Systems and methods for workspace continuity and remediation
Systems and methods for modernizing workspace and hardware lifecycle management in an enterprise productivity ecosystem are described. In some embodiments, a client Information Handling System (IHS) may include a processor and a memory, the memory having program instructions that, upon execution by the processor, cause the client IHS to: receive, from a workspace orchestration service, one or more files or policies configured to enable the client IHS to instantiate a first workspace based upon a first workspace definition; allow a user to execute a non-vetted application in the first workspace; determine that the first workspace is compromised; and receive, in response to the determination, from the workspace orchestration service, one or more other files or policies configured to enable the client IHS to instantiate a second workspace based upon a second workspace definition, where the second workspace definition allows execution of a vetted application corresponding to the non-vetted application.
1. A client Information Handling System (IHS), the client IHS comprising:
a processor; and
a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the client IHS to:
instantiate, using one or more files or policies, a first workspace based upon a first workspace definition;
allow a user to execute a non-vetted application in the first workspace;
determine that the first workspace is compromised because the application is non-vetted; and
in response to the determination:
identify a vetted application that corresponds to the non-vetted application, wherein the vetted application is different than the non-vetted application;
instantiate, using one or more other files or policies, a second workspace based upon a second workspace definition, wherein the second workspace definition indicates the vetted application corresponding to the non-vetted application;
cause the client IHS to migrate a workload from the first workspace to the second workspace;
cause the client IHS to transmit, to a workspace orchestration service, cloned user actions and data collected during execution of the non-vetted application in the first workspace, and wherein the one or more other files or policies comprise an indication of the cloned user actions and data that is applicable to the vetted application in the second workspace; and
allow the user to execute the vetted application in the second workspace.
2. The client IHS of claim 1 , wherein the non-vetted application comprises an application that is not vetted, trusted, or recommended by an entity employing the workspace orchestration service.
3. The client IHS of claim 1 , wherein the non-vetted application comprises a first web browser and the vetted application comprises a second web browser.
4. The client IHS of claim 1 , wherein the program instructions, upon execution, further cause the client IHS to notify a workspace orchestration service that the non-vetted application is being executed, and wherein the workspace orchestration service is configured to select the one or more other files or policies in anticipation of the determination that the first workspace is compromised.
5. The client IHS of claim 1 , wherein the program instructions, upon execution, further cause the client IHS to determine that the first workspace is compromised in response to a security risk score being equal to or greater than a threshold value.
6. The client IHS of claim 5 , wherein the threshold value is a security target associated with the first workspace definition.
7. The client IHS of claim 5 , wherein the security risk score is calculated based upon at least one of: a risk metric associated with a locale of the client IHS, a risk metric associated with the user of the client IHS, a risk metric associated with a network of the client IHS, a risk metric associated with hardware of the client IHS, a risk metric associated with a requested datafile, or a regulatory risk metric associated with the user, the locale, and the requested datafile.
8. A memory storage device having program instructions stored thereon that, upon execution by one or more processors of an Information Handling System (IHS) of a workspace orchestration service, cause the IHS to:
instantiate, using one or more files or policies, a first workspace based upon a first workspace definition;
determine that that the first workspace has been compromised due to execution of a non-vetted application; and
in response to the determination:
identify a vetted application that corresponds to the non-vetted application, wherein the vetted application is different than the non-vetted application;
cause the client IHS to migrate a workload from the first workspace to the second workspace;
cause the client IHS to transmit, to a workspace orchestration service, cloned user actions and data collected during execution of the non-vetted application in the first workspace, and wherein the one or more other files or policies comprise an indication of the cloned user actions and data that is applicable to the vetted application in the second workspace; and
instantiate, using one or more other files or policies, a second workspace based upon a second workspace definition, wherein the second workspace definition allows execution of a vetted application corresponding to the non-vetted application, wherein the second workspace definition indicates the vetted application corresponding to the non-vetted application.
9. The memory storage device of claim 8 , wherein the non-vetted application comprises an application that is not vetted, trusted, or recommended by an entity employing the workspace orchestration service.
10. The memory storage device of claim 8 , wherein the non-vetted application is a first web browser and the vetted application is a second web browser.
11. The memory storage device of claim 8 , wherein the program instructions, upon execution, further cause the IHS to receive a notification from the client IHS that the non-vetted application is being executed, and wherein the one or more other files or policies are selected in anticipation of the determination that the first workspace is compromised.
12. The memory storage device of claim 8 , wherein the program instructions, upon execution, further cause the client IHS to determine that the first workspace is compromised in response to a security risk score being equal to or greater than a threshold value, wherein the security risk score is calculated based upon at least one of: a risk metric associated with a locale of the client IHS, a risk metric associated with a user of the client IHS, a risk metric associated with a network of the client IHS, a risk metric associated with hardware of the client IHS, a risk metric associated with a requested datafile, or a regulatory risk metric associated with the user, the locale, and the requested datafile.
13. A method, comprising:
instantiating, using one or more files or policies, a first workspace based upon a first workspace definition;
receiving user actions and data collected during execution of a non-vetted application in the first workspace; and
in response to a determination that the first workspace has been compromised due to execution of the non-vetted application:
identifying a vetted application that corresponds to the non-vetted application, wherein the vetted application is different than the non-vetted application;
instantiating, using one or more other files or policies, a second workspace based upon a second workspace definition, wherein the second workspace definition indicates a vetted application corresponding to the non-vetted application, and wherein the one or more other files or policies comprise at least a subset of the user actions and data to be applied to the vetted application in the second workspace;
cause the client IHS to migrate a workload from the first workspace to the second workspace;
cause the client IHS to transmit, to a workspace orchestration service, cloned user actions and data collected during execution of the non-vetted application in the first workspace, and wherein the one or more other files or policies comprise an indication of the cloned user actions and data that is applicable to the vetted application in the second workspace; and
allowing the user to execute the vetted application in the second workspace.
14. The method of claim 13 , wherein the non-vetted application comprises an application that is not vetted, trusted, or recommended by an entity employing the workspace orchestration service.
15. The method of claim 13 , wherein the non-vetted application is a first web browser and the vetted application is a second web browser.
16. The method of claim 13 , further comprising determining that the first workspace is compromised in response to a security risk score being equal to or greater than a threshold value, wherein the security risk score is calculated based upon at least one of: a risk metric associated with a locale of the client IHS, a risk metric associated with a user of the client IHS, a risk metric associated with a network of the client IHS, a risk metric associated with hardware of the client IHS, a risk metric associated with a requested datafile, or a regulatory risk metric associated with the user, the locale, and the requested datafile.
17. The method of claim 13 , further comprising terminating the first workspace.