SYSTEMS AND METHODS FOR DYNAMICALLY DEPLOYING SECURITY PROFILES
System, methods, and apparatuses enable a network security system to more efficiently deploy security profiles to virtual servers managed by the network security application. For example, a network security application is enabled to more efficiently deploy security profiles to new virtual servers as the virtual servers are created in a computing environment, where the new virtual servers may have varying security requirements. A security profile herein refers to a set of security policy configurations related to various functions of a virtual server including, for example, to which networks a virtual server is permitted to access, security configurations for applications running on the virtual server, user permissions, etc.
1 . A computer-implemented method, comprising:
generating, for a plurality of existing virtual servers, server profile data indicating values for a plurality of properties associated with each of the plurality of existing virtual servers;
receiving an indication that a hypervisor is hosting a new virtual server associated with a plurality of property values;
in response to receiving the indication, comparing the property values associated with the new virtual server against the server profile data to identify a closest matching existing virtual server, wherein the closest matching existing virtual server is associated with a security policy from a plurality of stored security policies;
deploying the security policy associated with the closest matching existing virtual server to the new virtual server.
2 . The method of claim 1 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a set of networks to which the existing virtual server is permitted to access.
3 . The method of claim 1 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a set of computer applications hosted by the existing virtual server.
4 . The method of claim 1 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a type of hypervisor hosting the existing virtual server.
5 . The method of claim 1 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, an operating system version running on the existing virtual server.
6 . The method of claim 1 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a software patch status associated with one or more computer applications hosted by the existing virtual server.
7 . The method of claim 1 , wherein comparing the property values associated with the new virtual server against the server profile data includes identifying one or more existing virtual servers running a same operating system and having a same or older software patch status.
8 . The method of claim 1 , wherein deploying the security policy to the new virtual server comprises sending the security policy to the new virtual server.
9 . The method of claim 1 , wherein deploying the security policy to the new virtual server comprises sending a reference to the security policy.
10 . The method of claim 1 , wherein the security policy specifies configurations related to one or more of an interface policy, an access control policy, an encryption policy, a data loss prevention policy.
11 . A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:
generating, for a plurality of existing virtual servers, server profile data indicating values for a plurality of properties associated with each of the plurality of existing virtual servers;
receiving an indication that a hypervisor is hosting a new virtual server associated with a plurality of property values;
in response to receiving the indication, comparing the property values associated with the new virtual server against the server profile data to identify a closest matching existing virtual server, wherein the closest matching existing virtual server is associated with a security policy from a plurality of stored security policies;
deploying the security policy associated with the closest matching existing virtual server to the new virtual server.
12 . The non-transitory computer-readable storage medium of claim 11 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a set of networks to which the existing virtual server is permitted to access.
13 . The non-transitory computer-readable storage medium of claim 11 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a set of computer applications hosted by the existing virtual server.
14 . The non-transitory computer-readable storage medium of claim 11 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a type of hypervisor hosting the existing virtual server.
15 . The non-transitory computer-readable storage medium of claim 11 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, an operating system version running on the existing virtual server.
16 . The non-transitory computer-readable storage medium of claim 11 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a software patch status associated with one or more computer applications hosted by the existing virtual server.
17 . The non-transitory computer-readable storage medium of claim 11 , wherein comparing the property values associated with the new virtual server against the server profile data includes identifying one or more existing virtual servers running a same operating system and having a same or older software patch status.
18 . The non-transitory computer-readable storage medium of claim 11 , wherein deploying the security policy to the new virtual server comprises sending the security policy to the new virtual server.
19 . The non-transitory computer-readable storage medium of claim 11 , wherein deploying the security policy to the new virtual server comprises sending a reference to the security policy.
20 . The non-transitory computer-readable storage medium of claim 11 , wherein the security policy specifies configurations related to one or more of an interface policy, an access control policy, an encryption policy, a data loss prevention policy.
21 . An apparatus, comprising:
one or more processors;
a non-transitory computer-readable storage medium coupled to the one or more processors, the computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to:
generate, for a plurality of existing virtual servers, server profile data indicating values for a plurality of properties associated with each of the plurality of existing virtual servers;
receive an indication that a hypervisor is hosting a new virtual server associated with a plurality of property values;
in response to receiving the indication, compare the property values associated with the new virtual server against the server profile data to identify a closest matching existing virtual server, wherein the closest matching existing virtual server is associated with a security policy from a plurality of stored security policies;
deploy the security policy associated with the closest matching existing virtual server to the new virtual server.
22 . The apparatus of claim 21 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a set of networks to which the existing virtual server is permitted to access.
23 . The apparatus of claim 21 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a set of computer applications hosted by the existing virtual server.
24 . The apparatus of claim 21 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a type of hypervisor hosting the existing virtual server.
25 . The apparatus of claim 21 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, an operating system version running on the existing virtual server.
26 . The apparatus of claim 21 , wherein the server profile data indicates, for each existing virtual server of the plurality of existing virtual servers, a software patch status associated with one or more computer applications hosted by the existing virtual server.
27 . The apparatus of claim 21 , wherein comparing the property values associated with the new virtual server against the server profile data includes identifying one or more existing virtual servers running a same operating system and having a same or older software patch status.
28 . The apparatus of claim 21 , wherein deploying the security policy to the new virtual server comprises sending the security policy to the new virtual server.
29 . The apparatus of claim 21 , wherein deploying the security policy to the new virtual server comprises sending a reference to the security policy.
30 . The apparatus of claim 21 , wherein the security policy specifies configurations related to one or more of an interface policy, an access control policy, an encryption policy, a data loss prevention policy.