Method and system for providing an efficient asset management and verification service

• US 9,888,025 B2
• Filed: 02/24/2016
• Issued: 02/06/2018
• Est. Priority Date: 02/27/2014
• Status: Active Grant

• Current Assignee: Intuit, Inc.
• Original Assignee: Intuit, Inc.
• Inventors: Lietz, M. Shannon, Cabrera, Luis Felipe, Nisly, Barry J., Neher, III, Ted R., Godinez, Javier
• Primary Examiner(s): Traore, Fatoumata
• Application Number:
  US15/051,888
• Publication Number:
  US 20160173524A1
• Time in Patent Office: 713 Days
• Field of Search: None
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A virtual asset creation template associated with a class of virtual assets is identified and analyzed to identify and remedy vulnerabilities in the virtual asset creation template. If no vulnerability is identified in the virtual asset creation template, or once each vulnerability identified in the virtual asset creation template is remedied, each virtual asset of the virtual asset class generated using the virtual asset creation template is assigned an initial status of verified virtual asset. Instructions are generated for monitoring and detecting one or more trigger events in assets as well as instructions for implementing at least one responsive action associated with each of the one or more trigger events. Assets monitor and detect one or more trigger events and associated responsive actions are then performed upon the trigger event being detected.

Claims

1. A system for providing an efficient asset management and verification service comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory unit having stored therein instructions, which when executed by any set of the at least one processors, perform a process for providing an efficient asset management and verification service, the process for providing an efficient asset management and verification service including;

identifying a virtual asset creation template associated with a virtual asset class, the virtual asset creation template being used to create each virtual asset of the virtual asset class;

obtaining virtual asset creation template data representing the virtual asset creation template, at least part of the virtual asset creation template data including steps, instructions, and/or operations used to create each virtual asset of the virtual asset class;

analyzing the virtual asset creation template data to identify any vulnerabilities in the virtual asset creation template data;

if one or more vulnerabilities are identified in the virtual asset creation template data, applying to the identified virtual asset creation template a remedy to each identified vulnerability;

generating one or more virtual assets using the virtual asset creation template;

if no vulnerability is identified in the virtual asset creation template data, or each vulnerability identified in the virtual asset creation template data is remedied, transforming an initial status of each virtual asset of the virtual asset class generated using the virtual asset creation template to an initial status of verified;

monitoring the verified virtual assets of the virtual asset class generated using the virtual asset creation template to detect at least one predefined trigger event associated with a monitored verified virtual asset, the predefined trigger events including events representing a change in any of the monitored verified virtual assets, wherein at least a portion of data representing instructions for monitoring and detecting the at least one predefined trigger event associated with the monitored verified virtual asset is provided through a virtual asset creation template used to instantiate the at least one virtual asset used to implement the application;

performing one or more responsive actions associated with the detected trigger event.

2. The system for providing an efficient asset management and verification service of claim 1, further comprising:

transforming the status of the changed monitored verified virtual asset to a status of unverified;

analyzing the unverified virtual asset to identify any vulnerabilities in the unverified virtual asset;

if one or more vulnerabilities are identified in the unverified virtual asset, applying a remedy to each vulnerability identified in the unverified virtual asset; and

if no vulnerability is identified in the unverified virtual asset, or if each vulnerability identified in the unverified virtual asset is remedied, transforming the status of the unverified virtual asset to a status of verified.

3. The system for providing an efficient asset management and verification service of claim 1, wherein at least part of the virtual asset creation template data is selected from the group of virtual asset creation template data consisting of:

a tool and/or system for creating and managing a collection of related cloud resources;

a configuration management tool associated with the virtual asset class; and

a virtual appliance used to instantiate each virtual asset of the virtual asset class.

4. The system for providing an efficient asset management and verification service of claim 1, wherein the virtual asset class is a virtual asset class selected from the group of the virtual asset classes consisting of:

a virtual machine class;

a virtual server class;

a virtual database or data store class;

a specific type of instance instantiated in a cloud environment;

an application development process class; and

an application class.

