Provision and execution of customized security assessments of resources in a virtual computing environment

• US 10,643,002 B1
• Filed: 09/28/2017
• Issued: 05/05/2020
• Est. Priority Date: 09/28/2017
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Veselov, Vladimir, Grajdeanu, Adrian-Radu, Sultan, Hassan
• Primary Examiner(s): Pwu, Jeffrey C
• Assistant Examiner(s): Cheema, Ali H.
• Application Number:
  US15/719,453
• Time in Patent Office: 950 Days
• Field of Search: 726 1, 726 25, 713164, 713193, 709220, 707600, 705 3, 705 35
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2209/508 Monitor
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 30/0242 Determining effectiveness of advertisements
• CPC Class Codes: G06Q 30/0641 Shopping interfaces

Abstract

Systems for performing a security assessment of a target computing resource, such as a virtual machine or an instance of a virtual machine, include a security assessment service that enables the use of third-party-authored rules packages in the security assessment. The third-party rules package includes rules that can operate on telemetry and configuration data of the target computing resource, produced by sensors that are native to the computing environment, but the sensor protocols, message format, and sensitive data are not exposed to the rules. An interface, such as an ingest function, may be used to convert telemetry data in the form of sensor messages into assessment data objects. The assessment data objects contain the data elements the rules evaluate, and may also have corresponding retrieval methods that are exposed to the rules; the rules call the retrieval methods to extract parameter-value pairs from the data object.

Claims

1. A system, comprising:

an electronic data store storing;

a security assessment data object containing a plurality of parameter-value pairs; and

an ingestion function that associates the security assessment data object with sensor results produced by a first sensor and comprising a plurality of data elements, such that each parameter-value pair of the plurality of parameter-value pairs has a corresponding data element of the plurality of data elements; and

a security assessment system comprising one or more hardware computing devices in communication with the electronic data store and configured to execute specific computer-executable instructions that upon execution cause the security assessment system to;

receive information describing a first rules package comprising a plurality of rules that evaluate security characteristics of a computing resource, the first rules package being prevented from accessing the sensor results to evaluate the security characteristics, a first rule of the plurality of rules being configured to read instances of the security assessment data object;

receive a request to perform a security assessment of a first virtual machine instance, the security assessment using the first sensor and the first rules package;

cause the first sensor to perform a data collection action on the first virtual machine instance to produce the sensor results;

using the ingestion function, copy the data elements in the sensor data that correspond to the plurality of parameter-value pairs in the security assessment data object into a first instance of the security assessment data object; and

cause the first rule of the first rules package to be executed against the first instance of the security assessment data object to produce an assessment result.

2. The system of claim 1, wherein the plurality of data elements in the sensor results include restricted data, and the security assessment data object abstracts the sensor results such that the plurality of rules in the first rules package are prevented from accessing the restricted data.

3. The system of claim 1, wherein the first virtual machine instance is allocated to a user, and to cause the first rule to be executed against the first instance of the security assessment data object, the security assessment system:

determines that the first instance of the security assessment data object includes user-identifying information identifying the user;

replaces the user-identifying information with obscuring information that masks the user'"'"'s identity, such that the first instance of the security assessment data object comprises anonymized assessment data; and

sends the first instance of the security assessment data object to be processed in a computing environment controlled by a provider of the first rules package, wherein the first rules package is executed against the anonymized assessment data.

4. The system of claim 1, wherein the first virtual machine is associated with a first user of a computing resource service provider, and the first rules package is submitted to the computing resource service provider by a vendor, the system further comprising one or more server computers associated with the computing resource service provider and in communication with the one or more hardware computing devices of the security assessment system, the one or more server computers comprising additional computer-executable instructions that upon execution cause the one or more server computers to:

provide, to the first user via a user computing device in communication with the one or more server computers, an electronic marketplace comprising a user interface that enables the first user to request that any of a plurality of rules packages, including the first rules package, be provisioned to a user account of the first user;

receive, from the user computing device, user input comprising a selection of the first rules package; and

cause the first rules package to be associated with the user account of the first user, such that the first user is enabled to submit the request to perform the security assessment using the first rules package.

5. A system, comprising one or more hardware computing devices configured to execute specific computer-executable instructions that upon execution cause the system to:

receive rules package data for a first rules package comprising a plurality of rules that, to determine one or more security characteristics of a computing resource, evaluate assessment data associated with the computing resource, the first rules package being prevented from evaluating sensor results produced by one or more sensors that perform data collection and monitoring actions on the computing resource;

receive a request to perform a security assessment of a target computing resource using the first rules package;

cause a first set of the data collection and monitoring actions to be performed on the target computing resource;

receive first data generated from the first set of the data collection and monitoring actions;

using an ingestion function that associates a data object with the sensor results, convert the first data into the assessment data; and

cause the first rules package to be executed against the assessment data to produce an assessment result.

6. The system of claim 5, wherein the first data comprises the sensor results in a first format, and converting the first data into the assessment data obscures the first format from the first rules package.

7. The system of claim 6, wherein the first data comprises a plurality of data elements including one or more private data elements, and converting the first data into the assessment data prevents the first rules package from accessing the one or more private data elements.

