System and method to create zero trust framework for security as a service
An apparatus includes a network interface that performs a reception of a launch request and receives a policy for a service. The launch request includes an identifier of a workload and an identifier of an application. A processor determines a customer security posture, at least in part based on the identifier of the workload and the identifier of the application. Further, the processor determines to deny the launch request, at least in part based on the policy and the customer security posture.
1 . An apparatus, comprising:
a network interface that performs a reception of a launch request to launch an application and receives a policy for a service, wherein the launch request includes an identifier of a workload within a customer infrastructure making the launch request and an identifier of the application; and
a processor configured to determine a customer security posture, at least in part based on the identifier of the workload, activities performed by the workload, and the identifier of the application, and to determine to deny the launch request, at least in part based on the policy and the customer security posture, wherein determining to deny the launch request includes determining whether the workload meets hardening rules and determining whether a checksum of the application matches a predetermined checksum and determining whether a risk score exceeds a predetermined value indicated in the policy, wherein the risk score is based on an evaluation of hardware running a virtual machine (VM) or container that produced the workload within the customer infrastructure.
2 . The apparatus of claim 1 , wherein the network interface receives an application programming interface (API) request for access to the service, the API request includes the identifier of the workload, and the processor further is configured to deny the access to the service, at least in part based on the policy and the customer security posture.
3 . The apparatus of claim 1 , wherein the network interface receives an access request for access to a vendor apparatus, the access request includes the identifier of the workload, and the processor further is configured to deny the access to the vendor apparatus, at least in part based on the policy and the customer security posture.
4 . The apparatus of claim 1 , wherein the network interface transmits a policy request, at least in part based on the reception of the launch request.
5 . The apparatus of claim 1 , wherein the processor further is configured to detect an event, and the network interface transmits an artifact of the event.
6 . The apparatus of claim 1 , wherein the network interface transmits policy management information including an identifier of the apparatus.
7 . The apparatus of claim 1 , wherein the processor further is configured to determine to allow a launch request, at least in part based on the policy and a customer security posture for another workload.
8 . A method, comprising:
receiving a launch request to launch an application including an identifier of a workload within a customer infrastructure making the launch request and an identifier of the application;
receiving a policy for a service;
determining a customer security posture, at least in part based on the identifier of the workload, activities performed by the workload, and the identifier of the application; and
determining to deny the launch request, at least in part based on the policy and the customer security posture, wherein determining to deny the launch request includes determining whether the workload meets hardening rules and determining whether a checksum of the application matches a predetermined checksum and determining whether a risk score exceeds a predetermined value indicated in the policy, wherein the risk score is based on an evaluation of hardware running a virtual machine (VM) or container that produced the workload within the customer infrastructure.
9 . The method of claim 8 , further comprising:
receiving an application programming interface (API) request for access to the service, the API request including the identifier of the workload; and
denying the access to the service, at least in part based on the policy and the customer security posture.
10 . The method of claim 8 , further comprising:
receiving an access request for access to a vendor apparatus, the access request including the identifier of the workload; and
denying the access to the vendor apparatus, at least in part based on the policy and the customer security posture.
11 . The method of claim 8 , further comprising:
transmitting a policy request, at least in part based on the receiving the launch request.
12 . The method of claim 8 , further comprising:
detecting an event; and
transmitting an artifact of the event.
13 . The method of claim 8 , further comprising:
transmitting policy management information including an identifier of an apparatus.
14 . The method of claim 8 , further comprising:
determining to allow a launch request, at least in part based on the policy and a customer security posture for another workload.
15 . A non-transitory, computer-readable medium encoded with executable instructions that, when executed by a processing unit, perform operations comprising:
receiving a launch request to launch an application, wherein the launch request includes an identifier of a workload within a customer infrastructure making the launch request and an identifier of the application;
receiving a policy for a service;
determining a customer security posture, at least in part based on the identifier of the workload, activities performed by the workload, and the identifier of the application; and
determining to deny the launch request, at least in part based on the policy and the customer security posture, wherein determining to deny the launch request includes determining whether the workload meets hardening rules and determining whether a checksum of the application matches a predetermined checksum and determining whether a risk score exceeds a predetermined value indicated in the policy, wherein the risk score is based on an evaluation of hardware running a virtual machine (VM) or container that produced the workload within the customer infrastructure exceeds.
16 . The medium of claim 15 , the operations further comprising:
receiving an application programming interface (API) request for access to the service, the API request including the identifier of the workload; and
denying the access to the service, at least in part based on the policy and the customer security posture.
17 . The medium of claim 15 , the operations further comprising:
receiving an access request for access to a vendor apparatus, the access request including the identifier of the workload; and
denying the access to the vendor apparatus, at least in part based on the policy and the customer security posture.
18 . The medium of claim 15 , the operations further comprising:
transmitting a policy request, at least in part based on the receiving the launch request.
19 . The medium of claim 15 , the operations further comprising:
detecting an event; and
transmitting an artifact of the event.
20 . The medium of claim 15 , the operations further comprising:
determining to allow a launch request, at least in part based on the policy and a customer security posture for another workload.