Systems and methods for application placement in a network based on host security posture

1. A method comprising:

determining a respective security posture score for each of a plurality of candidate hosts of an enterprise network, the security posture score for a first host of the candidate hosts being based on a combination of:

a process hash score as an assessment of process binary hash or file hash consistency across workloads on the first host, or across multiple hosts of the candidate hosts;

an attack surface score for both the first host and a workload to be placed that measures a number of potential attack surfaces of the first host or the workload;

a forensics score for the first host that measures the impact of a security incident at the first host;

a network anomaly score for the first host that measures the severity of a data leak event at the first host; and

a segmentation compliance score for the first host that measures any policy violations associated with candidate host;

identifying a set of performance parameters and security parameters for a host in the enterprise network to execute a workload thereon;

selecting a host from the plurality of candidate hosts having a security posture score matching the performance parameters and the security parameters for executing the workload; and

placing the workload on the host.

2. The method of claim 1 , wherein the respective security posture for each of the plurality of candidate hosts is determined based on one or more of a number of open ports for a corresponding candidate host, current or scheduled processes executed on the corresponding candidate host, geo-specific risks associated with the corresponding candidate host, flows associated with the corresponding candidate host and a security score of the corresponding candidate host.

3. The method of claim 1 , wherein the respective security posture score for each of the plurality of candidate hosts is further determined based on a corresponding neighborhood security assessment of a neighborhood associated with a candidate host.

4. The method of claim 1 , wherein the set of performance parameters and security parameters identify a desired processing capacity, a desired host availability and a desired security specification for the host.

5. The method of claim 1 , wherein identifying the set of performance and security parameters comprises receiving the set of performance and security parameters via a terminal coupled to the enterprise network.

6. The method of claim 1 , wherein identifying the set of performance and security parameters is automatically determined.

7. The method of claim 1 , further comprising:

presenting a set of candidate hosts for selection on a terminal coupled to the enterprise network; and

receiving a selection of the host via the terminal.

8. An application placement system comprising:

one or more processors; and

at least one non-transitory computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to:

determine, by a security score service, a respective security posture score for each of a plurality of candidate hosts of an enterprise network, the security posture score for a first host of the candidate hosts being based on a combination of:

a process hash score as an assessment of process binary hash or file hash consistency across workloads on the first host, or across multiple hosts of the candidate hosts;

an attack surface score for both the first host and a workload to be placed that measures a number of potential attack surfaces of the first host or the workload;

a forensics score for the first host that measures the impact of a security incident at the first host a network anomaly score for the first host that measures the severity of a data leak event at the first host; and

a segmentation compliance score for the first host that measures any policy violations associated with candidate host;

identify, by a user, a set of performance parameters and security parameters for a host in the enterprise network to execute a workload thereon;

select, by an application placement engine, a host from the plurality of candidate hosts having a security posture score matching the performance parameters and the security parameters for executing the workload; and

place, by an application deployment engine, the workload on the host.

9. The application placement system of claim 8 , wherein respective security posture for each of the plurality of candidate hosts is determined based on one or more of a number of open ports for a corresponding candidate host, current or scheduled processes executed on the corresponding candidate host, geo-specific risks associated with the corresponding candidate host, flows associated with the corresponding candidate host and a security score of the corresponding candidate host.

10. The application placement system of claim 8 , wherein the respective security posture score for each of the plurality of candidate hosts is further determined based on a corresponding neighborhood security assessment of a neighborhood associated with a candidate host.

11. The application placement system of claim 8 , wherein the set of performance parameters and security parameters identify a desired processing capacity, a desired host availability and a desired security specification for the host.

12. The application placement system of claim 8 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to:

receive the set of performance and security parameters via a terminal coupled to the enterprise network.

13. The application placement system of claim 8 , wherein identify the set of performance and security parameters is automatically determined.

14. The application placement system of claim 8 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to:

presenting a set of candidate hosts for selection on a terminal coupled to the enterprise network; and

receiving a selection of the host via the terminal.

15. A non-transitory computer-readable storage medium comprising instructions which, when executed by one or more processors of an application placement system, cause the application placement system to:

determine a respective security posture score for each of a plurality of candidate hosts of an enterprise network, the security posture score for a first host of the candidate hosts being based on a combination of:

a process hash score as an assessment of process binary hash or file hash consistency across workloads on the first host, or across multiple hosts of the candidate hosts;

an attack surface score for both the first host and a workload to be placed that measures a number of potential attack surfaces of the first host or the workload;

a forensics score for the first host that measures the impact of a security incident at the first host;

a network anomaly score for the first host that measures the severity of a data leak event at the first host; and

a segmentation compliance score for the first host that measures any policy violations associated with candidate host;

identify a set of performance parameters and security parameters for a host in the enterprise network to execute a workload thereon;

select a host from the plurality of candidate hosts having a security posture score matching the performance parameters and the security parameters for executing the workload; and

place the workload on the host.

16. The non-transitory computer-readable storage medium of claim 15 , wherein the respective security posture for each of the plurality of candidate hosts is determined based on one or more of a number of open ports for a corresponding candidate host, current or scheduled processes executed on the corresponding candidate host, geo-specific risks associated with the corresponding candidate host, flows associated with the corresponding candidate host and a security score of the corresponding candidate host.

17. The non-transitory computer-readable storage medium of claim 15 , wherein the respective security posture score for each of the plurality of candidate hosts is further determined based on a corresponding neighborhood security assessment of a neighborhood associated with a candidate host.

18. The non-transitory computer-readable storage medium of claim 15 , wherein the set of performance parameters and security parameters identify a desired processing capacity, a desired host availability and a desired security specification for the host.

19. The non-transitory computer-readable storage medium of claim 15 , wherein execution of the instructions by the one or more processors further cause the application placement system to:

receive the set of performance and security parameters via a terminal coupled to the enterprise network.

20. The non-transitory computer-readable storage medium of claim 15 , wherein identify the set of performance and security parameters is automatically determined.