5. The system for providing an efficient asset management and verification service of claim 1, wherein at least one of the predefined trigger events is selected from the group of trigger events consisting of:

a change in software associated with a verified asset;

a change in a software stack associated with a verified asset;

a change in a deployment pattern associated with a verified asset;

a change in a communications channel associated with a verified asset;

a change in a communications channel configuration associated with a verified asset;

a deviation from an expected communications traffic pattern associated with a verified asset;

a geo-location of the recipient of communications traffic associated with a verified asset;

a geo-location of the originator of communications traffic associated with a verified asset;

a change in a pattern of wireless communications associated with a verified asset;

a change in a phone number associated with communications associated with a verified asset;

a change in a periodic event associated with a verified asset; and

a deviation from any defined expected normal operations parameter.

6. The system for providing an efficient asset management and verification service for of claim 1, wherein at least one of the one or more responsive actions is selected from the group of responsive actions consisting of:

disabling one or more operations performed by the virtual asset until one or more required actions have taken place;

permanently disabling one or more operations performed by the virtual asset;

disabling one or more communications channels associated with the virtual asset until one or more required actions have taken place;

permanently disabling one or more communications channels associated with the virtual asset;

blocking a portion of communications traffic associated with the virtual asset until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the virtual asset;

disabling the virtual asset until one or more required actions have taken place;

permanently disabling the virtual asset until one or more required actions have taken place; and

directing a transfer of data from the virtual asset to a location outside the virtual asset before disabling the virtual asset.

7. The system for providing an efficient asset management and verification service of claim 1, wherein at least the portion of data representing instructions for monitoring and detecting the at least one predefined trigger event associated with the monitored verified virtual asset and at least a portion of data representing instructions for performing the one or more responsive actions associated with the detected trigger event are provided by providing a security policy library to the application, and/or one or more assets used to implement the application.

8. The system for providing an efficient asset management and verification service of claim 1, wherein at least a portion of data representing instructions for performing the one or more responsive actions associated with the detected trigger event is provided through a virtual asset creation template used to instantiate the at least one virtual asset used to implement the application.

9. A system for providing an efficient asset management and verification service comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory unit having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing an efficient asset management and verification service, the process for providing an efficient asset management and verification service including;

obtaining scanner data representing one or more scanner tests configured to discover one or more vulnerabilities in a virtual asset creation template;

obtaining remedy data representing one or more remedies associated with vulnerabilities scanned for by the one or more scanner tests;

correlating the remedy data with vulnerabilities discoverable by the scanner tests;

identifying a virtual asset creation template associated with a virtual asset class and is used to create each virtual asset of the virtual asset class;

obtaining virtual asset creation template data representing a virtual asset creation template used to create virtual assets of the virtual asset class, wherein at least part of the virtual asset creation template data includes steps, instructions, and/or operations used to create the virtual assets of the virtual asset class;

analyzing the vulnerability management data and the virtual asset creation template data to automatically identify a relevant scanner test in the scanner data to be applied to the virtual asset creation template data;

automatically deploying the relevant scanner test on the virtual asset creation template data;

if a vulnerability is identified by the relevant scanner test, identifying the remedy in the remedy data associated with the identified vulnerability;

automatically creating a remedied virtual asset creation template by applying the identified remedy to the virtual asset creation template data;

generating one or more virtual assets using the virtual asset creation template;

if no vulnerability is identified in the virtual asset creation template data, or each vulnerability identified in the virtual asset creation template data is remedied, transforming an initial status of each virtual asset of the virtual asset class generated using the virtual asset creation template to an initial status of verified;

monitoring the verified virtual assets of the virtual asset class generated using the virtual asset creation template to detect at least one predefined trigger event associated with a monitored verified virtual asset, the predefined trigger events including events representing a change in any of the monitored verified virtual assets, wherein at least a portion of data representing instructions for monitoring and detecting the at least one predefined trigger event associated with the monitored verified virtual asset is provided through a virtual asset creation template used to instantiate the at least one virtual asset used to implement the application;

performing one or more responsive actions associated with the detected trigger event.

10. The system for providing an efficient asset management and verification service of claim 9, further comprising:

transforming the status of the changed monitored verified virtual asset to a status of unverified;

analyzing the vulnerability management data and the unverified virtual asset to automatically identify a relevant scanner test in the scanner data to be applied to the unverified virtual asset;

automatically deploying the relevant scanner test on the unverified virtual asset;

if a vulnerability is identified by the relevant scanner test, identifying the remedy in the remedy data associated with the identified vulnerability;

automatically applying the identified remedy to the unverified virtual asset; and

if no vulnerability is identified in the unverified virtual asset, or if each vulnerability identified in the unverified virtual asset is remedied, transforming the status of the unverified virtual asset to a status of verified.

