Method and system for providing security aware applications

• US 9,596,251 B2
• Filed: 12/31/2015
• Issued: 03/14/2017
• Est. Priority Date: 04/07/2014
• Status: Active Grant

• Current Assignee: Intuit, Inc.
• Original Assignee: Intuit, Inc.
• Inventors: Lietz, M. Shannon, Cabrera, Luis Felipe
• Primary Examiner(s): Bayou, Yonas
• Application Number:
  US14/985,858
• Publication Number:
  US 20160112447A1
• Time in Patent Office: 439 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: H04L 47/803 Application aware
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Instructions for monitoring and detecting one or more trigger events in assets used to implement an application are generated. Instructions for implementing at least one responsive action associated with each of the one or more trigger events is generated. At least part of instructions for monitoring and detecting the one or more trigger events is provided to an asset used to implement the application. The at least part of the instructions for monitoring and detecting the one or more trigger events are used by the asset to detect a trigger event. The instructions for implementing the at least one responsive action associated with each of the one or more trigger events is then used to automatically implement the at least one responsive action associated with the detected trigger event.

Claims

1. A system for providing security aware applications comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing security aware applications, the process for providing security aware applications including;

instantiating, using a virtual asset creation template, a virtual asset used to implement an application, wherein the virtual asset is a virtual machine;

defining one or more trigger events that when detected in the virtual asset require at least one responsive action, the defined trigger events at least including a change in a user ID associated with a user of the application, and/or an asset;

defining at least one responsive action to be associated with each of the one or more trigger events, wherein one of the one or more defined responsive actions includes disabling one or more communications channels of the virtual asset, until one or more required actions have taken place;

generating data representing instructions for monitoring and detecting the one or more trigger events;

generating data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events;

providing, to the virtual asset, at least part of the data representing instructions for monitoring and detecting the one or more trigger events in the virtual asset;

providing, to the virtual asset, at least part of the data representing instructions for implementing the one or more responsive actions;

detecting, by the virtual asset, using the data representing instructions for monitoring and detecting the one or more trigger events in an asset, a trigger event involving the virtual asset; and

automatically implementing, by the virtual asset, using the data representing instructions for implementing the at least one responsive action, the at least one responsive action associated with the detected trigger event.

2. The system for providing security aware applications of claim 1 wherein at least one of the defined trigger events is selected from the group of trigger events consisting of:

a change in software associated with the application, and/or an asset used to implement the application;

a change in a software stack associated with the application, and/or an asset used to implement the application;

the receipt of one or more defined commands by the application, and/or an asset used to implement the application;

a change in a deployment pattern associated with the application, and/or an asset used to implement the application;

a change in a communications channel associated with the application, and/or an asset used to implement the application;

a change in a communications channel configuration associated with the application, and/or an asset used to implement the application;

a deviation from an expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a geo-location of the recipient of communications traffic associated with the application, and/or an asset used to implement the application;

a geo-location of the originator of communications traffic associated with the application, and/or an asset used to implement the application;

a change in a pattern of wireless communications associated with the application, and/or an asset used to implement the application;

a change in a phone number associated with communications associated with the application, and/or an asset used to implement the application;

a change in the profile of a user associated with the application, and/or an asset used to implement the application;

a change in a periodic event associated with the application, and/or an asset used to implement the application; and

a deviation from any defined expected normal operations parameter associated with the application, and/or an asset used to implement the application.

3. The system for providing security aware applications of claim 1 wherein at least one of the defined responsive actions is selected from the group of responsive actions consisting of:

notifying a party or entity of the detected trigger event;

disabling one or more operations performed by the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more operations performed by the application, and/or an asset used to implement the application;

permanently disabling one or more communications channels associated with the application, and/or an asset used to implement the application;

blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application;

disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

obtaining data from the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application; and

directing a transfer of data from the application, and/or an asset used to implement the application, to a location outside the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application.

