Remediation of known defects and vulnerabilities in cloud application packages

• US 9,195,453 B1
• Filed: 09/30/2014
• Issued: 11/24/2015
• Est. Priority Date: 06/10/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Giammaria, Alberto, Peters, Christopher Andrew, Spatzier, Thomas
• Primary Examiner(s): Deng, Anna
• Application Number:
  US14/503,056
• Publication Number:
  US 20150355895A1
• Time in Patent Office: 420 Days
• Field of Search: 717124-127
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3688 for test execution, e.g. scheduling of test suites
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 65/40 Support for services or applications
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes

Abstract

A method for applying remediation policy to a cloud application package having a set of components is described. The method is initiated in response to discovery of a new vulnerability. It begins by comparing information from a deployment description against a data set of known problems associated with the one or more of the components. The deployment description represents the set of components and their interrelationships. For each of the one or more components, one or more known problems that satisfy a given severity and/or complexity criteria are identified. Thereafter, and with respect to at least one of the components for which one known problem satisfying the given criteria has been identified, the remediation policy (e.g., an update, a replacement, a patch, an additional installable) is applied to attempt to rectify the known problem. After applying the policy, the old version of the package is replaced with the new version.

Claims

1. A method for applying a remediation policy to a cloud application package having a set of components, the cloud application package being associated with a catalog of cloud application packages, comprising:

in response to discovery of a new defect or vulnerability, comparing information from a deployment description against a data set of known problems associated with the one or more of the components, the deployment description representing the set of components and their interrelationships;

for each of the one or more components, identifying one or more known problems that satisfy a given criteria;

with respect to at least one of the components for which at least one known problem satisfying the given criteria has been identified, applying the remediation policy to attempt to rectify the known problem; and

after applying the remediation policy, replacing an old version of the cloud application package in the catalog of cloud application packages with a new version;

wherein at least one of the comparing, identifying, applying and replacing operations are carried out in software executing in a hardware element.

2. The method as described in claim 1 further including:

determining a current availability of the replacement policy; and

removing the cloud application package from the catalog of cloud application packages when it is determined that the replacement policy is not currently available.

3. The method as described in claim 1, wherein the given criteria is one of:

a complexity criteria, a severity criteria, and a combination of the complexity and severity criteria.

4. The method as described in claim 1 further including:

providing information identifying a listing of known problems ordered according to the given criteria; and

receiving data identifying a selection of the one known problems to which the remediation policy is to be applied.

5. The method as described in claim 1 wherein the remediation policy is selected from one of:

an update, a replacement, a patch, and an additional installable.

6. The method as described in claim 1 wherein the deployment description is a TOSCA (Topology and Orchestration Specification for Cloud Applications)-compliant document.

7. The method as described in claim 1 wherein the operations are carried out automatically and autonomously.