Method to prevent root level access attack and measurable SLA security and compliance platform
A compliance monitor measures metrics regarding one or more managed devices in a network. The compliance monitor generates a log based on the information detected by the measurement trackers and to transmit a report based on the generated log to a recipient. The compliance monitor also initiates one or more security actions based on the one or more measurement trackers indicating that a measured metric exceeds an associated threshold measurement value.
1. A method comprising:
receiving, from a plurality of devices in a managed network, first logged information describing activity of the plurality of devices in the managed network;
computing a first value for a security compliance metric for the managed network based on the received first logged information;
comparing, at a first time, the first value for the security compliance metric to a threshold value corresponding to the metric;
identifying the security compliance metric as being out of compliance based on the comparing of the first value to the threshold value;
receiving second logged information from the plurality of devices;
computing, at a second time later than the first time, a second value for the security compliance metric based on the second logged information;
comparing the second value for the security compliance metric to the threshold value corresponding to the security compliance metric;
determining that the security compliance metric that is in compliance based on the comparing of the second value to the threshold value;
computing a time to compliance for the managed network based on the first time, the second time, the first logged information, and the second logged information;
comparing the time to compliance to a threshold value; and
initiating, responsive to the time to compliance exceeding the threshold value, a security action.
2. The method of claim 1 , wherein the security action includes rolling back a state of a managed device to an earlier known good state.
3. The method of claim 1 , wherein the security compliance metric includes a mean time to isolation metric representing a mean time to an isolation of each device of the plurality of devices when a change is detected at the device.
4. The method of claim 1 , wherein the security compliance metric includes a hacker investigation time metric that tracks a time spent by a malicious attacker at a device of the plurality of devices.
5. The method of claim 4 , wherein the device is a honeypot designed to provide dummy resources for a malicious attacker to access, the dummy resources being attractive to the malicious attacker.
6. The method of claim 1 , wherein the security compliance metric includes a mean time to repair metric that represents a mean time to repair a device of the plurality of devices after a change is detected at the device.
7. The method of claim 1 , wherein the security compliance metric includes a mean time to service metric that represents a mean time to restore a service provided by the plurality of devices in the network after a disruption of the service caused by a change detected at a device of the plurality of devices.
8. The method of claim 1 , further comprising:
selecting a security action of a plurality actions based on the identified security compliance metric; and
initiating, responsive to the time to compliance exceeding the threshold value, the selected security action.
9. The method of claim 1 , wherein computing the first value for the security compliance metric comprises:
computing the first value by a tracker corresponding to the security compliance metric.
10. The method of claim 1 , further comprising:
transmitting a notification of the initiated security action to a user.
11. A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform operations comprising:
receiving, from a plurality of devices in a managed network, first logged information describing activity of the plurality of devices in the managed network;
computing a first value for a security compliance metric for the managed network based on the received first logged information;
comparing, at a first time, the first value for the security compliance metric to a threshold value corresponding to the metric;
identifying the security compliance metric as being out of compliance based on the comparing of the first value to the threshold value;
receiving second logged information from the plurality of devices;
computing, at a second time later than the first time, a second value for the security compliance metric based on the second logged information;
comparing the second value for the security compliance metric to the threshold value corresponding to the security compliance metric;
determining that the security compliance metric that is in compliance based on the comparing of the second value to the threshold value;
computing a time to compliance for the managed network based on the first time, the second time, the first logged information, and the second logged information;
comparing the time to compliance to a threshold value; and
initiating, responsive to the time to compliance exceeding the threshold value, a security action.
12. The computer-readable medium of claim 11 , wherein the security action includes rolling back a state of a managed device to an earlier known good state.
13. The computer-readable medium of claim 11 , wherein the security compliance metric includes a mean time to isolation metric representing a mean time to an isolation of each device of the plurality of devices when a change is detected at the device.
14. The computer-readable medium of claim 11 , wherein the security compliance metric includes a hacker investigation time metric that tracks a time spent by a malicious attacker at a device of the plurality of devices.
15. The computer-readable medium of claim 14 , wherein the device is a honeypot designed to provide dummy resources for a malicious attacker to access, the dummy resources being attractive to the malicious attacker.
16. The computer-readable medium of claim 11 , wherein the security compliance metric includes a mean time to repair metric that represents a mean time to repair a device of the plurality of devices after a change is detected at the device.
17. The computer-readable medium of claim 11 , wherein the security compliance metric includes a mean time to service metric that represents a mean time to restore a service provided by the plurality of devices in the network after a disruption of the service caused by a change detected at a device of the plurality of devices.
18. The computer-readable medium of claim 11 , the operations further comprising:
selecting a security action of a plurality actions based on the identified security compliance metric; and
initiating, responsive to the time to compliance exceeding the threshold value, the selected security action.
19. The computer-readable medium of claim 11 , wherein computing the first value for the security compliance metric comprises:
computing the first value by a tracker corresponding to the security compliance metric.
20. The computer-readable medium of claim 11 , the operations further comprising:
transmitting a notification of the initiated security action to a user.