11. The system for providing an efficient asset management and verification service of claim 9, wherein the scanner data is open-ended to allow for the addition, deletion, and/or modification of scanner tests represented by the scanner data.

12. The system for providing an efficient asset management and verification service of claim 9, wherein the remedy data is open-ended to allow for the addition, deletion, and/or modification of remedies represented by the remedy data.

13. The system for providing an efficient asset management and verification service of claim 9, wherein at least one of the vulnerabilities discoverable by the one or more scanner tests are vulnerabilities included in the group of vulnerabilities consisting of:

the existence of a known weakness pattern in the virtual asset creation template data;

a lack of security requirements, or insufficient security requirements associated with the virtual asset creation template data;

the existence of a known vulnerable version of software or code included in the virtual asset creation template data;

code written in a language, or version of a language in the virtual asset creation template data known to be vulnerable to attack;

lack of encryption, or the proper level of encryption, indicated in the virtual asset creation template data;

no checks of buffer lengths indicated in the virtual asset creation template data;

no checks of the integrity of arguments indicated in the virtual asset creation template data; and

any combination thereof.

14. The system for providing an efficient asset management and verification service of claim 9, wherein at least one of the remedies associated with vulnerabilities discoverable by the scanner tests is selected from the group of remedies consisting of:

automatic application of a software patch via the virtual asset creation template data;

automatic installation of a software version update via the virtual asset creation template data;

automatic deletion of a virtual asset component indicated in the virtual asset creation template data;

automatic replacement of a virtual asset component indicated in the virtual asset creation template data;

an automatic change to a configuration indicated in the virtual asset creation template data;

automatic re-sizing of buffers and buffer pools indicated in the virtual asset creation template data;

automatic re-setting or changing a response time indicated in the virtual asset creation template data; and

any combination thereof.

15. The system for providing an efficient asset management and verification service of claim 9, wherein at least part of the virtual asset creation template data is selected from the group of virtual asset creation template data consisting of:

a tool and/or system for creating and managing a collection of related cloud resources;

a configuration management tool associated with the virtual asset class; and

a virtual appliance used to instantiate each virtual asset of the virtual asset class.

16. The system for providing an efficient asset management and verification service of claim 9, wherein at least one of the predefined trigger events is selected from the group of trigger events consisting of:

a change in software associated with a verified asset;

a change in a software stack associated with a verified asset;

a change in a deployment pattern associated with a verified asset;

a change in a communications channel associated with a verified asset;

a change in a communications channel configuration associated with a verified asset;

a deviation from an expected communications traffic pattern associated with a verified asset;

a geo-location of the recipient of communications traffic associated with a verified asset;

a geo-location of the originator of communications traffic associated with a verified asset;

a change in a pattern of wireless communications associated with a verified asset;

a change in a phone number associated with communications associated with a verified asset;

a change in a periodic event associated with a verified asset; and

a deviation from any defined expected normal operations parameter.

17. The system for providing an efficient asset management and verification service for of claim 9, wherein at least one of the one or more responsive actions is selected from the group of responsive actions consisting of:

disabling one or more operations performed by the virtual asset until one or more required actions have taken place;

permanently disabling one or more operations performed by the virtual asset;

disabling one or more communications channels associated with the virtual asset until one or more required actions have taken place;

permanently disabling one or more communications channels associated with the virtual asset;

blocking a portion of communications traffic associated with the virtual asset until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the virtual asset;

disabling the virtual asset until one or more required actions have taken place;

permanently disabling the virtual asset until one or more required actions have taken place; and

directing a transfer of data from the virtual asset to a location outside the virtual asset before disabling the virtual asset.

18. The system for providing an efficient asset management and verification service of claim 9, wherein each virtual asset of the virtual asset class created using the virtual asset creation template has the same defined initial operational parameters selected from the group of operational parameters consisting of;

the function of the virtual assets of the virtual asset class;

the connectivity of the virtual assets of the virtual asset class;

the storage capability allocated to the virtual assets of the virtual asset class;

the processing capability allocated to the virtual assets of the virtual asset class;

the hardware allocated to the virtual assets of the virtual asset class;

the software allocated to virtual assets of the virtual asset class; and

any combination thereof.

