Method to prevent root level access attack and measurable SLA security and compliance platform
A compliance monitor measures metrics regarding one or more managed devices in a network. The compliance monitor generates a log based on the information detected by the measurement trackers and to transmit a report based on the generated log to a recipient. The compliance monitor also initiates one or more security actions based on the one or more measurement trackers indicating that a measured metric exceeds an associated threshold measurement value.
1. A method comprising
receiving, from a plurality of devices in a managed network, logged information describing activity of the plurality of devices in the managed network;
computing a first set of values for a set of security compliance metrics for the managed network based on the received logged information;
comparing, at a first time, each of the first set of values for the set of security compliance metrics to a threshold value corresponding to each value;
identifying a security compliance metric of the set of security compliance metrics that is out of compliance with a service level agreement based on the comparing;
receiving additional logged information from the plurality of devices;
computing, at a second time later than the first time, a second set of values for the set of security compliance metrics based on the additional logged information;
comparing each of the second set of values for the set of security compliance metrics to the threshold value corresponding to each value;
determining that the identified security compliance metric that is in compliance with the service level agreement based on the comparing of the second set of values;
computing a time to compliance for the managed network based on the first time, the second time, the logged information, and the additional logged information;
comparing the time to compliance to a threshold value; and
initiating, responsive to the time to compliance exceeding the threshold value, a security action.
2. The method of claim 1 , wherein the security action includes rolling back a state of a managed device to an earlier known good state when a measured metric for that managed device exceeds the associated threshold measurement value.
3. The method of claim 1 , wherein the set of security compliance metrics includes a mean time to isolation metric representing a mean time to an isolation of each device of the plurality of devices when a change is detected at the device.
4. The method of claim 1 , wherein the set of security compliance metrics includes a hacker investigation time metric that tracks a time spent by a malicious attacker at a device of the plurality of devices.
5. The method of claim 4 , wherein the device is a honeypot designed to provide dummy resources for a malicious attacker to access, the dummy resources being attractive to the malicious attacker.
6. The method of claim 1 , wherein the set of security compliance metrics includes a mean time to repair metric that represents a mean time to repair a device of the plurality of devices after a change is detected at the device.
7. The method of claim 1 , wherein the set of security compliance metrics includes a mean time to service metric that represents a mean time to restore a service provided by the plurality of devices in the network after a disruption of the service caused by a change detected at a device of the plurality of devices.
8. The method of claim 1 , further comprising:
selecting a security action of a plurality actions based on the identified security compliance metric; and
initiating, responsive to the time to compliance exceeding the threshold value, the selected security action.
9. The method of claim 1 , wherein computing the first set of values for the set of security compliance metrics comprises:
computing each value of the set of the first set of values by a tracker corresponding to each security compliance metric of the set of security compliance metrics.
10. The method of claim 1 , further comprising:
transmitting a notification of the initiated security action to a user.
11. A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform operations comprising:
receiving, from a plurality of devices in a managed network, logged information describing activity of the plurality of devices in the managed network;
computing a first set of values for a set of security compliance metrics for the managed network based on the received logged information;
comparing, at a first time, each of the first set of values for the set of security compliance metrics to a threshold value corresponding to each value;
identifying a security compliance metric of the set of security compliance metrics that is out of compliance with a service level agreement based on the comparing;
receiving additional logged information from the plurality of devices;
computing, at a second time later than the first time, a second set of values for the set of security compliance metrics based on the additional logged information;
comparing each of the second set of values for the set of security compliance metrics to the threshold value corresponding to each value;
determining that the identified security compliance metric that is in compliance with the service level agreement based on the comparing of the second set of values;
computing a time to compliance for the managed network based on the first time, the second time, the logged information, and the additional logged information;
comparing the time to compliance to a threshold value; and
initiating, responsive to the time to compliance exceeding the threshold value, a security action.
12. The computer-readable medium of claim 11 , wherein the security action includes rolling back a state of a managed device to an earlier known good state when a measured metric for that managed device exceeds the associated threshold measurement value.
13. The computer-readable medium of claim 11 , wherein the set of security compliance metrics includes a mean time to isolation metric representing a mean time to an isolation of each device of the plurality of devices when a change is detected at the device.
14. The computer-readable medium of claim 11 , wherein the set of security compliance metrics includes a hacker investigation time metric that tracks a time spent by a malicious attacker at a device of the plurality of devices.
15. The computer-readable medium of claim 14 , wherein the device is a honeypot designed to provide dummy resources for a malicious attacker to access, the dummy resources being attractive to the malicious attacker.
16. The computer-readable medium of claim 11 , wherein the set of security compliance metrics includes a mean time to repair metric that represents a mean time to repair a device of the plurality of devices after a change is detected at the device.
17. The computer-readable medium of claim 11 , wherein the set of security compliance metrics includes a mean time to service metric that represents a mean time to restore a service provided by the plurality of devices in the network after a disruption of the service caused by a change detected at a device of the plurality of devices.
18. The computer-readable medium of claim 11 , further storing instructions that, when executed by a processor, cause the processor to perform operations comprising:
selecting a security action of a plurality actions based on the identified security compliance metric; and
initiating, responsive to the time to compliance exceeding the threshold value, the selected security action.
19. The computer-readable medium of claim 11 , wherein computing the first set of values for the set of security compliance metrics comprises:
computing each value of the set of the first set of values by a tracker corresponding to each security compliance metric of the set of security compliance metrics.
20. The computer-readable medium of claim 11 , further storing instructions that, when executed by a processor, cause the processor to perform operations comprising:
transmitting a notification of the initiated security action to a user.