Offline Virtual Machine Image Compliance Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively assess and ensure compliance of off-line virtual machine images before they are reinstated into a network, leading to potential security and compliance issues due to unlicensed software, viruses, and outdated patches.
Innovation Solution
A method and system that utilize virtualization APIs to inspect and fix off-line virtual machine images by scanning their filesystems, preventing non-compliant images from going online and performing deep analysis in an isolated environment without network connectivity, using automation APIs to execute compliance checks and sensors without altering the virtual machine's filesystem.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a virtual machine image is restored and tested in a closed virtual environment, then compliance and security can be assessed, but it consumes significant resources and triggers noncompliance events or security issues
Solution Approach 1:
The system performs compliance assessment and security scanning on virtual machine images before they are restored to the virtualization infrastructure. By conducting the assessment in advance on the source system rather than after restoration, the system ensures that only compliant images are brought online, avoiding resource-intensive re-assessments and preventing security incidents.
Solution Approach 2:
The invention introduces an intermediary compliance assessment system that acts as a bridge between the source system containing virtual machine images and the target virtualization infrastructure. This intermediary system scans and validates images before they are transferred and restored, ensuring compliance without requiring the target infrastructure to consume resources for testing.
2Reliability
If a virtual machine is restored and tested in a network environment, then security and compliance can be verified, but it negatively impacts security levels and triggers noncompliance events
Solution Approach 1:
Security scanning and compliance verification are performed before the virtual machine image is restored to the virtualization infrastructure. The assessment system scans the image on the source system, identifies security issues, and ensures compliance with policies before the image is brought online, thereby preventing security risks from affecting the network environment.
Solution Approach 2:
The system applies preliminary anti-action by proactively identifying and flagging security issues and non-compliant configurations before the virtual machine is restored. By detecting and addressing potential security threats in advance, the system prevents harmful factors from being introduced into the network environment.
3Reliability
If compliance assessment is performed on an active virtual machine, then security issues can be detected, but the virtual machine must be active which complicates the assessment process
Solution Approach 1:
Instead of assessing compliance on an active virtual machine, the system inverts the approach by performing the assessment on the virtual machine image file while it is in an inactive state on the source system. This allows the compliance assessment system to scan the image without requiring it to be powered on or integrated into the virtualization infrastructure, simplifying the process while maintaining detection effectiveness.
Data Source
AI summary
A method of determining the compliance of a virtual machine image during a process to potentially introduce the virtual machine image into a network, the method comprising: identifying one or more virtual machine images; controlling the or each virtual machine image such that it cannot connect to the network; carrying out one or more tests to determine if the or each virtual machine image is compliant with one or more predetermined requirements; if a virtual machine is compliant with said one or more predetermined requirement, introducing the virtual machine image to the network.