Dynamic adaptive defense for cyber-security threats
Disclosed is a cyber-security system that is configured to aggregate and unify data from multiple components and platforms on a network. The system allows security administrators can to design and implement a workflow of device-actions taken by security individuals in response to a security incident. Based on the nature of a particular threat, the cyber-security system may initiate an action plan that is tailored to the security operations center and their operating procedures to protect potentially impacted components and network resources.
1. A method performed by a cyber-security system, comprising:
receiving a cyber-security alert;
analyzing the cyber-security alert to determine a security threat to a network;
configuring an action plan, in accordance with an established network security policy, targeted to remediate the security threat;
initiating an execution of at least one automated action pursuant to the action plan to respond to the security threat when the security threat is a first type, the at least one automated action being executed automatically without specific human intervention;
mapping the security threat to a plurality of preplanned actions based on the security threat and in accordance with the action plan, the plurality of preplanned actions approved for an administrator to initiate;
receiving an administrator input to initiate at least one preplanned action from the plurality of preplanned actions;
initiating, in response to the administrator input, an execution of the at least one preplanned action to respond to the security threat;
determining when the security threat is mitigated by the execution of at least one of (i) the at least one automated action, or (ii) the at least one preplanned action; and
generating a security threat response report that includes data regarding mitigation of the security threat and the at least one of (i) the at least one automated action or (ii) the at least one preplanned action.
2. The method of claim 1 , wherein:
each preplanned action from the plurality of preplanned actions associated with a network security element from a plurality of network security elements of the network;
the initiating the execution of the at least one preplanned action includes executing the preplanned action to a network security element from the plurality of network security elements and associated with the preplanned action.
3. The method of claim 1 , wherein:
the administrator input is a first administrator input;
the method further includes:
providing, based on the security threat, information associated with a plurality of custom actions;
providing a plurality of network security elements, each custom action from the plurality of custom actions not being specifically correlated with any network security element from the plurality of network security elements in the established network security policy;
receiving a second administrator input that correlates a custom action from the plurality of custom actions with a network security element from the plurality of network security elements; and
initiating, in response to the second administrator input, an execution of the custom action to the network security element to respond to the security threat.
4. The method of claim 1 , wherein:
the administrator input is a first administrator input;
the at least one preplanned action is a first preplanned action;
the method further includes:
receiving a second administrator input to approve a second preplanned action from the plurality of preplanned actions, and
initiating, in response to the second administrator input, an execution of the second preplanned action to respond to the security threat.
5. The method of claim 1 , further comprising:
applying the at least one automated action and the at least one preplanned action to a plurality of network security elements associated with the network.
6. The method of claim 1 , further comprising:
when the security threat is not mitigated by the execution of the at least one of (i) the at least one automated action, or (ii) the at least one preplanned action,
continuing to initiate, pursuant to the action plan, an automated action from a plurality of automated actions or a preplanned action from the plurality of preplanned actions until the security threat is mitigated.
7. The method of claim 1 , further comprising:
updating the established network security policy based on the determining when the security threat is mitigated.
8. The method of claim 7 , wherein:
the security threat is a first security threat, and
when the security threat is mitigated by the execution of the at least one preplanned action, the updating the established network security policy includes adding the at least one preplanned action to the established network security policy as an automated action for further implementation without specific human intervention in response to a second security threat after the first security threat.
9. The method of claim 1 , wherein:
the administrator input includes a selection of the at least one preplanned action and a selection of a network security element from a plurality of network security elements, and
the initiating the execution of the at least one preplanned action includes executing the at least one preplanned action to the network security element.
10. The method of claim 3 , further comprising:
displaying the plurality of network security elements in a network security map in a graphical user interface;
displaying representations of the plurality of custom actions in the network security map; and
receiving the second administrator input via the graphical user interface to correlate the custom action with the network security element and trigger the initiation of the execution of the custom action to the network security element.
11. The method of claim 1 , wherein:
the established network security policy includes cyber-security actions that have been approved to respond to the security threat prior to the security threat occurring.
12. The method of claim 11 , wherein:
the established network security policy includes a cyber-security action that forbids disconnecting a manager's computer without an advance notice, the cyber-security action requiring a security administrator to approve the cyber-security action after the advance notice.
13. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:
receive a cyber-security alert;
analyze the cyber-security alert to determine a security threat to a network;
configure an action plan, in accordance with an established network security policy, targeted to remediate the security threat;
initiate an execution of a first level action pursuant to the action plan to respond to the security threat, the first level action being executed automatically without specific human intervention;
determine when the security threat is mitigated after the first level action is executed;
when the security threat is not mitigated after the first level action is executed, map the security threat to a plurality of second level actions based on the security threat and in accordance with the action plan, the plurality of second level actions not approved to be automatically initiated and approved for an administrator to initiate;
receive an administrator input to select at least one second level action from the plurality of second level actions; and
initiate, in response to the administrator input, an execution of the at least one second level action to respond to the security threat.
14. The non-transitory processor-readable medium of claim 13 , wherein:
the administrator input is a first administrator input;
the code further includes code to cause the processor to:
determine when the security threat is mitigated after the at least one second level action is executed; and
when the security threat is not mitigated after the at least one second level response is executed,
provide, based on the security threat, information associated with a plurality of third level actions;
provide a plurality of network security elements, each third level action from the plurality of third level actions not being specifically correlated with each network security element from the plurality of network security elements in a network security policy;
receive a second administrator input that correlates a third level action from the plurality of third level actions with a network security element from the plurality of network security elements; and
initiate, in response to the second administrator input, an execution of the third level action to the network security element correlated with the third level action to respond to the security threat.
15. The non-transitory processor-readable medium of claim 13 , wherein the code further includes code to cause the processor to:
determine when the security threat is mitigated by the execution of the at least one second level action; and
when the security threat is not mitigated by the execution of the at least one second level action, continue to execute at least one of (i) a plurality of first level actions, or (ii) the plurality of second level actions until the security threat is mitigated.
16. The non-transitory processor-readable medium of claim 14 , wherein the code further includes code to cause the processor to:
determine when the security threat is mitigated by the execution of the third level action; and
when the security threat is not mitigated by the execution of the third level action, continue to execute at least one of (i) a plurality of first level actions, (ii) the plurality of second level actions, or (iii) the plurality of third level actions until the security threat is mitigated.
17. The non-transitory processor-readable medium of claim 13 , wherein:
each second level action from the plurality of second level actions associated with a network security element from a plurality of network security elements;
the code includes code to cause the processor to initiate the execution of the at least one second level action by executing the at least one second level action to a network security element associated with the at least one second level action.
18. The non-transitory processor-readable medium of claim 13 , wherein the code further includes code to cause the processor to:
update the established network security policy based on the determining when the security threat is mitigated by the execution of the at least one second level action.
19. The non-transitory processor-readable medium of claim 18 , wherein:
the security threat is a first security threat, and
when the security threat is mitigated by the execution of the at least one preplanned action, the code includes code to cause the processor to update the established network security policy by adding the at least one second level action to the established network security policy as an action after the first level action for further implementation without specific human intervention in response to a second security threat after the first security threat.
20. A method, comprising:
receiving a cyber-security alert;
analyzing the cyber-security alert to determine a security threat to a network;
initiating an execution of a first level action to respond to the security threat, the first level action being executed automatically without specific human intervention;
determining when the security threat is mitigated after the first level action is executed;
when the security threat is not mitigated after the first level action is executed, mapping the security threat to a plurality of second level actions based on the security threat, the plurality of second level actions not approved to be automatically initiated and approved for an administrator to initiate;
receiving an administrator input to select at least one second level action from the plurality of second level actions;
initiating, in response to the administrator input, an execution of the at least one second level action to respond to the security threat;
determining when the security threat is mitigated by the execution of the at least one second level action; and
when the security threat is not mitigated after the at least one second level action is executed, continuing to execute at least one of (i) a plurality of first level actions, or (ii) the plurality of second level actions until the security threat is mitigated.
21. The method of claim 20 , wherein:
the administrator input includes a selection of the at least one second level action and a selection of a network security element from a plurality of network security elements, and
the initiating the execution of the at least one second level action includes applying the at least one second level action to the network security element.
22. The method of claim 20 , further comprising:
configuring an action plan, in accordance with an established network security policy, targeted to remediate the security threat; and
the mapping the security threat to the plurality of second level actions is based on the security threat and in accordance with the action plan.
23. The method of claim 22 , wherein:
the established network security policy includes a cyber-security action that forbids disconnecting a manager's computer without an advance notice, the cyber-security action requiring a security administrator to approve the cyber-security action after the advance notice.