MANAGEMENT OF INFORMATION TECHNOLOGY RISK USING VIRTUAL INFRASTRUCTURES

• US 20100332889A1
• Filed: 06/25/2009
• Published: 12/30/2010
• Est. Priority Date: 06/25/2009
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: CAUDLE, Corey Pace, HANSON, Jeffrey J., SHNEORSON, Oren
• Granted Patent: US 7,975,165 B2
• Time in Patent Office: Days
• US Class Current: 714/2
• CPC Class Codes: G06Q 10/04 Forecasting or optimisation specially adapted for administrative or management purposes, e.g. linear programming or "cutting stock problem" market predictions or forecasting for commercial activities G06Q30/0202
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling

Abstract

Information Technology Risk to an organization is associated with a plurality of virtual machines (VMs) each running on a plurality of hosts, each host being a computer system connected to a network and in communication with a risk orchestrator, which receives threat indication messages (TIMs) from threat indicators. Each TIM indicates a status of a threat to which a hosts is vulnerable. Downtime probability (DTP) resulting from the threat and an overall host DTP for each host are calculated. For each VM, a risk value associated with the VM is calculated as a function of the host DTP for and an impact for the VM, the impact being a value reflecting a relative importance of the VM to the organization. Each VM requiring risk mitigation is identified and prioritized in accordance with a policy, and a configured mitigation control action may be carried out for each VM requiring risk mitigation.

Claims

1. A method for managing risk to an organization associated with each of a plurality of virtual machines (VMs) each running on one of a plurality of hosts, each host being a physical computer system connected to one or more networks and in communication with a risk orchestrator for carrying out the method, the risk orchestrator being an application in communication with the plurality of hosts and a threat indicator, the method comprising:

receiving at the risk orchestrator a threat indication message from the threat indicator, the threat indication message indicating a status of a threat to which a plurality of hosts in a threat group are vulnerable;

calculating a downtime probability resulting from the threat;

calculating a host downtime probability for each host, the host downtime probability being a function of all the downtime probabilities from all threats for which the host is vulnerable;

for each risk-managed VM, calculating a risk value associated with the VM, the risk value being a function of the host downtime probability for the host on which the VM is running and an impact value for the VM, the impact value being a value reflecting a relative importance of the VM to the organization;

identifying each risk-managed VM requiring risk mitigation, the identifying being in accordance with a policy, prioritizing the risk-managed VMs requiring risk mitigation in an order starting with one of the risk-managed VMs having a highest associated risk;

performing a configured mitigation control action on each of the risk-managed VMs requiring risk mitigation, in the order of the prioritization.

2. The method of claim 1, wherein calculating the host downtime probability further includes, solving DTP_HOST=1−

π

_{i=1 . . . n}(1−

DTP_TINDi), where DTP_HOST is the host downtime probability, i is an integer from 1 to n, n is the number of threats, TIND_i is the threat indicator for threat i, and DTP_TINDi is the downtime probability resulting from threat i.

3. The method of claim 1, further comprising,

calculating a system risk as a sum of all the VM risks for all the VMs;

and

performing a system mitigation action when the system risk exceeds a residual system risk threshold.

4. The method of claim 3, wherein the system risk threshold is configured as a preconfigured percentage of a maximum system risk which is equal to a sum of all maximum VM risks for all the VMs.

5. The method of claim 3, wherein the system mitigation action includes one or more actions selected from a group consisting of moving all VMs to a host with a smallest host downtime probability, taking a snapshot of VMs, powering off all VMs, shutting down all hosts, shutting down guest operating system (GOS) in the VMs, switch VMs to a different site by invoking disaster recovery operations.

6. The method of claim 1 wherein the policy is to provide sufficient risk mitigation with minimum disruption or cost, and the identifying of the risk-managed VMs requiring risk mitigation comprises comparing each the risk value associated with risk-managed VM to a threshold, and deeming the risk-managed VM as requiring risk mitigation when the risk value for that VM exceeds the threshold.

7. The method as recited in claim 1 wherein the policy is to perform ongoing risk balancing, and the identifying of the risk-managed VMs requiring risk mitigation comprises identifying risk-managed VMs having highest associated risk for which risk mitigation has not been recently attempted as requiring risk mitigation.

8. The method as recited in claim 1, wherein the performing of a configured mitigation control action comprises migrating the VM from a current host to a selected target host, the selected target host having a downtime probability sufficiently low so that the VM being migrated no longer requires risk mitigation according to the policy.