4. The system for providing security aware applications of claim 1 wherein the at least one asset used to implement the application is a virtual asset selected from the group of the virtual assets consisting of:

a virtual machine;

a virtual server;

a database or data store;

an instance in a cloud environment;

a cloud environment access system;

part of a mobile device;

part of a remote sensor;

part of a server computing system; and

part of a desktop computing system.

5. The system for providing security aware applications of claim 1 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by providing a security policy library to the application, and/or one or more assets used to implement the application.

6. The system for providing security aware applications of claim 1 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided through a virtual asset creation template used to instantiate the at least one virtual asset used to implement the application.

7. The system for providing security aware applications of claim 1 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided to the application, and/or one or more assets used to implement the application, by the owner of the application.

8. The system for providing security aware applications of claim 1 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a provider of at least part of a production environment in which the application is implemented.

9. The system for providing security aware applications of claim 1 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a third party service provider.

10. A system for providing security aware applications comprising:

an application implemented by at least one virtual asset instantiated from a virtual asset creation template;

a production environment implementing the application;

data for monitoring and detecting one or more trigger events in the virtual asset, the trigger events at least including a change in a user ID associated with a user of the virtual asset;

data representing instructions for implementing at least one responsive action associated with each of the one or more trigger events upon detection of the one or more trigger events in the virtual asset, wherein at least one responsive action associated with at least one trigger event includes disabling one or more communications channels associated with the virtual asset, until one or more required actions have taken place;

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing security aware applications, the process for providing security aware applications including;

providing, to the at least one virtual asset, at least part of the data for monitoring and detecting the one or more trigger events;

detecting, by the virtual asset, using the at least part of the data for monitoring and detecting the one or more trigger events, a trigger event involving the at least one asset; and

automatically implementing, by the virtual asset, using the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events, the at least one responsive action associated with the detected trigger event.

11. The system for providing security aware applications of claim 10 wherein at least one of the defined trigger events is selected from the group of trigger events consisting of:

a change in software associated with the application, and/or an asset used to implement the application;

a change in a software stack associated with the application, and/or an asset used to implement the application;

the receipt of one or more defined commands by the application, and/or an asset used to implement the application;

a change in a deployment pattern associated with the application, and/or an asset used to implement the application;

a change in a communications channel associated with the application, and/or an asset used to implement the application;

a change in a communications channel configuration associated with the application, and/or an asset used to implement the application;

a deviation from an expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a geo-location of the recipient of communications traffic associated with the application, and/or an asset used to implement the application;

a geo-location of the originator of communications traffic associated with the application, and/or an asset used to implement the application;

a change in a pattern of wireless communications associated with the application, and/or an asset used to implement the application;

a change in a phone number associated with communications associated with the application, and/or an asset used to implement the application;

a change in the profile of a user associated with the application, and/or an asset used to implement the application;

a change in a periodic event associated with the application, and/or an asset used to implement the application; and

a deviation from any defined expected normal operations parameter associated with the application, and/or an asset used to implement the application.

12. The system for providing security aware applications of claim 10 wherein at least one of the defined responsive actions is selected from the group of responsive actions consisting of:

notifying a party or entity of the detected trigger event;

disabling one or more operations performed by the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more operations performed by the application, and/or an asset used to implement the application;

permanently disabling one or more communications channels associated with the application, and/or an asset used to implement the application;

blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application;

disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

obtaining data from the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application; and

directing a transfer of data from the application, and/or an asset used to implement the application, to a location outside the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application.

13. The system for providing security aware applications of claim 10 wherein the at least one asset used to implement the application in the production environment is a virtual asset selected from the group of the virtual assets consisting of:

a virtual machine;

a virtual server;

a database or data store;

an instance in a cloud environment;

a cloud environment access system;

part of a mobile device;

part of a remote sensor;

part of a server computing system; and

part of a desktop computing system.

14. The system for providing security aware applications of claim 10 wherein the data for monitoring and detecting the one or more trigger events and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by providing a security policy library to the application, and/or one or more assets used to implement the application.

