Systems and methods for performing self-contained posture assessment from within a protected portable-code workspace
Systems and methods for performing self-contained posture assessment from within a protected portable-code workspace are described. In some embodiments, an Information Handling System (IHS) may include a processor and a memory having program instructions that, upon execution, cause the IHS to: transmit, from an orchestration service to a local agent, a workspace definition that references an application, where the application comprises a first portion of code provided by a developer and a second portion of code provided by the orchestration service; and receive, from a local agent at the orchestration service, a message in response to the execution of the second portion of code within a workspace instantiated based upon the workspace definition. The second portion of code may inspect the contents of the runtime memory of the workspace upon execution, for example, by performing a stack canary check, a hash analysis, a boundary check, and/or a memory scan.
1. An Information Handling System (IHS), the IHS comprising:
a processor; and
a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to:
transmit, from a workspace orchestration service to a local management agent, a workspace definition that references an application, wherein the application comprises a first portion of code provided by a developer and a second portion of code provided by the workspace orchestration service, wherein the workspace definition comprises: (a) a security target determined based upon a security context, and (b) a productivity target determined based upon a productivity context where a workspace is deployed, and wherein the second portion of code, upon execution, further causes the IHS to inspect contents of a runtime memory of the workspace through at least one of: a stack canary check, a hash analysis, or a boundary check; and
receive, from a local management agent at the workspace orchestration service, a message in response to the execution of the second portion of code within the workspace instantiated based upon the workspace definition, wherein the workspace orchestration service lacks the ability to inspect contents of a runtime memory of the workspace, wherein the second portion of code is retrieved from a library provided by the workspace orchestration service, wherein the library is configured to automatically update as new threats are discovered, and wherein the second portion of code is updated to incorporate one or more inspection techniques against the new threats.
2. The IHS of claim 1 , wherein the application comprises a progressive web application (PWA) or a browser-based application.
3. The IHS of claim 1 , wherein the second portion of code is configured to inspect the contents of the runtime memory of the workspace upon execution.
4. The IHS of claim 3 , wherein to inspect the contents of the runtime memory, the second portion of code is configured to perform, upon execution, at least one of: a stack canary check, a hash analysis, or a boundary check.
5. The IHS of claim 3 , wherein the message provides an assessment of the contents of the runtime memory of the workspace.
6. The IHS of claim 3 , wherein the program instructions, upon execution, further cause the IHS to, in response to the message, transmit a second workspace definition to the local management agent, wherein the local management agent is configured to instantiate a second workspace based upon the second workspace definition.
7. The IHS of claim 6 , wherein the program instructions, upon execution, further cause the IHS to, in response to the message, facilitate a migration of at least one of: an application, or document, from the workspace to the second workspace.
8. The IHS of claim 7 , wherein the program instructions, upon execution, further cause the IHS to, in response to the message, transmit another message to the local management agent to terminate the workspace.
9. The IHS of claim 1 , wherein the program instructions, upon execution, further cause the IHS to make the second portion of code available to the developer as a library.
10. A memory storage device having program instructions stored thereon that, upon execution by an Information Handling System (IHS), cause the IHS to:
receive a first portion of code from a developer;
receive a second portion of code from a workspace orchestration service, wherein the second portion of code is retrieved from a library provided by the workspace orchestration service, wherein the library is configured to automatically update as new threats are discovered, wherein the second portion of code is updated to incorporate one or more inspection techniques against the new threats, and wherein the second portion of code, upon execution, further causes the IHS to inspect contents of a runtime memory of the workspace through at least one of: a stack canary check, a hash analysis, or a boundary check; and
assemble the first and second portions of code into an application, wherein the application is referenced in a workspace definition that, upon instantiation into a workspace by a local management agent, sends a message to the workspace orchestration service indicating the contents of a runtime memory of the workspace, wherein the workspace definition comprises: (a) a security target determined based upon a security context, and (b) a productivity target determined based upon a productivity context where a workspace is deployed, and wherein the workspace orchestration service lacks the ability to inspect the contents of the runtime memory of the workspace.
11. The memory storage device of claim 10 , wherein the application comprises a progressive web application (PWA) or a browser-based application.
12. The memory storage device of claim 10 , wherein in response to the message, the workspace orchestration service is configured to transmit a second workspace definition to the local management agent, and wherein the local management agent is configured to instantiate a second workspace based upon the second workspace definition.
13. The memory storage device of claim 12 , wherein in response to the message, the workspace orchestration service is configured to facilitate a migration of at least one of: an application, or document, from the workspace to the second workspace.
14. The memory storage device of claim 13 , wherein in response to the message, the workspace orchestration service is configured to transmit another message to the local management agent to terminate the workspace.
15. The memory storage device of claim 13 , wherein the workspace orchestration service is configured to make the second portion of code available to the developer as a library.
16. A method, comprising:
transmitting, from a workspace orchestration service to a local management agent, a workspace definition that references an application, wherein the application comprises a first portion of code provided by a developer and a second portion of code provided by the workspace orchestration service, wherein the workspace definition comprises: (a) a security target determined based upon a security context, and (b) a productivity target determined based upon a productivity context where a workspace is deployed, and wherein the second portion of code, upon execution, further causes the IHS to inspect contents of a runtime memory of the workspace through at least one of: a stack canary check, a hash analysis, or a boundary check; and
receiving, from a local management agent at the workspace orchestration service, a message in response to the execution of the second portion of code within the workspace instantiated based upon the workspace definition, wherein the workspace orchestration service lacks the ability to inspect contents of a runtime memory of the workspace, wherein the second portion of code is retrieved from a library provided by the workspace orchestration service, wherein the library is configured to automatically update as new threats are discovered, and wherein the second portion of code is updated to incorporate one or more inspection techniques against the new threats.