9. The method of claim 8, wherein the policy is to provide sufficient risk mitigation with minimum disruption or cost, and the selection of the target host comprises selecting a target host such that upon migration the VM being migrated will have an associated risk value below a threshold, wherein the VM is not considered to require risk mitigation when the associated risk is below the threshold.

10. The method of claim 8, wherein the policy is to reduce risk to a minimum value, and the selection of the target host comprises selecting a target host with the lowest host downtime probability.

11. The method of claim 1, wherein the configured mitigation control action for the risk-managed VM requiring risk mitigation includes one or more actions selected from a group consisting of taking a snapshot of the VM, migrating or live-migrating the VM, suspending the VM, powering down the VM, implementing a shadow VM for potential fail-over, failing-over the VM to an existing shadow VM, restarting the VM, and shutting down the VM.

12. A machine readable storage medium embodying computer code for a risk orchestrator, the risk orchestrator managing risk to an organization associated with each of a plurality of virtual machines (VMs), each VM running on one of a plurality of hosts, each host being a physical computer system connected to one or more networks and in communication with the risk orchestrator, the risk orchestrator being an application in communication with the plurality of hosts and at least one threat indicator, risk orchestrator causing a computer system to carry out a method, the method comprising:

receiving at the risk orchestrator a threat indication message from one of the threat indicators, the threat indication message indicating a status of a threat to which a plurality of hosts in a threat group are vulnerable;

calculating a downtime probability resulting from the threat;

calculating a host downtime probability for each host, the host downtime probability being a function of all the downtime probabilities from all threats for which the host is vulnerable;

for each risk-managed VM, calculating a risk value associated with the VM, the risk value being a function of the host downtime probability for the host on which the VM is running and an impact value for the VM, the impact value being a value reflecting a relative importance of the VM to the organization;

identifying each risk-managed VM requiring risk mitigation, the identifying being in accordance with a policy, prioritizing the risk-managed VMs requiring risk mitigation in an order starting with one of the risk-managed VMs having a highest associated risk;

performing a configured mitigation control action on each of the risk-managed VMs requiring risk mitigation, in the order of the prioritization.

13. The machine readable storage medium of claim 12, wherein the calculating of the host downtime probability further includes, solving DTP_HOST=1−

π

_{i=1 . . . n}(1−

DTP_TINDi), where DTP_HOST is the host downtime probability, i is an integer from 1 to n, n is the number of threats, TIND_i is the threat indicator for threat i, and DTP_TINDi is the downtime probability resulting from threat i.

14. The machine readable storage medium of claim 12, wherein the method further comprises:

calculating a system risk as a sum of all the VM risks for all the VMs; and

performing a system mitigation action when the system risk exceeds a residual system risk threshold.

15. The machine readable storage medium of claim 14, wherein the system risk threshold is configured as a preconfigured percentage of a maximum system risk which is equal to a sum of all maximum VM risks for all the VMs.

16. The machine readable storage medium of claim 14, wherein the system mitigation action includes one or more actions selected from a group consisting of moving all VMs to a host with a smallest host downtime probability, taking a snapshot of VMs, powering off all VMs, shutting down all hosts, shutting down guest operating system (GOS) in the VMs, switch VMs to a different site by invoking disaster recovery operations.

17. The machine readable storage medium of claim 12, wherein the policy is to provide sufficient risk mitigation with minimum disruption or cost, and the identifying of the risk-managed VMs requiring risk mitigation comprises comparing each the risk value associated with risk-managed VM to a threshold, and deeming the risk-managed VM as requiring risk mitigation when the risk value for that VM exceeds the threshold.

18. The machine readable storage medium of claim 12, wherein the policy is to perform ongoing risk balancing, and the identifying of the risk-managed VMs requiring risk mitigation comprises identifying risk-managed VMs having highest associated risk for which risk mitigation has not been recently attempted as requiring risk mitigation.

19. The machine readable storage medium of claim 12, wherein the performing of a configured mitigation control action comprises migrating the VM from a current host to a selected target host, the selected target host having a downtime probability sufficiently low so that the VM being migrated no longer requires risk mitigation according to the policy.

20. The machine readable storage medium of claim 19, wherein the policy is to provide sufficient risk mitigation with minimum disruption or cost, and the selection of the target host comprises selecting a target host such that upon migration the VM being migrated will have an associated risk value below a threshold, wherein the VM is not considered to require risk mitigation when the associated risk is below the threshold.

21. The machine readable storage medium of claim 19, wherein the policy is to reduce risk to a minimum value, and the selection of the target host comprises selecting a target host with the lowest host downtime probability.