15. The system for providing security aware applications of claim 10 wherein the data for monitoring and detecting the one or more trigger events and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided through a virtual asset creation template used to instantiate the at least one virtual asset used to implement the application in the production environment.

16. The system for providing security aware applications of claim 10 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by the owner of the application.

17. The system for providing security aware applications of claim 10 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a provider of at least part of the production environment in which the application is implemented.

18. The system for providing security aware applications of claim 10 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a third party service provider.

19. A system for providing security aware applications comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing security aware applications, the process for providing security aware applications including;

instantiating, using a virtual asset creation template, a virtual asset used to implement an application;

defining one or more operational parameters associated with the virtual asset used to implement the application, the defined one or more operational parameters at least including a communications channel configuration associated with the virtual asset;

obtaining baseline values for the one or more operational parameters associated with assets used to implement the application;

defining a trigger deviation value for each of the one or more operational parameters associated with assets used to implement the application;

defining one or more trigger events that when detected in the virtual asset require at least one responsive action, the trigger events including the occurrence of a trigger deviation value for any of the one or more operational parameters associated with the virtual asset used to implement the application, the defined trigger events at least including a change in a user ID associated with a user of the virtual asset;

defining at least one responsive action to be associated with each of the one or more trigger events;

generating data representing instructions for monitoring and detecting the one or more trigger events in the virtual asset used to implement the application;

generating data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events;

providing, to the virtual asset, at least part of the data representing instructions for monitoring and detecting the one or more trigger events;

detecting, by the virtual asset, using the at least part of the data representing instructions for monitoring and detecting the one or more trigger events, a trigger event involving the virtual asset; and

automatically implementing, by the virtual asset, using the data representing instructions for implementing the at least one responsive action, the at least one responsive action associated with the detected trigger event.

20. The system for providing security aware applications of claim 19 wherein at least one of the operational parameters for assets used to implement an application to be monitored is selected from the group operational parameters consisting of:

a deployment pattern associated with the application, and/or an asset used to implement the application;

a communications channel associated with the application, and/or an asset used to implement the application;

expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a pattern of wireless communications associated with the application, and/or an asset used to implement the application; and

a periodic event associated with the application, and/or an asset used to implement the application.

21. The system for providing security aware applications of claim 19 wherein at least one of the defined responsive actions is selected from the group of responsive actions consisting of:

notifying a party or entity of the detected trigger event;

disabling one or more operations performed by the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more operations performed by the application, and/or an asset used to implement the application;

disabling one or more communications channels associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more communications channels associated with the application, and/or an asset used to implement the application;

blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application;

disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

obtaining data from the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application; and

directing a transfer of data from the application, and/or an asset used to implement the application, to a location outside the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application.

22. The system for providing security aware applications of claim 19 wherein the at least one asset used to implement the application is a virtual asset selected from the group of the virtual assets consisting of:

a virtual machine;

a virtual server;

a database or data store;

an instance in a cloud environment;

a cloud environment access system;

part of a mobile device;

part of a remote sensor;

part of a server computing system; and

part of a desktop computing system.

23. The system for providing security aware applications of claim 19 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by providing a security policy library to the application, and/or one or more assets used to implement the application.

24. The system for providing security aware applications of claim 19 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided through a virtual asset creation template used to instantiate at least one virtual asset used to implement the application.

25. The system for providing security aware applications of claim 19 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by the owner of the application.

26. The system for providing security aware applications of claim 19 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a provider of at least part of a production environment in which the application is implemented.

27. The system for providing security aware applications of claim 19 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a third party service provider.

