SECURITY ASSESSMENT OF VIRTUAL MACHINE ENVIRONMENTS

• US 20130247133A1
• Filed: 10/13/2011
• Published: 09/19/2013
• Est. Priority Date: 10/13/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Price, Michael, Bettini, Anthony
• Granted Patent: US 8,850,512 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

Each virtual machine in a set of virtual machines managed by the virtual machine manager is identified. For each virtual machine in the set, it is determined whether the respective virtual machine is online. For at least the virtual machines determined to be offline, a machine image is collected for each offline virtual machine. Security of the offline virtual machines is assessed from the collected images. For virtual machines identified as online, an agent is loaded on each online virtual machine in the set via the virtual machine manager. The loaded agents are used to assess security of the online virtual machines in the set.

Claims

1. A method comprising:

identifying each virtual machine in a set of virtual machines managed by a virtual machine manager;

determining, for each virtual machine in the set, whether the respective virtual machine is online;

collecting, for each virtual machine in the set determined to be offline, a machine image of the virtual machine via the virtual machine manager; and

assessing security of the offline virtual machines from the collected images.

2. The method of claim 1, wherein identifying each virtual machine includes:

sending a query to the virtual machine manager for information for the set of virtual machines; and

receiving identification data, from the virtual machine manager, identifying each virtual machine in the set of virtual machines in response to the query.

3. The method of claim 2, wherein the identification data includes identification, for each virtual machine in the set of virtual machines, of whether the virtual machine is online.

4. The method of claim 2, wherein at least one of the query or identification data is communicated over an API of the virtual machine manager.

5. The method of claim 1, wherein the machine images of offline virtual machines in the set are sent via an API of the virtual machine manager.

6. The method of claim 1, further comprising:

loading an agent, via an API of the virtual machine manager, on at least one online virtual machine in the set; and

using the agent to assess security of the at least one online virtual machine.

7. The method of claim 6, further comprising collecting result data reporting results of the security assessment of the at least one online virtual machine, wherein the result data is collected from the agent over the API of the virtual machine manager.

8. The method of claim 6, wherein the agent is removed automatically at conclusion of the security assessment of the at least one online virtual machine.

9. The method of claim 1, wherein the set is a subset of the plurality of virtual machines managed by the virtual machine manager and the set comprises less than all of the plurality of virtual machines.

10. The method of claim 1, further comprising collecting result data from the security assessment of the offline virtual machines.

11. The method of claim 10, wherein the offline virtual machines include a plurality of offline virtual machines and the result data describes virtual-machine-specific security conditions for each of the plurality of offline virtual machines.

12. The method of claim 11, further comprising generating a virtual-machine-specific report for each of the plurality of offline virtual machines based at least in part on collected result data.

13. The method of claim 1, wherein assessing security of the offline virtual machines from the collected images includes reading each image file to identify security characteristics of each virtual machine in the offline virtual machines.

14. The method of claim 1, wherein assessing security of the offline virtual machines from the collected images further includes simulating operation of each offline virtual machine based on data in the corresponding image of the respective virtual machine.

15. The method of claim 1, wherein the plurality of virtual machines are firewalled.

16. The method of claim 1, further comprising authenticating, at the virtual machine manager, a security assessment tool.

17. The method of claim 1, wherein the security assessment of the offline virtual machines includes remedying at least one of a security vulnerability or policy violation detected for a particular one of the offline virtual machines before the particular virtual machine resumes online operation.

18. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

identifying each virtual machine in a set of virtual machines managed by a particular virtual machine manager;

determining, for each virtual machine in the set of virtual machines, whether the respective virtual machine is online;

collecting, for each virtual machine in the set determined to be offline, a machine image of the virtual machine via the particular virtual machine manager; and

assessing security of the offline virtual machines from the collected machine images.

19. A system comprising:

at least one processor device;

at least one memory element; and

a security assessment module, adapted when executed by the at least one processor device to;

identify each virtual machine in a set of virtual machines managed by a particular virtual machine manager;

determine, for each virtual machine in the set of virtual machines, whether the respective virtual machine is online;

load, via an API of the virtual machine manager, an agent on each virtual machine in the set of virtual machines determined to be online; and

use the agent to assess security of the at least one online virtual machine.

20. The system of claim 19, wherein the security assessment module is further adapted to:

collect, for each virtual machine in the set determined to be offline, a machine image of the virtual machine via the particular virtual machine manager; and

assess security of the offline virtual machines from the collected machine images.