Auto-populating Whitelists via Provisioning Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise applications face vulnerabilities due to new processes or executables that are not yet detected on blacklists, and whitelists must be custom-generated for each system, making them impractical for widespread use.
Innovation Solution
Automatically populating process-connection whitelists using provisioning information from systems like Chef, Puppet, or Ansible, which identifies allowed processes and connections, and using this information to create context-dependent whitelists that map processes to allowed connection destinations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If whitelists are custom-generated for each system to improve security accuracy, then security effectiveness is improved, but device complexity and operational burden increase
Solution Approach 1:
The system automatically generates whitelists by monitoring and analyzing actual process connections and behaviors without requiring manual configuration. The security agent autonomously observes which processes connect to which destinations and automatically adds these to the whitelist, eliminating the need for manual whitelist creation and maintenance while maintaining high security accuracy.
Solution Approach 2:
The system performs preliminary monitoring and analysis of process connections before finalizing the whitelist configuration. By observing actual system behavior in advance and pre-identifying legitimate connections, the system prepares accurate whitelists proactively rather than reacting to security incidents, thereby improving security effectiveness while automating the process.
2Ease of operation
If blacklists are used to block known problematic processes, then ease of operation is improved, but reliability decreases due to undetected new threats
Solution Approach 1:
Instead of using a blacklist approach that blocks only known threats, the system inverts the logic by using a whitelist approach that allows only verified legitimate processes. By monitoring actual system behavior and automatically whitelist-approved connections, the system achieves both ease of operation and high reliability against new threats, as any connection not on the whitelist is automatically blocked regardless of whether the process is newly created or modified.
3Reliability
If manual whitelist updates are performed to maintain security, then security accuracy is improved, but productivity and time efficiency worsen
Solution Approach 1:
The security agent automatically monitors process connections, identifies legitimate communication patterns, and updates the whitelist without human intervention. This self-service approach maintains high whitelist accuracy by basing entries on actual observed behavior while dramatically improving deployment speed and reducing the time required for whitelist maintenance.
Solution Approach 2:
The system continuously monitors actual process connections and uses this feedback to automatically update and refine the whitelist. By implementing a closed-loop feedback mechanism where observed behavior directly informs whitelist updates, the system maintains high accuracy while eliminating manual update tasks, thereby improving both reliability and productivity.
Data Source
AI summary
A security system for a distributed application obtains and, in effect, preserves provisioning information for the purpose of auto-populating whitelists used to protect the distributed application from intrusions. The provisioning information identifies allowable connections on a software-package level. Entries mapping processes to connection destinations are added to a whitelist if a process requesting a connection results from execution of an executable file installed as part of a software package for which the connection was allowed according to the provisioning information.