Workload Segmentation Policy Provisioning from Telemetry Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users of workload protection solutions struggle with implementing effective segmentation strategies due to a lack of awareness of scopes, labels, hierarchies, and network policies, leading to increased vulnerability and time inefficiencies.
Innovation Solution
A system and method for automatically identifying and classifying network traffic to generate recommended policies using telemetry data, including scope data, label data, and application dependency mapping, with agents deployed to collect data and apply policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users manually implement segmentation strategies without training, then they can configure network policies, but it increases complexity and time requirements significantly
Solution Approach 1:
The system performs self-service by automatically discovering workloads, classifying traffic patterns, and generating segmentation policies without requiring manual user input or training. The workload protection solution autonomously analyzes telemetry data and creates scope hierarchies, labels, and network policies based on best practices, eliminating the need for users to manually configure these complex elements.
Solution Approach 2:
The system performs preliminary actions by pre-defining scope hierarchies, classification criteria, and policy templates based on industry best practices before the user needs to implement segmentation. This preliminary preparation allows the system to automatically generate appropriate segmentation strategies without requiring users to understand or manually create these complex structures.
2Reliability
If users manually configure network policies, then they can control traffic flow, but it increases the time the network remains vulnerable
Solution Approach 1:
The system performs preliminary security measures by automatically discovering workloads and generating segmentation policies before the network is fully exposed to threats. By continuously monitoring traffic patterns and proactively creating protective policies, the system minimizes the time the network remains vulnerable while ensuring comprehensive security coverage.
Solution Approach 2:
The workload protection solution operates continuously, constantly monitoring network traffic, discovering workloads, and updating segmentation policies in real-time. This continuous action ensures that the network maintains security reliability without interruption, eliminating gaps where vulnerabilities could exist between manual configuration steps.
3Measurement precision
If the system collects comprehensive telemetry data, then it can generate accurate policy recommendations, but it increases data processing complexity
Solution Approach 1:
The system segments the complex data processing task into distinct functional components: workload discovery, traffic pattern classification, policy generation, and compliance verification. Each component processes specific types of telemetry data independently, reducing the complexity of handling comprehensive data while maintaining high measurement precision through specialized processing algorithms.
Solution Approach 2:
The system introduces intermediary processing layers that translate raw telemetry data into meaningful classifications and policy recommendations. These intermediary components act as mediators between data collection and policy generation, simplifying the overall data processing complexity while preserving the precision needed for accurate traffic classification and secure policy creation.
Data Source
AI summary
Devices, systems, methods, and processes for automatically generating, at least in part, a segmentation strategy. Users of workload protection solutions can initiate a process to deploy various agents onto a network with one or more operating systems. The initial scope may be defined via one or more best practices to generate a scope tree. Associated labels may be defined based on the scope design and any subnets learned from the installed agent interface subnets. Common services can also be defined based on well known ports and/or protocols. Agent-based host names can also be evaluated to define potential application groupings. A generated application dependency mapping can be applied to understand potential application boundaries and potential policy recommendations. These steps can help a user to begin their segmentation strategy when deploying a workload protection solution.