Managing workflows upon a security incident

• US 9,871,818 B2
• Filed: 04/17/2015
• Issued: 01/16/2018
• Est. Priority Date: 12/03/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Phantom Cyber Corporation (Cisco Systems, Inc.)
• Inventors: Satish, Sourabh, Friedrichs, Oliver, Mahadik, Atif, Salinas, Govind
• Primary Examiner(s): Zee, Edward
• Application Number:
  US14/689,926
• Publication Number:
  US 20160164918A1
• Time in Patent Office: 1,005 Days
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems, methods, and software described herein provide for managing service level agreements (SLAs) for security incidents in a computing environment. In one example, an advisement system identifies a rule set for a security incident based on enrichment information obtained for the security incident, wherein the rule set is associated with action recommendations to be taken against the incident. The advisement system further identifies a default SLA for the security incident based on the rule set, and obtains environmental characteristics related to the security incident. Based on the environmental characteristics, the advisement system determines a modified SLA for the security incident.

Claims

1. A method of managing service level agreements (SLAs) for security incidents in a computing environment, the method comprising:

identifying a rule set for a security incident of the security incidents based on enrichment information obtained for the security incident, wherein the rule set is associated with one or more action recommendations to be taken against the security incident;

identifying a default SLA for the security incident based on the rule set, wherein the default SLA comprises a default hierarchy of administrators for the security incident and a default set of one or more time periods for administrator security actions;

obtaining environmental characteristics related to the security incident, wherein the environmental characteristics comprise at least a criticality rating of an asset associated with the security incident;

determining a modified SLA for the security incident based on the environmental characteristics, wherein the modified SLA comprises a second hierarchy of administrators for the security incident and a second set of one or more time periods for administrator security actions;

providing the one or more security actions to administrators based on the modified SLA; and

obtaining input from at least one administrator, wherein the input comprises;

an action selection of the one or more security actions;

or

feedback regarding the one or more action recommendations, wherein the feedback comprises modifying the one or more action recommendations, removing an action recommendation from the one or more action recommendations, or deferring action selection to another administrator.

2. The method of claim 1 wherein the environmental characteristics further comprise a current severity level of the security incident, a rate of events for the security incident, current market conditions at a time for the incident, or geopolitical conditions at a time for the incident.

3. The method of claim 1 further comprising obtaining the enrichment information for the security incident from one of a database or a website.

4. The method of claim 1 wherein the security incident comprises one of an unknown process on an asset or an unknown communication request to an asset in the computing environment.

5. The method of claim 1 further comprising:

initiating implementation of a first security action within the computing environment based on the rule set, wherein the first security action comprises a containment action for the security incident, and

wherein obtaining the environmental characteristics related to the security incident comprises obtaining containment effectiveness information for the first security action.

6. An apparatus to manage service level agreements (SLAs) for security incidents in a computing environment, the apparatus comprising:

one or more non-transitory computer readable media; and

processing instructions stored on the one or more computer readable media that, when executed by a processing system, direct the processing system to;

identify a rule set for a security incident of the security incidents based on enrichment information obtained for the security incident, wherein the rule set is associated with one or more action recommendations to be taken against the security incident;

identify a default SLA for the security incident based on the rule set, wherein the default SLA comprises a default hierarchy of administrators for the security incident and a default set of one or more time periods for administrator security actions;

obtain environmental characteristics related to the security incident, wherein the environmental characteristics comprise at least a criticality rating of an asset associated with the security incident;

determine a modified SLA for the security incident based on the environmental characteristics, wherein the modified SLA comprises a second hierarchy of administrators for the security incident and a second set of one or more time periods for administrator security actions;

provide the one or more security actions to administrators based on the modified SLA; and

obtain input from at least one administrator, wherein the input comprises;

an action selection of the one or more security actions;

or

feedback regarding the one or more action recommendations, wherein the feedback comprises modifying the one or more action recommendations, removing an action recommendation from the one or more action recommendations, or deferring action selection to another administrator.

7. The apparatus of claim 6 wherein the environmental characteristics further comprise a current severity level of the security incident, a rate of events for the security incident, current market conditions at a time for the incident, or geopolitical conditions at a time for the incident.

8. The apparatus of claim 6 wherein the processing instructions further direct the processing system to obtain the enrichment information for the security incident from one of a database or a website.

9. The apparatus of claim 6 wherein the security incident comprises one of an unknown process on an asset in the computing environment or an unknown communication request to an asset in the computing environment.

10. The apparatus of claim 6 wherein the processing instructions further direct the processing system to:

initiate implementation of a first security action within the computing environment based on the rule set, wherein the first security action comprises a containment action for the security incident, and

wherein obtaining the environmental characteristics related to the security incident comprises obtaining containment effectiveness information for the first security action.

11. An advisement system to manage service level agreements (SLAs) for security incidents in a computing environment with a plurality of assets, the advisement system comprising:

one or more non-transitory computer readable media;

a processing system operatively coupled to the one or more non-transitory computer readable media; and

processing instructions stored on the one or more computer readable media that, when executed by a processing system, direct the processing system to;

identify a rule set for a security incident of the security incidents based on enrichment information obtained for the security incident, wherein the rule set is associated with one or more action recommendations to be taken against the security incident;

identify a default SLA for the security incident based on the rule set, wherein the default SLA comprises a default hierarchy of administrators for the security incident and a default set of one or more time periods for administrator security actions;

obtain environmental characteristics related to the security incident, wherein the environmental characteristics comprise at least a criticality rating of an asset associated with the security incident;

determine a modified SLA for the security incident based on the environmental characteristics, wherein the modified SLA comprises a second hierarchy of administrators for the security incident and a second set of one or more time periods for administrator security actions;

provide the one or more security actions to administrators based on the modified SLA; and

obtain input from at least one administrator, wherein the input comprises;

an action selection of the one or more security actions;

or

feedback regarding the one or more action recommendations, wherein the feedback comprises modifying the one or more action recommendations, removing an action recommendation from the one or more action recommendations, or deferring action selection to another administrator.

12. The advisement system of claim 11 wherein the environmental characteristics further comprise a current severity level of the security incident, a rate of events for the security incident, current market conditions at a time for the incident, or geopolitical conditions at a time for the incident.

13. The advisement system of claim 11 wherein the processing instructions further direct the processing system to obtain the enrichment information for the security incident from one of a database or a website.

14. The advisement system of claim 11 wherein the security incident comprises one of an unknown process on an asset in the computing environment or an unknown communication request to an asset in the computing environment.

15. The advisement system of claim 11 wherein the processing instructions further direct the processing system to:

initiate implementation of a first security action within the computing environment based on the rule set, wherein the first security action comprises a containment action for the security incident, and

wherein obtaining the environmental characteristics related to the security incident comprises obtaining containment effectiveness information for the first security action.