Segmentation Policy Generation for Vulnerability Exposure

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current segmentation policies in computing environments fail to effectively manage vulnerabilities and exposure risks across workloads, leading to potential security breaches due to inadequate connectivity controls and lack of real-time risk assessment.

Innovation Solution

A segmentation server generates vulnerability exposure scores by analyzing permitted connectivity and detected vulnerabilities, creating a presentation of risk information and modifying the segmentation policy to reduce exposure, thereby enforcing a more secure communication strategy across workloads.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the segmentation policy permits broader connectivity between workloads, then productivity and ease of operation improve, but security reliability deteriorates due to increased vulnerability exposure

Engineering Contradiction:

Improveworkload connectivityVSAvoidsecurity reliability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent divides the network into segmented zones with controlled connectivity. The segmentation policy creates distinct security domains where workloads are grouped and isolated based on vulnerability profiles, allowing selective communication paths that maintain productivity while limiting exposure to specific vulnerability types in each segment

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system dynamically adjusts segmentation policy parameters based on vulnerability exposure scores. When vulnerability thresholds are exceeded, the policy automatically modifies connectivity parameters such as permitted ports, protocols, or workload groups, thereby reducing security risk while maintaining operational functionality through controlled parameter adjustments

Inventive Principle:

Principle #35Parameter changes

2Reliability

If the segmentation policy restricts connectivity to reduce vulnerability exposure, then security reliability improves, but productivity and ease of operation worsen

Engineering Contradiction:

Improvesecurity reliabilityVSAvoidworkload connectivity

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The segmentation policy is designed as a dynamic system that continuously monitors vulnerability exposure scores and automatically adjusts connectivity restrictions. Rather than static blocking, the policy adapts in real-time by modifying segmentation rules when vulnerability thresholds are crossed, allowing connectivity to be restored when risks are mitigated while maintaining security when vulnerabilities persist

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system implements feedback loops where vulnerability scanning results and exposure scores feed back into the segmentation policy decision-making process. This closed-loop control enables the policy to learn from vulnerability assessments and automatically adjust connectivity restrictions, balancing security requirements with operational needs through continuous monitoring and adaptation

Inventive Principle:

Principle #23Feedback

3Measurement precision

If manual vulnerability assessment and policy creation is performed, then measurement precision improves, but device complexity and time consumption increase

Engineering Contradiction:

Improvevulnerability assessment accuracyVSAvoidpolicy management complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The segmentation policy system performs self-assessment by automatically scanning workloads for vulnerabilities and calculating exposure scores without requiring manual intervention. The system autonomously generates segmentation policies based on its own vulnerability assessments, eliminating the need for external security analysts while maintaining high measurement precision through systematic automated evaluation

Inventive Principle:

Principle #25Self-service

4Measurement precision

If comprehensive vulnerability scanning is performed across all workloads, then measurement precision improves, but productivity and time consumption worsen

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoidscanning time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs vulnerability scanning on a partial basis initially, focusing on critical workloads or high-risk segments first. By scanning only the most vulnerable or important portions of the infrastructure initially, the system achieves sufficient measurement precision to create effective segmentation policies without the time cost of comprehensive full-system scanning, allowing progressive expansion as needed

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11665192B2Generating a segmentation policy based on vulnerabilities

Publication Date: 2023.05.30 ILLUMIO INC

AI summary

A segmentation server generates vulnerability exposure scores associated with workloads operating in a segmented computing environment. The segmentation server may automatically aggregate the vulnerability exposure scores in various ways to generate vulnerability exposure information representative of workloads in an administrative domain controlled by the segmentation server. The aggregated vulnerability exposure information may be presented in a manner that enables an administrator to easily evaluate different segmentation strategies and assess the risks associated with each of them. Moreover, the segmentation server can automatically generate a segmentation policy that modifies a configured segmentation strategy based on the vulnerability exposure scores to reduce exposure to certain vulnerabilities without impeding operation of the workloads.