8. The system of claim 5, wherein the data object comprises a first parameter, a first value associated with the parameter, and a first retrieval method that, when executed, produces the first value;

and

wherein a first rule of the plurality of rules of the first rules package, when executed against the assessment data, calls the first retrieval method to obtain the first value.

9. The system of claim 5, wherein to receive the rules package data, further executing the specific computer-executable instructions causes the system to:

receive, from a computing device in communication with the one or more hardware computing devices, a request to create the first rules package for performing security assessments in the system;

provide to the computing device a user interface enabling a user of the computing device to create each of the plurality of rules to operate on the assessment data, and to enter user input indicating that at least one of the plurality of rules requires a first data element that is included in sensor results of a first sensor; and

receive the user input as the rules package data.

10. The system of claim 9, wherein execution of the specific computer-executable instructions further causes the system to:

determine that the first data element is obtained by the first sensor collecting data from the target computing resource; and

select the first set of data collection and monitoring actions to include execution of the first sensor on the target computing resource.

11. The system of claim 5, wherein the target computing resource is allocated to a first user, and execution of the specific computer-executable instructions further causes the system to:

provide, to the first user via a user computing device in communication with the one or more hardware computing devices, an electronic marketplace comprising a user interface that enables the first user to request that any of a plurality of available rules packages, including the first rules package, be provisioned to a user account of the first user;

receive, from the user computing device, user input comprising a selection of the first rules package; and

cause the first rules package to be associated with the user account of the first user, such that the first user is enabled to submit the request to perform the security assessment using the first rules package.

12. The system of claim 11, wherein the plurality of available rules packages each comprise a visibility indicator having a first value that indicates the corresponding rules package can be made available in the electronic marketplace, and execution of the specific computer-executable instructions further causes the system to:

receive second rules package data describing a second rules package created by a second user;

determine that the second rules package data includes the visibility indicator having a second value that indicates the second rules package cannot be made available in the electronic marketplace; and

exclude the second rules package from the electronic marketplace.

13. The system of claim 5, wherein a plurality of sensors installed on the target computing resource are configurable to generate sensor results comprising one or both of telemetry data and configuration data associated with the target computing resource, and the execution of the specific computer-executable instructions further causes the system to:

identify, from the rules package data, a plurality of data elements expected to be stored in the assessment data;

identify a first subset of the plurality of sensors that together generate sensor results that include the plurality of data elements; and

to cause the first set of data collection and monitoring actions to be performed, cause the first subset of sensors to activate.

14. A system, comprising one or more hardware computing devices configured to execute specific computer-executable instructions that upon execution cause the system to:

receive sensor results obtained by a plurality of sensors monitoring a computing resource, the sensor results having a first data structure;

using an ingestion function that associates the first data structure with a second data structure different from the first data structure, convert the sensor results to assessment data having the second data structure, the assessment data retaining a plurality of data elements of the sensor results;

prevent a first rules package configured to evaluate security characteristics of the computing resource from accessing the sensor results, wherein the first rules package requires the plurality of data elements and is configured to extract the plurality of data elements from the second data structure; and

perform a security assessment of the computing resource using the first rules package on the assessment data.

15. The system of claim 14, wherein the second data structure is a data object comprising a plurality of retrieval methods and the first rules package comprises a plurality of rules that are enabled to call one or more of the plurality of retrieval methods to obtain one or more of the plurality of data elements from the data object.

16. The system of claim 14, wherein upon execution the specific computer-executable instructions further cause the system to:

receive the first rules package;

execute one or more rules of the first rules package against the assessment data to produce an assessment result; and

determine, based on the assessment result, a corrective action to remediate a security vulnerability of the computing resource.

17. The system of claim 14, wherein the computing resource is allocated to a first user, and upon execution the specific computer-executable instructions further cause the system to:

determine that the assessment data includes user-identifying information identifying the first user;

replace the user-identifying information with obscuring information that masks the user'"'"'s identity to produce anonymized assessment data;

to perform the security assessment, cause an assessment system controlled by a provider of the first rules package to execute the first rules package against the anonymized assessment data; and

receive, from the assessment system, an assessment result associated with the anonymized assessment data.

18. The system of claim 17, wherein the computing resource is provided within a computing environment of a computing resource service provider, and the assessment system is not within the computing environment, and upon execution the specific computer-executable instructions further cause the system to, before causing the assessment system to execute the first rules package:

encrypt the anonymized assessment data; and

send the anonymized assessment data to the assessment system.

19. The system of claim 17, wherein to cause the assessment system to execute the first rules package against the anonymized assessment data, the system:

sends the anonymized assessment data to a first data storage service;

obtains a first location for the anonymized assessment data, wherein the first data storage service sends the anonymized assessment data to a requestor that connects to the first location; and

sends the first locator to the assessment system.

20. The system of claim 19, wherein to receive the assessment result, the system:

receives a second location from the assessment system, wherein a second data storage service sends the assessment result to a requestor that connects to the second location;

connects to the second location; and

receives the assessment result from the second data storage service.