal from the host system generated upon startup of the virtual machine, a network connection on the host system being accessible by the virtual machine;

restricting the network connection to the virtual machine in response to the initiation signal;

querying the virtual machine for preexisting vulnerabilities;

receiving the preexisting vulnerabilities from the virtual machine;

controlling access by the virtual machine to the network connection on the host system based upon a comparison of a security policy to the received preexisting vulnerabilities, the security policy including vulnerability definitions associated with the virtual machine.