Custom Security Assessment Service for Virtual Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data center security assessment technologies face challenges in effectively interfacing with custom security rules packages and third-party services, particularly in virtualized environments, leading to vulnerabilities and inefficiencies in identifying and mitigating security risks across diverse computing resources.
Innovation Solution
The system enables computing resource service providers to interface with security assessments and rules packages authored by customers or third parties, allowing for customization, configuration, and activation of security assessments on virtual computing resources, using a scanning service that executes rules against collected data to identify vulnerabilities and generate assessment results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If security assessments use standardized rules packages, then assessment execution is simplified and automated, but the ability to address custom security requirements and third-party rules is limited
Solution Approach 1:
The system implements a universal assessment execution service that can handle multiple types of rules packages (standardized, custom, third-party) through a common interface. The service receives assessment parameters including rules package identifiers, executes the appropriate rules against target computing resources, and returns results in a standardized format, making the system versatile enough to accommodate different rule sources while maintaining automated execution
2Measurement precision
If security assessments analyze detailed computing resource data, then vulnerability identification accuracy is improved, but user data security and privacy are compromised
Solution Approach 1:
The system extracts only the specific security-relevant parameters needed for vulnerability assessment from the computing resources, rather than analyzing all available data. The assessment execution service receives targeted parameters (such as configuration settings, software versions, and security policies) and processes only these essential elements to identify vulnerabilities, minimizing data exposure while maintaining assessment accuracy
3Adaptability or versatility
If the system supports multiple third-party rules packages and custom assessments, then security assessment versatility is improved, but system complexity increases
Solution Approach 1:
The assessment execution service acts as an intermediary layer between diverse rules packages and the target computing resources. It receives assessment requests with rules package identifiers, resolves the appropriate rules, executes them against the targets, and returns results in a unified format. This intermediary approach allows the system to support multiple third-party and custom rules packages without increasing overall system complexity, as the service abstracts the diversity of rules into a standardized execution process
Data Source
AI summary
Systems for performing a security assessment of a target computing resource, such as a virtual machine or an instance of a virtual machine, include a security assessment service that enables the use of third-party-authored rules packages in the security assessment. The third-party rules package includes rules that can operate on telemetry and configuration data of the target computing resource, produced by sensors that are native to the computing environment, but the sensor protocols, message format, and sensitive data are not exposed to the rules. An interface, such as an ingest function, may be used to convert telemetry data in the form of sensor messages into assessment data objects. The assessment data objects contain the data elements the rules evaluate, and may also have corresponding retrieval methods that are exposed to the rules; the rules call the retrieval methods to extract parameter-value pairs from the data object.