19. A system for providing an efficient asset management and verification service comprising:

virtual asset creation template data representing a virtual asset creation template used to create virtual assets of a virtual asset class, wherein at least part of the virtual asset creation template data includes steps, instructions, and/or operations used to create the virtual assets;

a vulnerability analysis module configured to analyze the virtual asset creation template data and identify vulnerabilities in the virtual asset creation template data;

a remedy application module configured to create a remedied virtual asset creation template by applying to the virtual asset creation template one or more remedies mapped to one or more vulnerabilities identified in the virtual asset creation template data by the vulnerability analysis module;

generating one or more virtual assets using the virtual asset creation template data;

a verification status module configured to assign an initial status to each generated virtual asset, the verification status module further configured to transform an initial status of each generated virtual asset to a status of verified if no vulnerability is identified in the virtual asset creation template data by the vulnerability analysis module, or if each vulnerability identified in the virtual asset creation template data by the vulnerability analysis module is remedied by the remedy application module;

a virtual asset state monitoring module configured to monitor verified virtual assets to detect at least one predefined trigger event associated with any of the monitored verified virtual assets wherein upon a trigger event associated with a monitored verified virtual asset being detected, performing one or more responsive actions associated with the trigger event, wherein at least a portion of data representing instructions for monitoring and detecting the at least one predefined trigger event associated with the monitored verified virtual asset is provided through a virtual asset creation template used to instantiate the at least one virtual asset used to implement the application.

20. The system for providing an efficient asset management and verification service of claim 19, further comprising:

transforming the status of the monitored virtual asset of the trigger event to a status of unverified using the verification status module;

an unverified virtual asset vulnerability analysis module configured to analyze the unverified virtual asset and identify any vulnerabilities in the unverified virtual asset;

an unverified virtual asset remedy application module configured to apply a remedy to each vulnerability identified by the unverified virtual asset vulnerability analysis module; and

if no vulnerability is identified in the unverified virtual asset by the unverified virtual asset vulnerability analysis module, or each vulnerability identified in the unverified virtual asset is remedied by the unverified virtual asset remedy application module, transforming, using the verification status module, the status of the unverified virtual asset to a status of verified.

21. The system for providing an efficient asset management and verification service of claim 19, wherein at least part of the virtual asset creation template data is selected from the group of virtual asset creation template data consisting of:

a tool and/or system for creating and managing a collection of related cloud resources;

a configuration management tool associated with the virtual asset class; and

a virtual appliance used to instantiate each virtual asset of the virtual asset class.

22. The system for providing an efficient asset management and verification service of claim 19, wherein at least one of the predefined trigger events is selected from the group of trigger events consisting of:

a change in software associated with a verified asset;

a change in a software stack associated with a verified asset;

a change in a deployment pattern associated with a verified asset;

a change in a communications channel associated with a verified asset;

a change in a communications channel configuration associated with a verified asset;

a change in a pattern of wireless communications associated with a verified asset;

a change in a phone number associated with communications associated with a verified asset;

a change in a periodic event associated with a verified asset; and

a deviation from any defined expected normal operations parameter.

23. The system for providing an efficient asset management and verification service of claim 19, wherein at least one of the one or more responsive actions is selected from the group of responsive actions consisting of:

disabling one or more operations performed by the virtual asset until one or more required actions have taken place;

permanently disabling one or more operations performed by the virtual asset;

disabling one or more communications channels associated with the virtual asset until one or more required actions have taken place;

permanently disabling one or more communications channels associated with the virtual asset;

blocking a portion of communications traffic associated with the virtual asset until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the virtual asset;

disabling the virtual asset until one or more required actions have taken place;

permanently disabling the virtual asset until one or more required actions have taken place; and

directing a transfer of data from the virtual asset to a location outside the virtual asset before disabling the virtual asset.

