Componentized security policy generation
A continuous security delivery fabric is disclosed. One or more security functions, comprising one or more tasks to be performed by a security tool, utility or service is encapsulated in a componentized security policy. A target list comprising of one or more items in an information technology installation is received. One or more security functions capable of being performed on at least one item in the received target list are selected. A componentized security policy encapsulating one or more security routines orchestrating the performance of at least one of the selected security functions is then created.
1. A method to remediate information technology installation security issues, comprising:
receiving data identifying an item in an information technology installation;
selecting a security function capable of being performed on the item in the information technology installation;
creating a componentized security policy encapsulating one or more security routines orchestrating the performance of the security function;
executing the one or more encapsulated security routines against a shadow environment that is a mirror instance of the information technology installation;
receiving results from the execution of the one or more encapsulated security routines against the shadow environment; and
based on the results, determining whether a security issue exists.
2. The method of claim 1 ,
wherein the componentized security policy is configured to be used in conjunction with at least one other componentized security policy.
3. The method of claim 1 ,
wherein the componentized security policy is configured to create an output report where results of the componentized security policy are integrated with results of at least one other componentized security policy.
4. The method of claim 1 ,
wherein the componentized security policy includes any combination of:
a code scan policy;
an application scan policy; and
a development security operations policy.
5. The method of claim 1 , wherein the security function is configured to be executed via a microservice.
6. The method of claim 1 , further comprising scheduling a time for the one or more encapsulated security routines to be executed.
7. A system, comprising:
one or more processors; and
memory including a plurality of computer-executable components that are executable by the one or more processors to perform a plurality of acts, the plurality of acts comprising:
receiving data identifying an item in an information technology installation;
selecting a security function capable of being performed on the item in the information technology installation;
creating a componentized security policy encapsulating one or more security routines orchestrating the performance of the security function;
executing the one or more encapsulated security routines against a shadow environment that is a mirror instance of the information technology installation;
receiving results from the execution of the one or more encapsulated security routines against the shadow environment; and
based on the results, determining whether a security issue exists.
8. The system of claim 7 ,
wherein the componentized security policy is configured to be used in conjunction with at least one other componentized security policy.
9. The system of claim 7 ,
wherein the componentized security policy is configured to create an output report where results of the componentized security policy are integrated with results of at least one other componentized security policy.
10. The system of claim 7 ,
wherein the componentized security policy includes any combination of:
a code scan policy;
an application scan policy; and
a development security operations policy.
11. The system of claim 7 , wherein the security function is configured to be executed via a microservice.
12. The system of claim 7 , wherein the plurality of acts further comprise scheduling a time for the one or more encapsulated security routines to be executed.
13. One or more non-transitory computer-readable media storing computer-executable instructions that upon execution cause one or more processors to perform acts comprising:
receiving data identifying an item in an information technology installation;
selecting a security function capable of being performed on the item in the information technology installation;
creating a componentized security policy encapsulating one or more security routines orchestrating the performance of the security function;
executing the one or more encapsulated security routines against a shadow environment that is a mirror instance of the information technology installation;
receiving results from the execution of the one or more encapsulated security routines against the shadow environment; and
based on the results, determining whether a security issue exists.
14. The one or more non-transitory computer-readable media of claim 13 ,
wherein the componentized security policy is configured to be used in conjunction with at least one other componentized security policy.
15. The one or more non-transitory computer-readable media of claim 13 ,
wherein the componentized security policy is configured to create an output report where results of the componentized security policy are integrated with results of at least one other componentized security policy.
16. The one or more non-transitory computer-readable media of claim 13 ,
wherein the componentized security policy includes any combination of:
a code scan policy;
an application scan policy; and
a development security operations policy.
17. The one or more non-transitory computer-readable media of claim 13 , wherein the security function is configured to be executed via a microservice.
18. The method of claim 1 ,
wherein the information technology installation includes one or more software systems that automate operations of an enterprise.