28. The system for providing security aware applications of claim 19 wherein at least one of the defined trigger events is selected from the group of trigger events consisting of:

a change in software associated with the application, and/or an asset used to implement the application;

a change in a software stack associated with the application, and/or an asset used to implement the application;

the receipt of one or more defined commands by the application, and/or an asset used to implement the application;

a change in a deployment pattern associated with the application, and/or an asset used to implement the application;

a change in a communications channel associated with the application, and/or an asset used to implement the application;

a change in a communications channel configuration associated with the application, and/or an asset used to implement the application;

a deviation from an expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a geo-location of the recipient of communications traffic associated with the application, and/or an asset used to implement the application;

a geo-location of the originator of communications traffic associated with the application, and/or an asset used to implement the application;

a change in a pattern of wireless communications associated with the application, and/or an asset used to implement the application;

a change in a phone number associated with communications associated with the application, and/or an asset used to implement the application;

a change in the profile of a user associated with the application, and/or an asset used to implement the application;

a change in a periodic event associated with the application, and/or an asset used to implement the application; and

a deviation from any defined expected normal operations parameter associated with the application, and/or an asset used to implement the application.

29. A method for providing security aware applications comprising:

defining one or more operational parameters associated with a virtual asset, wherein one of the one or more defined operational parameters includes a communications channel configuration associated with the virtual asset;

obtaining baseline values for the one or more operational parameters;

defining a trigger deviation value for each of the one or more operational parameters;

defining one or more trigger events that when detected in the virtual asset require at least one responsive action, the trigger events including the occurrence of a trigger deviation value for any of the one or more operational parameters, the defined trigger events at least including a change in a user ID associated with a user of the virtual asset;

defining at least one responsive action to be associated with each of the one or more trigger events;

generating data representing instructions for monitoring and detecting the one or more trigger events;

generating data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events;

providing, to the virtual asset, at least part of the data representing instructions for monitoring and detecting the one or more trigger events;

detecting, by the virtual asset, using the at least part of the data representing instructions for monitoring and detecting the one or more trigger events, a trigger event involving the virtual asset; and

automatically implementing, by the virtual asset, using the data representing instructions for implementing the at least one responsive action, the at least one responsive action associated with the detected trigger event.

30. The method for providing security aware applications of claim 29 wherein at least one of the operational parameters for an asset used to implement an application to be monitored is selected from the group operational parameters consisting of:

a deployment pattern associated with the application, and/or an asset used to implement the application;

a communications channel associated with the application, and/or an asset used to implement the application;

expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a pattern of wireless communications associated with the application, and/or an asset used to implement the application; and

a periodic event associated with the application, and/or an asset used to implement the application.

31. The method for providing security aware applications of claim 29 wherein at least one of the defined trigger events is selected from the group of trigger events consisting of:

a change in software associated with the application, and/or an asset used to implement the application;

a change in a software stack associated with the application, and/or an asset used to implement the application;

the receipt of one or more defined commands by the application, and/or an asset used to implement the application;

a change in a deployment pattern associated with the application, and/or an asset used to implement the application;

a change in a communications channel associated with the application, and/or an asset used to implement the application;

a change in a communications channel configuration associated with the application, and/or an asset used to implement the application;

a deviation from an expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a geo-location of the recipient of communications traffic associated with the application, and/or an asset used to implement the application;

a geo-location of the originator of communications traffic associated with the application, and/or an asset used to implement the application;

a change in a pattern of wireless communications associated with the application, and/or an asset used to implement the application;

a change in a phone number associated with communications associated with the application, and/or an asset used to implement the application;

a change in the profile of a user associated with the application, and/or an asset used to implement the application;

a change in a periodic event associated with the application, and/or an asset used to implement the application; and

a deviation from any defined expected normal operations parameter associated with the application, and/or an asset used to implement the application.

32. The method for providing security aware applications of claim 29 wherein at least one of the defined responsive actions is selected from the group of responsive actions consisting of:

notifying a party or entity of the detected trigger event;

disabling one or more operations performed by the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more operations performed by the application, and/or an asset used to implement the application;

disabling one or more communications channels associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more communications channels associated with the application, and/or an asset used to implement the application;

blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application;

disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

obtaining data from the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application; and

directing a transfer of data from the application, and/or an asset used to implement the application, to a location outside the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application.