24. A system for providing an efficient asset management and verification service comprising:

a virtual asset creation template, wherein the virtual asset creation template is associated with a virtual asset class, wherein the virtual asset creation template is used to create each virtual asset of the virtual asset class;

virtual asset creation template data representing the virtual asset creation template, wherein at least part of the virtual asset creation template data includes steps, instructions, and/or operations used to create each virtual asset of the virtual asset class;

a vulnerability analysis module for analyzing the virtual asset creation template data and identify any vulnerabilities in the virtual asset creation template data;

a remedy database, the remedy database including one or more remedies for one or more vulnerabilities;

identifying one or more vulnerabilities in the virtual asset creation template data and creating a remedied virtual asset creation template by applying to the virtual asset creation template a remedy to each vulnerability identified in the virtual asset creation template data;

a vulnerability to remedy mapping module, the vulnerability to remedy mapping module matching a given vulnerability to one or more associated remedies;

a remedy application module for applying one or more associated remedies mapped to one or more vulnerabilities identified in the virtual asset creation template data;

generating one or more virtual assets using the remedied virtual asset creation template;

a verification status module for assigning an initial status to each virtual asset of the virtual asset class generated using the virtual asset creation template data, the verification status module transforming an initial status of each virtual asset of the virtual asset class generated using the virtual asset creation template to an initial status of verified if no vulnerability is identified in the virtual asset creation template data by the vulnerability analysis module, or if each vulnerability identified in the virtual asset creation template data at the vulnerability analysis module is remedied at the remedy application module;

a virtual asset state monitoring module configured to monitor verified virtual assets to detect at least one predefined trigger event associated with any of the monitored verified virtual assets wherein upon a trigger event associated with a monitored verified virtual asset being detected, performing one or more responsive actions associated with the trigger event, wherein at least a portion of data representing instructions for monitoring and detecting the at least one predefined trigger event associated with the monitored verified virtual asset is provided through a virtual asset creation template used to instantiate the at least one virtual asset used to implement the application.

25. The system for providing an efficient asset management and verification service of claim 24, further comprising:

transforming the status of the changed monitored virtual asset to a status of unverified using the verification status module;

an unverified virtual asset vulnerability analysis module for analyzing the unverified virtual asset to identify any vulnerabilities in the unverified virtual asset;

an unverified virtual asset remedy application module for applying a remedy to each vulnerability identified by the unverified virtual asset vulnerability analysis module; and

if no vulnerability is identified in the unverified virtual asset by the unverified virtual asset vulnerability analysis module, or each vulnerability identified in the unverified virtual asset is remedied by the unverified virtual asset remedy application module, transforming the status of the unverified virtual asset to a status of verified using the verification status module.

26. The system for providing an efficient asset management and verification service of claim 24, wherein the virtual asset class is a virtual asset class selected from the group of the virtual asset classes consisting of:

a virtual machine class;

a virtual server class;

a virtual database or data store class;

a specific type of instance instantiated in a cloud environment;

an application development process class; and

an application class.

27. The system for providing an efficient asset management and verification service of claim 24, wherein each virtual asset of the virtual asset class created using the virtual asset creation template has the same defined initial operational parameters selected from the group of operational parameters consisting of;

the function of the virtual assets of the virtual asset class;

the connectivity of the virtual assets of the virtual asset class;

the storage capability allocated to the virtual assets of the virtual asset class;

the processing capability allocated to the virtual assets of the virtual asset class;

the hardware allocated to the virtual assets of the virtual asset class;

the software allocated to virtual assets of the virtual asset class; and

any combination thereof.

28. The system for providing an efficient asset management and verification service of claim 24, wherein at least one of the predefined trigger events is selected from the group of trigger events consisting of:

a change in software associated with a verified asset;

a change in a software stack associated with a verified asset;

a change in a deployment pattern associated with a verified asset;

a change in a communications channel associated with a verified asset;

a change in a communications channel configuration associated with a verified asset;

a change in a pattern of wireless communications associated with a verified asset;

a change in a phone number associated with communications associated with a verified asset;

a change in a periodic event associated with a verified asset; and

a deviation from any defined expected normal operations parameter.

29. The system for providing an efficient asset management and verification service of claim 24, wherein at least one of the one or more responsive actions is selected from the group of responsive actions consisting of:

disabling one or more operations performed by the virtual asset until one or more required actions have taken place;

permanently disabling one or more operations performed by the virtual asset;

disabling one or more communications channels associated with the virtual asset until one or more required actions have taken place;

permanently disabling one or more communications channels associated with the virtual asset;

blocking a portion of communications traffic associated with the virtual asset until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the virtual asset;

disabling the virtual asset until one or more required actions have taken place;

permanently disabling the virtual asset until one or more required actions have taken place; and

directing a transfer of data from the virtual asset to a location outside the virtual asset before disabling the virtual asset.