Data protection in a networked computing environment
Approaches for providing data protection in a networked computing environment are provided. A method includes detecting, by at least one computer device, a breach of a first system in the networked computing environment. The method also includes generating, by the at least one computer device, a second system in the networked computing environment, wherein the second system includes a patch based on the breach. The method additionally includes converting, by the at least one computer device, the first system to a decoy system. The method further includes generating, by the at least one computer device, a third system in the networked computing environment, wherein the third system has reduced security relative to the first system.
1. A method of providing data protection in a networked computing environment, comprising:
detecting, by at least one computer device, a breach of a first system in the networked computing environment;
in response to the detecting of the breach of the first system, generating, by the at least one computer device, a second system in the networked computing environment, wherein the second system includes a database which includes a scrambled version of low value data and a patch which is a configuration update applied to the database of the second system that eliminates a vulnerability exposed by the breach; and
converting, by the at least one computer device, the first system to a decoy system.
2. The method of claim 1 , wherein the generating the second system comprises:
determining a vulnerability that permitted the breach;
creating the patch to eliminate the vulnerability;
provisioning a new production server and a new production database in the networked computing environment; and
applying the patch to at least one of the new production server and the new production database.
3. The method of claim 1 , further comprising:
routing a client request for a service to the first system prior to the generating the second system; and
routing a client request for the service to the second system after the generating the second system.
4. The method of claim 1 , wherein:
the first system and the second system are physically separate; and
the first system in the networked computer environment comprises a first server and a first database and the second system in the networked computer environment comprises a second server and a second database.
5. The method of claim 1 , wherein the converting the first system to the decoy system comprises generating and adding decoy high value data to the database of the first system.
6. The method of claim 1 , wherein a service provider at least one of creates, maintains, deploys and supports the at least one computer device.
7. The method of claim 1 , wherein the detecting the breach, the generating the second system, and the converting the first system are provided by a service provider on a subscription, advertising, and/or fee basis.
8. The method of claim 1 , wherein the detecting the breach, the generating the second system, and the converting the first system are provided by software as a service in a cloud environment.
9. The method of claim 1 , wherein the configuration update mitigates the breach.
10. A computer program product for providing data protection in a networked computing environment, the computer program product comprising a computer readable storage device having program instructions embodied therewith, the program instructions being executable by a computer device to cause the computer device to:
detect a breach of a first production system in the networked computing environment;
in response to the detecting the breach of the first production system, generate a second production system in the networked computing environment, wherein the second production system includes a database which includes a scrambled version of low value data and a patch which is a configuration update applied to the database of the second system that eliminates a vulnerability exposed by the breach; and
convert the first production system to a decoy system,
wherein the scrambled version of the low value data is encrypted.
11. The computer program product of claim 10 , wherein the generating the second production system comprises:
determining a vulnerability that permitted the breach;
creating the patch to eliminate the vulnerability;
provisioning a new production server and a new production database in the networked computing environment; and
applying the patch to at least one of the new production server and the new production database.
12. The computer program product of claim 10 , the program instructions further being executable by the computer device to cause the computer device to:
route a client request for a service to the first production system prior to the generating the second production system; and
route a client request for the service to the second production system after the generating the second production system.
13. The computer program product of claim 10 , wherein:
the first production system and the second production system are physically separate; and
the first production system in the networked computer environment comprises a first server and a first database and the second production system in the networked computer environment comprises a second server and a second database.
14. The computer program product of claim 10 , wherein the converting the first production system to the decoy system comprises generating decoy high value data based on low value data contained in a database in the first production system; and storing the decoy high value data in the database.
15. The computer program product of claim 10 , wherein a service provider at least one of creates, maintains, deploys and supports the at least one computer device.
16. The computer program product of claim 10 , wherein the detecting the breach, the generating the second production system, and the converting the first production system are provided by a service provider on a subscription, advertising, and/or fee basis.
17. The computer program product of claim 10 , wherein the detecting the breach, the generating the second production system, and the converting the first production system are provided by software as a service in a cloud environment.
18. The method of claim 1 , wherein the low value data comprises non-confidential data.
19. The method of claim 18 , wherein the converting the first system to the decoy system comprises deleting high value data from the decoy system.
20. The method of claim 19 , wherein the high value data comprises confidential data and a decoy high value data is generated based on the low value data contained in a first database in the first system.