Determination of a security rating of a network element
Systems and methods for a security rating framework that translates compliance requirements to corresponding desired technical configurations to facilitate generation of security ratings for network elements is provided. According to one embodiment, a host network element executes a collection of security checks on at least a first network element. The execution is performed by receiving configuration data of the first network element pertaining to each security check of the collection of security checks in response to a request by the host network element and validating each security check by comparing the received configuration data pertaining to each security check with a pre-defined or configurable network security configuration recommendation to generate a compliance result. Further, the host network element generates a compliance report by aggregating the compliance results obtained by executing each security check of the collection of security checks.
1. A method comprising:
executing, by a host network element of a plurality of network elements associated with an enterprise network of an enterprise and communicatively coupled with each other via a security fabric, a collection of security checks on at least one network element of the plurality of network elements by:
receiving configuration data of the at least one network element pertaining to each security check of the collection of security checks, wherein the configuration data is received via the security fabric in response to a request by the host network element sent via the security fabric; and
validating each security check by comparing the received configuration data pertaining to each security check with a pre-defined or configurable network security configuration recommendation to generate a compliance result; and
generating, by the host network element, a compliance report for the at least one network element by aggregating the compliance results obtained by executing each security check of the collection of security checks.
2. The method of claim 1 , wherein the plurality of network elements comprise network security devices.
3. The method of claim 1 , wherein a network security service to which a plurality of enterprises, including the enterprise, subscribe computes relative security rating scores for the plurality of enterprises by performing statistical analysis on compliance reports submitted by the plurality of enterprises.
4. The method of claim 3 , wherein the relative security rating scores are computed by comparing those of the plurality of enterprises within one or more of a particular region, a particular industry and a particular compliance sector.
5. The method of claim 1 , wherein the host network element builds an internal network topology to determine the first network element for which the compliance report is to be generated.
6. The method of claim 1 , wherein the host network element assigns an authentication token with the request.
7. The method of claim 1 , wherein each security check of the collection of security checks is associated with a dependency so that each security check is executed consecutively based on the associated dependency.
8. The method of claim 1 , wherein the collection of security checks are executed in batches.
9. The method of claim 8 , wherein the compliance report is generated on completion of the execution of each batch of the security checks.
10. The method of claim 1 , wherein the host network element receives the configuration data of the first network element when the first network element generates a security rating request.
11. The method of claim 1 , wherein the pre-defined or configurable network security configuration recommendation is derived by translating any or a combination of security, business, audit and compliance requirement into a desired technical configuration.
12. A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a host network element of a plurality of network elements associated with a network and communicatively coupled with each other via a security fabric, causes the one or more processors to perform a method comprising:
executing, a collection of security checks on at least a first network element of the plurality of network elements by:
receiving configuration data of the first network element pertaining to each security check of the collection of security checks, wherein the configuration data is received via the security fabric in response to a request by the host network element sent via the security fabric; and
validating each security check by comparing the received configuration data pertaining to each security check with a pre-defined or configurable network security configuration recommendation to generate a compliance result; and
generating a compliance report by aggregating the compliance results obtained by executing each security check of the collection of security checks.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the plurality of network elements comprise network security devices.
14. The non-transitory computer-readable storage medium of claim 12 , wherein the host network element builds an internal network topology to determine the first network element that requires the compliance report.
15. The non-transitory computer-readable storage medium of claim 12 , wherein the host network element assigns an authentication token with the request.
16. The non-transitory computer-readable storage medium of claim 12 , wherein each security check of the collection of security checks is associated with a dependency so that each security check is executed consecutively based on the associated dependency.
17. The non-transitory computer-readable storage medium of claim 12 , wherein the collection of security checks are executed in batches.
18. The non-transitory computer-readable storage medium of claim 17 , wherein the compliance report is generated on completion of the execution of each batch of the security checks.
19. The non-transitory computer-readable storage medium of claim 12 , wherein the host network element receives the configuration data of the first network element when the first network element generates a security rating request.
20. The non-transitory computer-readable storage medium of claim 12 , wherein the pre-defined or configurable network security configuration recommendation is derived by translating any or a combination of security, business, audit and compliance requirement into a desired technical configuration.
21. A system, the system comprising:
a processing resource;
a non-transitory computer-readable storage medium coupled to the processing resource, wherein the non-transitory computer-readable storage medium embodies a set of instructions, which when executed by processing causes the processing resource to perform a method comprising:
executing, a collection of security checks on at least a first network element of the plurality of network elements by:
receiving configuration data of the first network element pertaining to each security check of the collection of security checks, wherein the configuration data is received via the security fabric in response to a request by the host network element sent via the security fabric; and
validating each security check by comparing the received configuration data pertaining to each security check with a pre-defined or configurable network security configuration recommendation to generate a compliance result; and
generating a compliance report by aggregating the compliance results obtained by executing each security check of the collection of security checks.