System and method for dynamic security provisioning of computing resources
View Patent ↗The present invention facilitates the dynamic provisioning of computing and data assets in a commodity computing environment. The invention provides a system and method for dynamically provisioning and de-provisioning computing resources based on multi-dimensional decision criteria. By employing specialized computing components configured to assess an asset and requestor of an asset, a provisioning engine is able to transform the input from the computing components into a specific configuration of computing resource provisioning and security controls. According to the rules and policies applying to a security domain, the provisioning engine may dynamically allocate computing resources in a manner that is both safe and efficient for the asset.
1. A method, comprising:
classifying, by a computer system of an entity, a software program into one of a plurality of classifications based on a value of the software program to the entity;
receiving, by the computer system and from a client device, a request to access the software program;
classifying, by the computer system, the client device into one of a plurality of classifications based on whether the client device is attempting to access the software program via a firewall;
based on the classification of the software program and the classification of the client device, assigning, by the computer system, the software program to one of a plurality of security domains, each of which has an associated set of security controls as defined by a set of domain rules stored in a database accessible to the computer system;
determining, by the computer system and based on the assigned security domain, whether to apply encryption to program data related to the software program; and
in response to the determining, applying encryption to the program data related to the software program.
2. The method of claim 1 , wherein the software program is assigned to the assigned security domain based on a source of a request associated with the software program.
3. The method of claim 1 , wherein the associated set of security controls of the assigned security domain includes a security control that is a requirement to use a firewall.
4. The method of claim 1 , wherein the plurality of classifications includes a low value, a medium value, and a high value.
5. The method of claim 1 , wherein the associated set of security controls of the assigned security domain includes a security control that is a requirement to use an intrusion detection service.
6. The method of claim 1 , wherein the software program is assigned to the assigned security domain based on whether the software program is accessible to a client external to the computer system.
7. The method of claim 1 , further comprising:
allocating, by the computer system, resources to the software program based on the assigned security domain.
8. The method of claim 7 , wherein the allocating includes terminating processes in response to the software program requiring an additional resource.
9. The method of claim 1 , further comprising:
determining, by the computer system, a location of a client requesting use of the software program; and
verifying, by the computer system and based on the location and the security domain, whether a patch is installed by the client.
10. A non-transitory computer readable medium having program instructions stored thereon that are executable by a computer system to cause the computer system to perform operations comprising:
determining a classification for an application based on a value of the application to an entity of the computer system;
receiving, by the computer system and from a client device, a request to access the application;
determining a classification for the client device based on whether the client device is located externally to a network that includes the computer system;
based on the classification for the application and the classification for the client device, placing the application into one of a plurality of security domains, each associated with a different set of security criteria stored in a database accessible to the computer system; and
based on the security domain into which the application is placed, determining to encrypt data related to the application; and
in response to the determining, causing encryption of the data related to the application.
11. The computer readable medium of claim 10 , wherein the operations further comprise:
based on the security domain, allocating resources of the computer system to the application.
12. The method of claim 1 , wherein the classifying includes determining a resource consumption of the software program.
13. The method of claim 1 , further comprising:
determining, by the computer system, whether to grant the request based on whether the client device has an installed patch.