Systems and methods for securing a dynamic workspace in an enterprise productivity ecosystem
Methods and system are provided for dynamically securing a workspace based on changes in the security context in which the workspace operates. Upon receiving a request from an IHS for access to a managed resource and receiving attributes of a risk context for the request, a risk score for the request is determined. A workspace definition that provides access to the managed resource is selected based on the risk score. A workspace definition includes security requirements for operation of the workspace by the IHS, where the security requirements are commensurate with the risk score. The workspace definition is transmitted to the IHS for operation of the workspace according to the security requirements. A risk context may include, IHS software, a physical environment in which the IHS is located, a physical location of the IHS, a classification of the requested resource, IHS hardware, and a user of the IHS.
1. A method, comprising:
receiving a request, from a first IHS (Information Handling System), for access to a managed resource;
receiving, from the first IHS, attributes of a first risk context of the request;
determining a risk score for the request, wherein the risk score is determined based on the first risk context as specified by the attributes provided by the first IHS;
selecting a workspace definition based on the risk score, wherein the workspace definition specifies a workspace that provides access to the managed resource via the first IHS and specifies security requirements for operation of the workspace by the first IHS; and
transmitting the workspace definition to the first IHS for operation of the workspace by the first IHS according to the security requirements.
2. The method of claim 1 , wherein the attributes of the first risk context comprise at least one of: a software environment of the first IHS, a physical environment in which the first IHS is located, a physical location of the first IHS, a classification of the requested resource, a hardware environment of the first IHS, and a user of the first IHS.
3. The method of claim 2 , wherein the software environment of the first IHS comprises version information for an operating system of the first IHS and applications running within the operating system.
4. The method of claim 2 , wherein the physical environment in which the first IHS is located comprises a network in use by the first IHS.
5. The method of claim 2 , wherein the physical location of the first IHS comprises at least one of: a geographic location, a geographic area, a facility, a country and an area defined by a geographic code.
6. The method of claim 2 , wherein the hardware environment of the first IHS comprises at least one of: an identity of a storage drive coupled to the first IHS, identities for attestable hardware components of the first IHS and an identity of a trusted controller operable for supporting workspaces on the first IHS.
7. The method of claim 6 , wherein the trusted controller is configured to host a secure execution environment that is isolated from the operating system of the first IHS and is further configured to support a workspace launch point on the first IHS.
8. The method of claim 7 , wherein the request for access to the managed resource is generated via a selection made via the workspace launch point.
9. The method of claim 1 , further comprising:
receiving, from the first IHS, attributes of a second risk context, wherein the second risk context reflects a change to the first risk context during operation of the workspace;
determining an updated risk score for ongoing support of the request based on the second risk context;
evaluating the workspace definition based on the updated risk score; and
when the updated risk score indicates modified security requirements are required for ongoing access to the managed resource, transmitting an updated workspace definition to the first IHS, wherein the updated workspace definition specifies the modified security requirements.
10. The method of claim 9 , wherein the first IHS modifies the operation of the workspace for providing ongoing access to the managed resource according to the modified security requirements in the updated workspace definition.
11. The method of claim 9 , the first IHS begins operation of a second workspace providing ongoing access to the managed resource according to the modified security requirements in the updated workspace definition.
12. An Information Handling System (IHS), comprising:
a processor; and
a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to:
transmit, to a workspace orchestration service, a request for access to a managed resource;
collect attributes describing a first risk context for the request;
transmit the attributes describing the first risk context to the workspace orchestration service that determines a risk score for the request, based on the first risk context;
receive a workspace definition from the workspace orchestration service, wherein the workspace definition is selected by the workspace orchestration service based on the risk score, and wherein the workspace definition specifies a workspace that provides access to the managed resource via the IHS and specifies security requirements for operation of the workspace by the IHS; and
initialize the workspace according to the workspace definition.
13. The IHS of claim 12 , wherein the attributes of the first risk context collected and transmitted by the IHS comprise at least one of: a software environment of the IHS, a physical environment in which the IHS is located, a physical location of the IHS, a classification of the requested resource, a hardware environment of the IHS, and a user of the IHS.
14. The IHS of claim 12 , wherein the software environment of the IHS comprises version information for an operating system of the IHS and applications running within the operating system, and wherein the hardware environment of the IHS comprises at least one of: an identity of a storage drive coupled to the IHS, identities for attestable hardware components of the IHS and an identity of a trusted controller operable for supporting workspaces on the IHS.
15. The IHS of claim 12 , wherein the physical environment in which the IHS is located comprises a network in use by the IHS, and wherein the physical location of the IHS comprises at least one of: a geographic location and a geographic area.
16. The IHS of claim 14 , wherein the trusted controller is configured to host a secure execution environment that is isolated from the operating system of the IHS and is further configured to support a workspace launch point on the IHS, wherein the request for access to the managed resource is generated via a selection made via the workspace launch point.
17. The IHS of claim 12 , wherein execution of the stored program instructions by the processor further causes the IHS to:
transmit, to the workspace orchestration service, attributes of a second risk context, wherein the second risk context reflects a change to the first risk context during operation of the workspace, and wherein the to the workspace orchestration service determines an updated risk score for ongoing support of the request based on the second risk context;
when the updated risk score indicates modified security requirements are required for ongoing access to the managed resource, receive an updated workspace definition from the workspace orchestration service, wherein the updated workspace definition specifies the modified security requirements; and
modify operation of the workspace or initiate a second workspace for providing ongoing access to the managed resource according to the modified security requirements in the updated workspace definition.
18. A memory storage device having program instructions stored thereon that, upon execution by one or more processors of an Information Handling System (IHS), cause the IHS to:
transmit, to a workspace orchestration service, a request for access to a managed resource;
collect attributes describing a first risk context for the request;
transmit the attributes describing the first risk context to the workspace orchestration service that determines a risk score for the request, based on the first risk context;
receive a workspace definition from the workspace orchestration service, wherein the workspace definition is selected by the workspace orchestration service based on the risk score, and wherein the workspace definition specifies a workspace that provides access to the managed resource via the IHS and specifies security requirements for operation of the workspace by the IHS; and
initialize the workspace according to the workspace definition.
19. The memory storage device of claim 18 , wherein the memory storage device and processors are comprised within a trusted controller of the IHS, wherein the trusted controller hosts a secure execution environment that is isolated from the operating system of the IHS and supports a workspace launch point.
20. The memory storage device of claim 19 , wherein the request for access to the managed resource is generated via a selection made via the workspace launch point.