Automatic generation of production security controls from a testing collaboration platform
The present disclosure relates to a system and method of automatically updating the set of security controls in the production environment using AI based on historical data generated in the test management system TMS during the system's testing in the testing environment including information about its elements, their properties, testing environment, its characteristics, and security controls with their settings. Once the AI has sufficient historical data from a testing environment, every time a change is detected to the system in the production environment, its elements, their properties, or at least one characteristic of the production environment, the AI system makes a recommendation to update the set of security controls in the production environment.
1. A method for automatically generating parameters of security controls in the production environment for an element of an information system (IS) using stored historical data about configurations of an element of the IS which have been marked safe in the test management system (TMS) and parameters of security test scenarios corresponding to these configurations, the method comprising the steps of:
a. collecting information about the configurations of the element of IS marked as safe in the TMS and corresponding security controls resulting in the safe state of the element during the security testing;
b. generating M-embeddings of the configurations of the element of IS of fixed length M and N-embedding of the parameters of security controls of fixed length N;
c. training a neural network NN with input layer of size M and output layer of size N using the embeddings of collected information, wherein the AI is configured take as an input embedding EE of the configuration of the element of IS and to output an embedding of the set of security controls of fixed length N;
d. obtaining information about a new configuration of the element of IS in the production environment;
e. generating an M-embedding of the new configuration of the element of IS in the production environment;
f. calculating an N-embedding of the parameters of security controls of fixed length N by inputting M-embedding of the new configuration of the element of IS in the production environment into NN;
g. generating new parameters of security controls corresponding to the N-embedding output by NN; and
h. setting the parameters of the set of security controls of the element of IS in the production environment to the values generated by the NN.
2. The method of claim 1 , wherein the set of security controls comprises proxy server settings, vulnerability scanner settings, virus scanner settings, automatic updater settings, failed authentication settings, backup settings, keep-alive server settings, or logging settings.
3. The method of claim 1 , wherein the element of IS comprises a communication device, a mobile device, a computer, physical server, a virtual machine, a web server, an FTP server, a file storage, a COTS application, a custom developed application, or a virtual environment.
4. The method of claim 1 , wherein the configuration of element comprises the set of users, authentication policies, password strength policies, IP address, software version, a set of open ports, type and version of software listening on different ports, available CPU, available memory, total available disk space, amount of free disk space, backup schedule, list of installed software, or a list of other elements with which current element communicates.
5. The method of claim 1 , wherein the information system IS comprises two elements E1 and E2 with the embeddings of size N1 and N2, embeddings of security controls of sizes M1 and M2, and neural network with an input layer the size of N1+N2 and output layer the size of M1+M2.
6. A system for automatically generating parameters of security controls in the production environment for an element of an information system (IS) using stored historical data about configurations of an element of the IS which have been marked safe in the test management system (TMS) and parameters of security controls corresponding to these configurations, comprising:
a. an information collector configured to:
i. collect from TMS information about the combinations of configurations of the element of IS marked safe in TMS and corresponding parameters of security controls; and
ii. pass collected information to the AI learning module;
b. an AI learning module configured to:
i. receive historical data from the information collector;
ii. generate an M-embeddings of configurations of the element of IS of fixed length M and an N-embeddings of the parameters of security controls of fixed length N; and
iii. train a neural network NN with input layer of size M and output layer of size N using the embeddings of collected information, wherein the neural network NN is configured take as an input M-embedding of the configuration of the element of IS and to output an N-embedding of the parameters of security controls;
c. an AI recommendation module configured to:
i. obtain information about a new configuration of the element of IS in the production environment;
ii. generate an M-embedding of the new configuration of the element of IS in the production environment;
iii. calculate the N-embedding of the parameters of security controls by inputting the M-embedding of the new configuration of the elements of IS in the production environment into NN;
iv. generate a set of new parameters of security controls corresponding to the embedding output by NN; and
V. communicate the new parameters of security controls to the production security system updater module;
d. a production security system updater module configured to:
i. obtain information about a new parameter of security controls from the AI recommendation module;
ii. apply the obtained new parameters of security controls to the element of IS in the production environment.
7. The system of claim 6 , wherein the set of security controls comprises proxy server settings, vulnerability scanner settings, virus scanner settings, automatic updater settings, failed authentication settings, backup settings, keep-alive server settings, or logging settings.
8. The system of claim 6 , wherein the element of IS comprises a communication device, a mobile device, a computer, physical server, a virtual machine, a web server, an FTP server, a file storage, a COTS application, a custom developed application, or a virtual environment.
9. The system of claim 6 , wherein the configuration of element comprises the set of users, authentication policies, password strength policies, IP address, software version, a set of open ports, type and version of software listening on different ports, available CPU, available memory, total available disk space, amount of free disk space, backup schedule, a list of installed software, or a list of other elements with which current element communicates.
10. The system of claim 6 , wherein the information system IS comprises two elements E1 and E2 with the embeddings of size N1 and N2, embeddings of security controls of sizes M1 and M2, and neural network with an input layer the size of N1+N2 and output layer the size of M1+M2.