METHOD AND SYSTEM FOR MAPPING BETWEEN CONNECTIVITY REQUESTS AND A SECURITY RULE SET

• US 20120192246A1
• Filed: 11/23/2011
• Published: 07/26/2012
• Est. Priority Date: 11/24/2010
• Status: Active Grant

• Current Assignee: Tufin Software Technologies Ltd.
• Original Assignee: Tufin Software Technologies Ltd.
• Inventors: HARRISON, Reuven
• Granted Patent: US 8,914,841 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system capable of automated mapping between a connectivity request and an ordered security rule-set and a method of operating thereof. The system includes an interface operable to obtain data characterizing at least one connectivity request; a module for automated recognizing at least one rule within the rule-set, the rule controlling traffic requested in the at least one connectivity request, wherein the recognizing is provided by comparing a set of combinations specified in the connectivity request with a set of combinations specified in the rule and matching connectivity-related actions specified in the connectivity request; a module for automated evaluating relationship between traffic controlled by the recognized at least one rule and traffic requested in the at least one connectivity request; and a module for automated classifying, in accordance with evaluation results, the at least one connectivity request with respect to the at least one rules and/or vice versa.

Claims

1. A system capable of automated mapping between a connectivity request and an ordered security rule-set, the system comprising:

an interface operable to obtain data characterizing at least one connectivity request;

means for automated recognizing at least one rule within the rule-set, said rule controlling traffic requested in said at least one connectivity request, wherein the recognizing is provided by comparing a set of combinations specified in the connectivity request with a set of combinations firstly specified in the rule and matching connectivity-related actions specified in said at least one connectivity request;

means for automated evaluating relationship between traffic controlled by said recognized at least one rule and traffic requested in said at least one connectivity request; and

means for automated classifying, in accordance with evaluation results, said at least one connectivity request with respect to said at least one rules and/or said at least one rule with respect to said at least one connectivity request.

2. The system of claim 1, wherein the connectivity-related actions are selected from a group comprising accepting, denying, authenticating and encrypting actions.

3. The system of claim 1 wherein the relationship between traffic controlled by a certain rule and traffic requested in a certain connectivity request is evaluated in accordance with conformity between the rule and respective connectivity request, said conformity being indicative of involvement of said certain rule in business needs associated with said certain connectivity request.

4. The system of claim 1 wherein the means for evaluating relationship between traffic controlled by said at least one rule and traffic requested in said at least one connectivity request are operable to calculate a ratio between an un-shadowed volume requested in said at least one rule and the overall un-shadowed volume of said at least one rule, thus giving rise to a conformity ratio characterizing the relationship between said at least one connectivity request and said certain rule.

5. The system of claim 4 wherein the conformity ratio is calculated separately for the fields of said at least one rule.

6. A method of automated managing an ordered security rule-set, the method comprising:

obtaining data characterizing one or more of connectivity requests;

automated recognizing at least one connectivity request requesting traffic at least partially controlled by a certain rule from the rule-set, thus giving rise to at least one connectivity request engaged with respect to said certain rule, wherein the recognizing is provided by comparing a set of combinations specified in a connectivity request with a set of combinations firstly specified in said certain rule and matching connectivity-related actions specified in said certain connectivity request;

automated evaluating relationship between the traffic controlled by said certain rule and the traffic requested in said at least one engaged connectivity request; and

in accordance with the evaluation result, automated classifying said certain rule with respect to said at least one engaged connectivity request.

7. The method of claim 6, wherein the connectivity-related actions are selected from a group comprising accepting, denying, authenticating and encrypting actions.

8. The method of claim 6 wherein the relationship between the traffic controlled by said certain rule and the traffic requested in said at least one engaged connectivity request is evaluated in accordance with conformity between said certain rule and said engaged connectivity request, said conformity being indicative of satisfaction of said engaged connectivity request by said certain rule.

9. The method of claim 6 wherein evaluating the relationship between the traffic controlled by said certain rule and the traffic requested in said at least one engaged connectivity request comprises calculating a ratio between an un-shadowed volume requested in said certain rule and the overall un-shadowed volume of said certain rule, thus giving rise to a conformity ratio being indicative of a degree of satisfaction of said engaged connectivity request by said certain rule.