33. The method for providing security aware applications of claim 29 wherein the at least one asset used to implement the application is a virtual asset selected from the group of the virtual assets consisting of:

a virtual machine;

a virtual server;

a database or data store;

an instance in a cloud environment;

a cloud environment access system;

part of a mobile device;

part of a remote sensor;

part of a server computing system; and

part of a desktop computing system.

34. The method for providing security aware applications of claim 29 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by providing a security policy library to the application, and/or one or more assets used to implement the application.

35. The method for providing security aware applications of claim 29 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided through a virtual asset creation template used to instantiate at least one virtual asset used to implement the application.

36. The method for providing security aware applications of claim 29 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by the owner of the application.

37. The method for providing security aware applications of claim 29 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a provider of at least part of a production environment in which the application is implemented.

38. The method for providing security aware applications of claim 29 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a third party service provider.

39. A system for providing security aware applications comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing security aware applications, the process for providing security aware applications including;

instantiating, using a virtual asset creation template, a virtual asset used to implement an application;

defining one or more trigger events that when detected in the virtual asset require at least one responsive action, the defined trigger events at least including a change in a user ID associated with a user of the virtual asset;

defining at least one responsive action to be associated with each of the one or more trigger events, wherein one of the defined at least one responsive actions includes permanently disabling one or more communications channels of the virtual asset;

generating data representing instructions for monitoring and detecting the one or more trigger events;

generating data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events;

providing, to the virtual asset, at least part of the data representing instructions for monitoring and detecting the one or more trigger events in the virtual asset;

providing, to the virtual asset, at least part of the data representing instructions for implementing the one or more responsive actions;

detecting, by the virtual asset, using the data representing instructions for monitoring and detecting the one or more trigger events in an asset to detect a trigger event involving the virtual asset; and

automatically implementing, by the virtual asset, using the data representing instructions for implementing the at least one responsive action, the at least one responsive action associated with the detected trigger event.

40. A system for providing security aware applications comprising:

an application;

a production environment implementing the application;

data for monitoring and detecting one or more trigger events in the virtual asset, the trigger events at least including a change in a user ID associated with a user of the virtual asset;

data representing instructions for implementing at least one responsive action associated with each of the one or more trigger events upon detection of the one or more trigger events in the virtual asset, wherein at least one responsive action associated with at least one trigger event includes permanently disabling one or more communications channels associated with the virtual asset;

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing security aware applications, the process for providing security aware applications including;

providing, to the at least one virtual asset, at least part of the data for monitoring and detecting the one or more trigger events;

detecting, by the virtual asset, using the at least part of the data for monitoring and detecting the one or more trigger events, a trigger event involving the at least one asset; and

automatically implementing, by the virtual asset, using the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events, the at least one responsive action associated with the detected trigger event.

41. A system for providing security aware applications comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing security aware applications, the process for providing security aware applications including;

instantiating, using a virtual asset creation template, a virtual asset used to implement an application;

defining one or more operational parameters associated with the virtual asset, the defined one or more operational parameters at least including a periodic event associated with the virtual asset;

obtaining baseline values for the one or more operational parameters associated with the virtual asset;

defining a trigger deviation value for each of the one or more operational parameters;

defining one or more trigger events that when detected in the virtual asset require at least one responsive action, the trigger events including the occurrence of a trigger deviation value for any of the one or more operational parameters, the defined trigger events at least including a change in a user ID associated with a user of the virtual asset;

defining at least one responsive action to be associated with each of the one or more trigger events;

generating data representing instructions for monitoring and detecting the one or more trigger events in the virtual asset;

generating data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events;

providing, to the virtual asset, at least part of the data representing instructions for monitoring and detecting the one or more trigger events;

providing, to the virtual asset, at least part of the data representing instructions for implementing the one or more responsive actions;

detecting, by the virtual asset, using the at least part of the data representing instructions for monitoring and detecting the one or more trigger events to detect a trigger event involving the virtual asset; and

automatically implementing, by the virtual asset, using the data representing instructions for implementing the at least one responsive action, the at least one responsive action associated with the detected trigger event.

