Security assessment of virtual machine environments

• US 8,850,512 B2
• Filed: 10/13/2011
• Issued: 09/30/2014
• Est. Priority Date: 10/13/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Bettini, Anthony, Price, Michael
• Primary Examiner(s): SHAW, BRIAN F
• Application Number:
  US13/272,484
• Publication Number:
  US 20130247133A1
• Time in Patent Office: 1,083 Days
• Field of Search: 718/1, 726/1, 726/12, 726/22, 726/23, 726/24, 713/164, 713/165, 713/166
• US Class Current: 726/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

Each virtual machine in a set of virtual machines managed by the virtual machine manager is identified. For each virtual machine in the set, it is determined whether the respective virtual machine is online. For at least the virtual machines determined to be offline, a machine image is collected for each offline virtual machine. Security of the offline virtual machines is assessed from the collected images. For virtual machines identified as online, an agent is loaded on each online virtual machine in the set via the virtual machine manager. The loaded agents are used to assess security of the online virtual machines in the set.

Claims

1. A method comprising:

identifying each virtual machine in a set of virtual machines managed by a virtual machine manager;

determining, for each virtual machine in the set, whether the respective virtual machine is online, wherein a first subset is determined to be offline and a second subset is determined to be online;

collecting, for each virtual machine in the first subset, a machine image of the virtual machine via the virtual machine manager;

causing a security tool authenticated by the virtual machine manager to assess security of each virtual machine in the first subset from the collected machine images;

loading a respective agent, via an application programming interface (API) of the virtual machine manager, on each virtual machine in the second subset, wherein each agent comprises logic to perform one or more security assessments within the corresponding online virtual machine and the API permits selective access to firewalled protected virtualized resources in the second subset of virtual machines; and

using the agents loaded on the virtual machines in the second subset to assess security of the corresponding virtual machines.

2. The method of claim 1, wherein identifying each virtual machine includes:

sending a query to the virtual machine manager for information for the set of virtual machines; and

receiving identification data, from the virtual machine manager, identifying each virtual machine in the set of virtual machines in response to the query.

3. The method of claim 2, wherein the identification data includes identification, for each virtual machine in the set of virtual machines, of whether the virtual machine is online.

4. The method of claim 2, wherein at least one of the query or identification data is communicated over an API of the virtual machine manager.

5. The method of claim 1, wherein the machine images of offline virtual machines in the set are sent via an API of the virtual machine manager.

6. The method of claim 1, further comprising collecting result data reporting results of the security assessment of the at least one online virtual machine, wherein the result data is collected from the agent over the API of the virtual machine manager.

7. The method of claim 1, wherein the agent is removed automatically at conclusion of the security assessment of the at least one online virtual machine.

8. The method of claim 1, wherein the set is a subset of the plurality of virtual machines managed by the virtual machine manager and the set comprises less than all of the plurality of virtual machines.

9. The method of claim 1, further comprising collecting result data from the security assessment of the offline virtual machines.

10. The method of claim 9, wherein the offline virtual machines include a plurality of offline virtual machines and the result data describes virtual-machine-specific security conditions for each of the plurality of offline virtual machines.

11. The method of claim 10, further comprising generating a virtual-machine-specific report for each of the plurality of offline virtual machines based at least in part on collected result data.

12. The method of claim 1, wherein assessing security of the offline virtual machines from the collected images includes reading each image file to identify security characteristics of each virtual machine in the offline virtual machines.

13. The method of claim 1, wherein assessing security of the offline virtual machines from the collected images further includes simulating operation of each offline virtual machine based on data in the corresponding image of the respective virtual machine.

14. The method of claim 1, wherein the plurality of virtual machines are firewalled.

15. The method of claim 1, further comprising authenticating, at the virtual machine manager, a security assessment tool.

16. The method of claim 1, wherein the security assessment of the offline virtual machines includes remedying at least one of a security vulnerability or policy violation detected for a particular one of the offline virtual machines before the particular virtual machine resumes online operation.

17. The method of claim 1, wherein the logic comprises logic to perform scans of the corresponding virtual machine to determine characteristics indicating one or more vulnerabilities of the virtual machine.

18. At least one non-transitory, machine-accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

identify each virtual machine in a set of virtual machines managed by a particular virtual machine manager;

determine, for each virtual machine in the set of virtual machines, whether the respective virtual machine is online, wherein a first subset is determined to be offline and a second subset is determined to be online;

collect, for each virtual machine in the first subset, a machine image of the virtual machine via the particular virtual machine manager;

cause a security tool authenticated by the virtual machine manager to assess security of each virtual machine in the first subset from the collected machine images;

load, on each virtual machine in the second subset, a respective agent, via an application programming interface (API) of the virtual machine manager, wherein each agent comprises logic to perform one or more security assessments within the corresponding online virtual machine and the API permits selective access to firewalled protected virtualized resources in the second subset of virtual machines; and

direct the agents loaded on the virtual machines in the second subset to assess security of the corresponding virtual machines.

19. A system comprising:

at least one processor device;

at least one memory element; and

a security assessment module, adapted when executed by the at least one processor device to;

identify each virtual machine in a set of virtual machines managed by a particular virtual machine manager;

determine, for each virtual machine in the set of virtual machines, whether the respective virtual machine is online, wherein a first subset is determined to be offline and a second subset is determined to be online;

collect, for each virtual machine in the first subset, a machine image of the virtual machine via the particular virtual machine manager;

cause a security tool authenticated by the virtual machine manager to assess security of each virtual machine in the first subset from the collected machine images;

load, via an API of the virtual machine manager, a respective agent, on each virtual machine in the second subset, wherein each agent comprises logic to perform one or more security assessments within the corresponding online virtual machine and the API permits selective access to firewalled protected virtualized resources in the second subset of virtual machines; and

direct the agents loaded on the virtual machines in the second subset to assess security of the corresponding virtual machines.