10. The method of claim 9 wherein the conformity ratio is calculated separately for the fields of said certain rule.

11. The method of claim 6 further comprising evaluating relationship between traffic controlled by the entire rule-set and traffic requested in all respectively engaged connectivity requests, wherein evaluating comprises calculating a ratio between an un-shadowed volume requested in the entire rule-set and the overall un-shadowed volume of the rule-set, thus giving rise to a conformity ratio indicative of a degree of justification of the rule-set by business needs.

12. The method of claim 11 further comprising classifying the entire rule-set, wherein the entire rule-set is classified as requiring amendment if the calculated conformity ratio does not match a predefined criterion related to compliance of the rule-set.

13. A method of automated managing an ordered security rule-set, the method comprising:

obtaining data characterizing at least a certain connectivity request;

automated recognizing at least one rule from the rule-set, said rule at least partially controlling traffic requested in said certain connectivity request, thus giving rise to at least one rule engaged with respect to said certain connectivity request, wherein the recognizing is provided by comparing a set of combinations specified in said certain connectivity request with a set of combinations firstly specified in a rule and matching connectivity-related actions specified in said at least one connectivity request;

automated evaluating relationship between the traffic requested in said certain connectivity request and traffic controlled by said at least one engaged rule and the traffic; and

in accordance with the evaluation result, automated classifying said certain connectivity request with respect to said at least one engaged rule.

14. The method of claim 13, wherein the connectivity-related actions are selected from a group comprising accepting, denying, authenticating and encrypting actions.

15. The method of claim 13 wherein the relationship between the traffic requested in said certain connectivity request and the traffic controlled by said at least one engaged rule is evaluated in accordance with implementation criterion, said implementation criterion being indicative of satisfying said certain connectivity request by said at least one engaged rule.

16. The method of claim 13 wherein evaluating the relationship between the traffic requested in said certain connectivity request and traffic controlled by said at least one engaged rule comprises calculating a ratio between an un-shadowed volume requested in said at least one engaged rule and the overall un-shadowed volume of said rule, thus giving rise to a conformity ratio characterizing a degree of satisfaction of said certain connectivity request by said at least one engaged rule.

17. The method of claim 16 wherein the conformity ratio is calculated separately for the fields of said certain rule.

18. The method of claim 13 further comprising evaluating relationship between traffic requested in all connectivity requests and traffic controlled by all respectively engaged rules in the rule-set, wherein evaluating comprises calculating a ratio between an un-shadowed volume requested in all engaged rules and the overall un-shadowed volume of all engaged rules.

19. The method of claim 13 further comprising:

automated recognizing at least two rules belonging to different rule-sets and engaged with respect to said certain connectivity request, wherein different rule-sets correspond to different revisions of a security policy;

automated evaluating relationship between the traffic requested in said certain connectivity request and traffic controlled by engaged rules corresponding to said different rule-sets;

in accordance with the evaluation result, automated classifying said different rule-sets and/or respective revisions of the security policy.

20. A computer program product comprising a non-transitory computer useable medium having computer readable program code embodied therein for collecting information relating to a communication network and to nodes operating therein, the computer program product comprising:

computer readable program code for enabling the computer to obtain data characterizing one or more of connectivity requests;

computer readable program code for enabling the computer to recognize at least one connectivity request requesting traffic at least partially controlled by a certain rule from the rule-set, thus giving rise to at least one connectivity request engaged with respect to said certain rule, wherein the recognition is provided by comparing a set of combinations specified in a certain connectivity request with a set of combinations firstly specified in the rule and matching connectivity-related actions specified in said certain connectivity request;

computer readable program code for enabling the computer to evaluate relationship between the traffic controlled by said certain rule and the traffic requested in said at least one engaged connectivity request; and

computer readable program code for enabling the computer, to classify said certain rule with respect to said at least one engaged connectivity request in accordance with the evaluation result.