Automated Intrusion Remediation Using Preprepared Resource Sanitization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional intrusion detection systems in storage systems lack the capability to automatically investigate and remediate unauthorized access, leaving the system vulnerable for an extended period, and require manual intervention by security personnel.
Innovation Solution
Implement an automated system that monitors for intrusions, determines illegitimate intrusions, and executes predefined rules to remediate the intrusion, using remediation materials to sanitize affected resources to their original state, ensuring high availability and minimizing system vulnerability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If conventional intrusion detection systems are used, then intrusion detection capability is provided, but automatic remediation capability is lacking and manual intervention is required
Solution Approach 1:
The system prepares remediation materials (sanitized copies of resources) in advance before any intrusion occurs. These remediation materials are created and stored in a controlled environment during the resource setup phase, so that when an intrusion is detected, the pre-prepared materials can be immediately applied to remediate the system without waiting for manual intervention or analysis.
2Reliability
If manual intervention by security personnel is used, then intrusion investigation and remediation can be performed, but system vulnerability duration is extended
Solution Approach 1:
The system performs self-service intrusion remediation by automatically detecting intrusions, determining illegitimacy, and applying pre-prepared remediation materials without requiring human intervention. The automated system monitors resources, evaluates detected intrusions against legitimacy criteria, and executes remediation actions independently, thereby eliminating the time delay associated with manual security personnel response.
3Ease of repair
If remediation materials are prepared in a controlled environment, then resource sanitization to original state is enabled, but system complexity increases
Solution Approach 1:
The system creates copies of resources in their original, sanitized state within a controlled environment. These copies serve as remediation materials that can be applied to restore compromised resources. By using copying rather than requiring complex reconstruction or analysis during remediation, the system simplifies the repair process while maintaining the capability to restore resources to their original state.
Data Source
AI summary
An example methodology includes, by a computing device, preparing remediation materials for use in remediating an intrusion on a resource of a computing system, monitoring the resource for intrusions, and detecting an intrusion on the resource based on the monitoring. The method also includes, responsive to a determination that the intrusion on the resource is an illegitimate intrusion, by the computing device, identifying at least one rule to execute to remediate the intrusion on the resource and running the identified at least one rule to remediate the intrusion on the resource, wherein the at least one rule defines one or more actions to sanitize the resource based on the remediation materials.