Applying security policies based on context of a workload

• US 9,794,289 B1
• Filed: 04/30/2014
• Issued: 10/17/2017
• Est. Priority Date: 04/11/2014
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Banerjee, Deb, Yelimeli, Sheetal Venkatesh, Gadre, Smita
• Primary Examiner(s): King, John B
• Application Number:
  US14/266,585
• Time in Patent Office: 1,266 Days
• Field of Search: 726 1, 726226, 726201
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

A workload to be provided by one or more network resources may be identified. The workload may be analyzed to determine one or more attributes of the workload. Furthermore, a general policy may be identified based on the one or more attributes of the workload. One or more security policies may be applied to a network resource that provides the workload. The one or more security policies may satisfy one or more requirements of the general policy.

Claims

1. A method comprising:

identifying a workload to be provided by one or more network resources;

analyzing the workload to determine one or more attributes of the workload, wherein the one or more attributes correspond to a type of data and a software application used by the workload;

identifying a general policy based on the determined one or more attributes corresponding to the type of data and the software application used by the workload, wherein the identified general policy is based on at least one of an industry standard or a government regulation, wherein the identified general policy comprises a first general policy associated with a first level of strictness and a second general policy associated with a second level of strictness higher than the first level of strictness;

determining, by a processing device, based on the identified general policy, one or more security policies to apply to the one or more network resources that provide the workload, wherein the one or more security policies satisfy one or more requirements associated with the identified general policy, wherein the one or more security policies satisfy the second level of strictness; and

applying the determined one or more security policies to the one or more network resources that provide the workload, wherein the applying of the determined one or more security policies modifies a configuration of the one or more network resources that provide the workload to satisfy the one or more requirements associated with the identified general policy.

2. The method of claim 1, wherein the one or more attributes comprises a geographical location associated with the workload.

3. The method of claim 1, wherein the one or more security policies comprises at least one of a network security policy, data policy, or a malware policy.

4. The method of claim 1, wherein the identified workload has not yet been provided by the one or more network resources.

5. The method of claim 1, wherein the identifying of the general policy based on the determined one or more attributes of the workload comprises matching one or more conditions associated with the general policy with at least one attribute of the one or more attributes of the workload.

6. A system comprising:

a memory; and

a processing device coupled with the memory to;

identify a workload to be provided by one or more network resources;

analyze the workload to determine one or more attributes of the workload, wherein the one or more attributes correspond to a type of data and a software application used by the workload;

identify a general policy based on the determined one or more attributes corresponding to the type of data and the software application used by the workload, wherein the identified general policy is based on at least one of an industry standard or a government regulation, wherein the identified general policy comprises a first general policy associated with a first level of strictness and a second general policy associated with a second level of strictness higher than the first level of strictness;

determine, based on the identified general policy, one or more security policies to apply to the one or more network resources that provide the workload, wherein the one or more security policies satisfy one or more requirements associated with the identified general policy, wherein the one or more security policies satisfy the second level of strictness; and

apply the determined one or more security policies to the one or more network resources that provide the workload, wherein the applying of the determined one or more security policies modifies a configuration of the one or more network resources that provide the workload to satisfy the one or more requirements associated with the identified general policy.

7. The system of claim 6, wherein the one or more attributes comprises a geographical location associated with the workload.

8. The system of claim 6, wherein the one or more security policies comprises at least one of a network security policy, data policy, or a malware policy.

9. The system of claim 6, wherein the identified workload has not yet been provided by the one or more network resources.

10. The system of claim 6, wherein the identifying of the general policy based on the determined one or more attributes of the workload comprises matching one or more conditions associated with the general policy with at least one attribute of the one or more attributes of the workload.

11. A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

identifying a workload to be provided by one or more network resources;

analyzing the workload to determine one or more attributes of the workload, wherein the one or more attributes correspond to a type of data and a software application used by the workload;

identifying a general policy based on the determined one or more attributes corresponding to the type of data and the software application used by the workload, wherein the identified general policy is based on at least one of an industry standard or a government regulation, wherein the identified general policy comprises a first general policy associated with a first level of strictness and a second general policy associated with a second level of strictness higher than the first level of strictness;

determining, by the processing device, based on the identified general policy, one or more security policies to apply to the one or more network resources that provide the workload, wherein the one or more security policies satisfy one or more requirements associated with the identified general policy, wherein the one or more security policies satisfy the second level of strictness; and

applying the determined one or more security policies to the one or more network resources that provide the workload, wherein the applying of the determined one or more security policies modifies a configuration of the one or more network resources that provide the workload to satisfy the one or more requirements associated with the identified general policy.

12. The non-transitory computer readable storage medium of claim 11, wherein the one or more attributes comprises a geographical location associated with the workload.

13. The non-transitory computer readable storage medium of claim 11, wherein the one or more security policies comprises at least one of a network security policy, data policy, or a malware policy.

14. The non-transitory computer readable storage medium of claim 11, wherein the identified workload has not yet been provided by the one or more network resources.

15. The non-transitory computer readable storage medium of claim 11, wherein the identifying of the general policy based on the determined one or more attributes of the workload comprises matching one or more conditions associated with the general policy with at least one attribute of the one or more attributes of the workload.