Cyber recovery to compromised production environment using microsegmentation
A computerized method and system is provided herein for enabling recovery of critical assets to a corrupted production environment prior to resolution of a security incident responsible for the corruption. Micro-segmentation and zero trust principles are applied to a production environment and a vault environment of a cyber-recovery system. Communities of interest (COIs) are created within the micro-segmented production environment, the vault environment, and a combination thereof (i.e., some production environment components can communicate with vault components). The verified security of the components within each COI ensures that only clean data is restored from a vault clean room to a production clean room within the production environment that is corrupted from the security incident.
1 . A computer-implemented method of restoring one or more critical assets to a production environment, the method comprising:
receiving an indication a security incident is occurring, wherein the security incident corrupts the production environment and creates a corrupted production environment;
identifying a clean copy of each of a plurality of critical assets, wherein a critical asset is an asset that is flagged as prioritized during a cyber-recovery to restore to the production environment;
dynamically generate a clean room in the corrupted production environment;
establishing a secure connection between the clean room in the corrupted production environment and a clean room in a vault, wherein the secure connection utilizes zero trust principles, and wherein the production environment and the vault are micro-segmented into a plurality of communities of interest; and
transmitting, to the clean room in the corrupted production environment, the clean copy of each of the plurality of critical assets.
2 . The computer-implemented method of claim 1 , wherein the clean copy is transmitted from a clean room in the vault.
3 . The computer-implemented method of claim 2 , wherein the clean room in the vault is separate from any other vault components.
4 . The computer-implemented method of claim 1 , wherein components communicate with other components in a same community of interest and cannot communicate with components in a different community of interest.
5 . The computer-implemented method of claim 4 , wherein the clean room in the vault and the clean room in the corrupted production environment are each in a same community of interest.
6 . One or more computer storage media storing computer-readable instructions thereon that, when executed by a processor, cause the processor to perform operations comprising:
receiving an indication a security incident is occurring, wherein the security incident corrupts the production environment and creates a corrupted production environment;
identifying a clean copy of each of a plurality of critical assets, wherein a critical asset is an asset that is flagged as prioritized during a cyber-recovery to restore to the production environment;
dynamically generate a clean room in the corrupted production environment;
establishing a secure connection between the clean room in the corrupted production environment and a clean room in a vault, wherein the production environment and the vault are micro-segmented into a plurality of communities of interest; and
transmitting, to the clean room in the corrupted production environment, the clean copy of each of the plurality of critical assets.
7 . The one or more computer storage media of claim 6 , wherein the clean coy is transmitted from a clean room in the vault.
8 . The one or more computer storage media of claim 7 , wherein the clean room in the vault is separate from any other vault components.
9 . The one or more computer storage media of claim 6 , wherein the secure connection utilizes zero trust principles.
10 . The one or more computer storage media of claim 6 , wherein components communicate with other components in a same community of interest and cannot communicate with components in a different community of interest.
11 . The one or more computer storage media of claim 6 , wherein the clean room in the vault and the clean room in the corrupted production environment are each in a same community of interest.