User behavior based security in a software defined data center
Behavior-based security in a datacenter includes monitoring user actions made by users in the datacenter. Behavior-based risk scores are computer for users based on their monitored actions. One or more firewall rules are generated for users based on their behavior-based risk scores. The firewall rules regulate the actions of the users.
1. A method comprising:
detecting, by one or more computers, computer-related actions performed by a user;
logging, by one or more of the computers, a logged event that includes the user's detected computer-related actions and the user that performed the detected computer-related actions;
computing, by one or more of the computers, one or more behavior-based risk scores for the user based on the user's computer-related actions;
receiving, by a rule builder, the logged event;
building, by the rule builder, one or more new behavior-based firewall rules for each different type of detected computer-related action by the user wherein the one or more new behavior-based firewall rules are based on the detected computer-related actions included in the logged event and the one or more behavior-based risk scores for the user;
inserting, by the rule builder, the one or more new behavior-based firewall rules into a firewall table;
periodically updating the user's one or more behavior-based risk scores as additional computer-related actions by the user are detected and logged;
updating the user's one or more behavior-based firewall rules by deleting previously built behavior-based firewall rules and building new behavior-based firewall rules based on the user's updated one or more behavior-based risk scores;
regulating, by one or more of the computers, the user's computer-related actions according to at least the one or more new behavior-based firewall rules inserted into the firewall table.
2. The method of claim 1 , wherein the one or more behavior-based risk scores include one or more of a risk score associated with failed login attempts, of a risk score associated with accessing files, of a risk score associated with accessing servers in the enterprise, of a risk score associated with accessing the network, of a risk score associated with installing software, and of a risk score associated with executing processes.
3. The method of claim 1 , wherein the user's computer-related actions are associated with corresponding vulnerability ratings, wherein the user's one or more behavior-based risk scores are computed using the vulnerability ratings corresponding to the user's computer-related actions.
4. The method of claim 1 , wherein regulating the user's computer-related actions includes at least one of allowing or denying the user from logging onto a computer system, allowing or denying the user access to a file or a server, allowing, denying, or redirecting a destination of a network access, allowing or denying the user from installing software, and allowing or denying execution of a process.
5. A non-transitory computer-readable storage medium having stored thereon computer executable instructions, which when executed by a computer device, cause the computer device to:
detect computer-related actions performed by a user;
log the user's computer-related actions as a logged event that includes the user's detected computer-related actions and the user that performed the detected computer-related actions;
compute one or more behavior-based risk scores for the user based on the user's computer-related actions;
receive, by a rule builder, the logged event;
build, by the rule builder, one or more new behavior-based firewall rules for each different type of detected computer-related action by the user wherein the one or more new behavior-based firewall rules are based on the detected computer-related actions included in the logged event and the one or more behavior-based risk scores for the user;
insert, by the rule builder, the one or more new behavior-based firewall rules into a firewall table;
periodically updating the user's one or more behavior-based risk scores as additional computer-related actions by the user are detected and logged;
updating the user's one or more behavior-based firewall rules by deleting previously built behavior-based firewall rules and building new behavior-based firewall rules based on the user's updated one or more behavior-based risk scores;
regulate the user's computer-related actions according to at least the one or more new behavior-based firewall rules inserted into the firewall table.
6. The non-transitory computer-readable storage medium of claim 5 , wherein the one or more behavior-based risk scores include one or more of a risk score associated with failed login attempts, of a risk score associated with accessing files, of a risk score associated with accessing servers in the enterprise, of a risk score associated with accessing the network, of a risk score associated with installing software, and of a risk score associated with executing processes.
7. The non-transitory computer-readable storage medium of claim 5 , wherein the user's computer-related actions are associated with corresponding vulnerability ratings, wherein the user's one or more behavior-based risk scores are computed using the vulnerability ratings corresponding to the user's computer-related actions.
8. The non-transitory computer-readable storage medium of claim 5 , wherein regulating the user's computer-related actions includes at least one of allowing or denying the user from logging onto a computer system, allowing or denying the user access to a file or a server, allowing, denying, or redirecting a destination of a network access, allowing or denying the user from installing software, and allowing or denying execution of a process.
9. An apparatus comprising:
one or more computer processors; and
a computer-readable storage medium comprising instructions for controlling the one or more computer processors to be operable to:
detect computer-related actions performed by a user;
log the user's computer-related actions as a logged event that includes the user's detected computer-related actions and the user that performed the detected computer-related actions;
compute one or more behavior-based risk scores for the user based on the user's computer-related actions;
receive, by a rule builder, the logged event;
build, by the rule builder, one or more new behavior-based firewall rules for each different type of detected computer-related action by the user wherein the one or more new behavior-based firewall rules are based on the detected computer-related actions included in the logged event and the one or more behavior-based risk scores for the user;
insert, by the rule builder, the one or more new behavior-based firewall rules into a firewall table;
periodically updating the user's one or more behavior-based risk scores as additional computer-related actions by the user are detected and logged;
updating the user's one or more behavior-based firewall rules by deleting previously built behavior-based firewall rules and building new behavior-based firewall rules based on the user's updated one or more behavior-based risk scores;
regulate the user's computer-related actions according to at least the one or more new behavior-based firewall rules inserted into the firewall table.
10. The apparatus of claim 9 , wherein the user's computer-related actions are associated with corresponding vulnerability ratings, wherein the user's one or more behavior-based risk scores are computed using the vulnerability ratings corresponding to the user's computer-related actions.
11. The apparatus of claim 9 , wherein the one or more behavior-based risk scores include one or more of a risk score associated with failed login attempts, of a risk score associated with accessing files, of a risk score associated with accessing servers in the enterprise, of a risk score associated with accessing the network, of a risk score associated with installing software, and of a risk score associated with executing processes.
12. The apparatus of claim 9 , wherein the computer-readable storage medium further comprises instructions for controlling the one or more computer processors to be operable to regulate the user's computer-related actions includes at least one of allowing or denying the user from logging onto a computer system, allowing or denying the user access to a file or a server, allowing, denying, or redirecting a destination of a network access, allowing or denying the user from installing software, and allowing or denying execution of a process.