Software security agent updates via microcode
Systems and methods include a host system that is configured to execute a security agent that is configured to allow and block flows in a network, on the network interface, receive a script from a command & control server, and execute the script via an interpreter associated with the security agent, wherein the script is configured to any of disable behavior and modify behavior of the security agent at one or more hook points in the security agent.
1. A host system comprising:
a network interface;
one or more processors connected to the network interface; and
memory storing instructions that, when executed, cause the one or more processors to
receive security policies that define microsegments of a network;
execute a security agent that is configured to allow and block flows in the network, on the network interface based on the received security policies,
receive a script and instructions from a command & control server, the instructions comprising instructions of which hook point of one or more hook points the script is to be bound to, and
execute the script via an interpreter associated with the security agent, wherein the script is configured to any of disable behavior and modify behavior of the security agent at one or more hook points in the security agent.
2. The host system of claim 1 , wherein the instructions that, when executed, further cause the one or more processors to
receive security policies that define microsegments.
3. The host system of claim 1 , wherein the instructions that, when executed, further cause the one or more processors to
store the script and perform the executing of the script based on a change freeze schedule.
4. The host system of claim 1 , wherein the instructions that, when executed, further cause the one or more processors to
verify a digital signature of the script prior to executing the script.
5. The host system of claim 1 , wherein the one or more hook points include a plurality of hook points that are hard coded into the security agent.
6. The host system of claim 1 , wherein the script conforms to Lua.
7. A method implemented by a host system, comprising steps of:
receiving security policies that define microsegments of a network;
executing a security agent that is configured to allow and block flows in the network, on the network interface based on the received security policies;
receiving a script and instructions from a command & control server, the instructions comprising instructions of which hook point of one or more hook points the script is to be bound to; and
executing the script via an interpreter associated with the security agent, wherein the script is configured to any of disable behavior and modify behavior of the security agent at one or more hook points in the security agent.
8. The method of claim 7 , wherein the steps further include receive security policies that define microsegments.
9. The method of claim 7 , wherein the steps further include storing the script and perform the executing of the script based on a change freeze schedule.
10. The method of claim 7 , wherein the steps further include
verify a digital signature of the script prior to executing the script.
11. The method of claim 7 , wherein the one or more hook points include a plurality of hook points that are hard coded into the security agent.
12. The method of claim 7 , wherein the script conforms to Lua.
13. A cloud system comprising:
a plurality of nodes, each including one or more processors and a network interface, wherein each node is configured to
communicate to one or more hosts each configured to execute a security agent that is configured to allow and block flows in a network, on the network interface based on one or more microsegments, and
provide security policies to the one or more hosts, the security policies defining microsegments of the network;
provide a script and instructions to the one or more hosts that execute the script via an interpreter associated with the security agent, the instructions comprising instructions of which hook point of one or more hook points the script is to be bound to, wherein the script is configured to any of disable behavior and modify behavior of the security agent at one or more hook points in the security agent.
14. The cloud system of claim 13 , wherein each node is further configured to
provide security policies to the one or more hosts that define microsegments.
15. The cloud system of claim 13 , wherein each node is further configured to
include a time to execute the script at a later time.
16. The cloud system of claim 13 , wherein each node is further configured to
include a digital signature in the script for verification prior to execution.
17. The cloud system of claim 13 , wherein the one or more hook points include a plurality of hook points that are hard coded into the security agent.
18. The cloud system of claim 13 , wherein the script conforms to a script programming language.