Security Microservice Segmentation for Selective Exploit Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security systems apply exploit mitigation to all resources in a resource group, regardless of impact, leading to excessive false positives, performance impairment, and resource consumption, as not all resources within a group may be affected by the security exploit or vulnerability.
Innovation Solution
A security microservice identifies impacted and non-impacted resource groups within a resource group and applies exploit mitigation only to the impacted resources, while allowing non-impacted resources to operate without unnecessary modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If exploit mitigation is applied to all resources in a resource group, then security coverage is improved, but false positives and resource consumption increase
Solution Approach 1:
The patent segments the resource group into impacted and non-impacted subsets based on vulnerability assessment. The security microservice identifies which specific resources are affected by the exploit and applies mitigation only to those resources, rather than uniformly to the entire resource group. This segmentation eliminates false positives for non-impacted resources while maintaining security coverage for impacted resources.
2Reliability
If exploit mitigation is applied to all resources in a resource group, then security coverage is improved, but performance impairment increases
Solution Approach 1:
The patent segments the resource group into impacted and non-impacted subsets based on vulnerability assessment. The security microservice identifies which specific resources are affected by the exploit and applies mitigation only to those resources, rather than uniformly to the entire resource group. This segmentation eliminates unnecessary performance impairment for non-impacted resources while maintaining security coverage for impacted resources.
3Reliability
If exploit mitigation is applied to all resources in a resource group, then security coverage is improved, but resource consumption increases
Solution Approach 1:
The patent segments the resource group into impacted and non-impacted subsets based on vulnerability assessment. The security microservice identifies which specific resources are affected by the exploit and applies mitigation only to those resources, rather than uniformly to the entire resource group. This segmentation eliminates unnecessary resource consumption for non-impacted resources while maintaining security coverage for impacted resources.
4Object-generated harmful factors
If resource group is split into impacted and non-impacted groups, then false positives are reduced, but device complexity increases
Solution Approach 1:
The security microservice automatically performs vulnerability assessment, resource classification, and mitigation application without requiring manual intervention. The system self-manages the complexity of identifying impacted versus non-impacted resources and dynamically adjusting security policies, eliminating the need for manual system configuration while reducing false positives.
Data Source
AI summary
Systems, methods, and apparatuses enable one or more security microservices to resolve the disparate impact of security exploits to resources within a resource group. When a resource group is determined to be impacted by a security exploit, the one or more security microservices determines whether the members of the resource group are disparately impacted. In response, the one or more security microservices splits the resource group into an impacted resource group and a non-impacted resource group and applies exploit mitigation to the resource group members in the impacted resource group. When the one or more security microservices determine that the resource group members of the split resource group are no longer disparately impacted, the one or more security microservices combine the impacted resource group and the non-impacted resource group back into a single resource group.