42. A system for providing security aware applications comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing security aware applications, the process for providing security aware applications including;

defining one or more operational parameters associated with a virtual asset used to implement an application, wherein the virtual asset is a virtual machine;

obtaining baseline values for the one or more operational parameters associated with the virtual asset;

defining a trigger deviation value for each of the one or more operational parameters associated with the virtual asset;

defining one or more trigger events that when detected in the virtual asset require at least one responsive action, the trigger events including the occurrence of a trigger deviation value for any of the one or more operational parameters, the defined trigger events at least including a change in a user ID associated with a user of the virtual asset;

defining at least one responsive action to be associated with each of the one or more trigger events, wherein the defined at least one responsive actions includes blocking a portion of communications traffic associated with the virtual asset, until one or more required actions have taken place;

generating data representing instructions for monitoring and detecting the one or more trigger events;

generating data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events;

providing, to the virtual asset, at least part of the data representing instructions for monitoring and detecting the one or more trigger events;

detecting, by the virtual asset, using the at least part of the data representing instructions for monitoring and detecting the one or more trigger events, a trigger event involving the virtual asset; and

automatically implementing, by the virtual asset, using the data representing instructions for implementing the at least one responsive action, the at least one responsive action associated with the detected trigger event.

43. A system for providing security aware applications comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing security aware applications, the process for providing security aware applications including;

defining one or more operational parameters associated with a virtual asset used to implement an application;

obtaining baseline values for the one or more operational parameters associated with the virtual asset;

defining a trigger deviation value for each of the one or more operational parameters associated with the virtual asset;

defining one or more trigger events that when detected in the virtual asset require at least one responsive action, the trigger events including the occurrence of a trigger deviation value for any of the one or more operational parameters, the defined trigger events at least including a change in a user ID associated with a user of the application, and/or an asset;

defining at least one responsive action to be associated with each of the one or more trigger events, wherein the defined at least one responsive actions includes permanently disabling one or more communications channels associated with the virtual asset;

generating data representing instructions for monitoring and detecting the one or more trigger events in the virtual asset;

generating data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events;

providing, to the virtual asset, at least part of the data representing instructions for monitoring and detecting the one or more trigger events;

detecting, by the virtual asset, using the at least part of the data representing instructions for monitoring and detecting the one or more trigger events involving the virtual asset; and

automatically implementing, by the virtual asset, using the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events, the at least one responsive action associated with the detected trigger event.

44. A method for providing security aware applications comprising:

defining one or more operational parameters associated with a virtual asset used to implement an application, wherein one of the one or more operational parameters includes a deployment pattern associated with the virtual asset used to implement the application;

obtaining baseline values for the one or more operational parameters associated with the virtual asset;

defining a trigger deviation value for each of the one or more operational parameters associated with the virtual asset;

defining one or more trigger events that when detected in the virtual asset require at least one responsive action, the trigger events including the occurrence of a trigger deviation value for any of the one or more operational parameters, the defined trigger events at least including a change in a user ID associated with a user of the application, and/or an asset;

defining at least one responsive action to be associated with each of the one or more trigger events;

generating data representing instructions for monitoring and detecting the one or more trigger events;

generating data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events;

providing, to the virtual asset, at least part of the data representing instructions for monitoring and detecting the one or more trigger events;

providing, to the virtual asset, at least part of the data representing instructions for implementing the one or more responsive actions;

detecting, by the virtual asset, using the at least part of the data representing instructions for monitoring and detecting the one or more trigger events, a trigger event involving the at least one asset; and

automatically implementing, by the virtual asset, using the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events, the at least one responsive action associated with the detected trigger event.