Resolving the disparate impact of security exploits to resources within a resource group
Systems, methods, and apparatuses enable one or more security microservices to resolve the disparate impact of security exploits to resources within a resource group. When a resource group is determined to be impacted by a security exploit, the one or more security microservices determines whether the members of the resource group are disparately impacted. In response, the one or more security microservices splits the resource group into an impacted resource group and a non-impacted resource group and applies exploit mitigation to the resource group members in the impacted resource group. When the one or more security microservices determine that the resource group members of the split resource group are no longer disparately impacted, the one or more security microservices combine the impacted resource group and the non-impacted resource group back into a single resource group.
1 . A computer-implemented method comprising:
during runtime, identifying, by a security service executing on one or more processors, a plurality of resource groups, each resource group having at least one computing resource available to a host computing system, wherein the host computing system provides a plurality of security microservices that have a hierarchical organization and are independent of each other;
identifying a security exploit and, using at least one of the plurality of microservices, identifying a first a resource group from the plurality of resource groups as impacted by a security exploit;
splitting the first resource group into an impacted resource group comprising those impacted by the security exploit and a second resource group comprising those not impacted by the security exploit;
intercepting traffic directed to and from the first resource group by configuring an interface microservice to operate in-line for the first resource group while not intercepting traffic directed to a non-impacted resource group;
applying an exploit mitigation to at least a portion of the intercepted traffic with one or more of the plurality of security microservices; and
determining that the security exploit has been resolved with the one or more of the plurality of security microservices.
2 . The computer-implemented method of claim 1 , wherein identifying that there is a disparate impact to the resource group members of the identified resource group comprises identifying a first set of resource group members as impacted by a security exploit and a second set of resource group members as non-impacted by the security exploit with one or more of the plurality of security microservices.
3 . The computer-implemented method of claim 2 , further comprising splitting the identified resource group into the impacted resource group and the non-impacted resource group with one or more of the plurality of security microservices by:
generating a first data structure for the first set of resource group members and a second data structure for the second set of resource group members;
moving first metadata for the first set of resource group members to the first data structure;
moving second metadata for the second set of resource group members to the second data structure; and
associating the first data structure and the second data structure.
4 . The computer-implemented method of claim 2 , further comprising splitting the identified resource group into the impacted resource group and the non-impacted resource group with one or more of the plurality of security microservices by:
generating a first data structure for the first set of resource group members;
moving metadata for the first set of resource group members to the first data structure; and
associating the first data structure with the identified resource group.
5 . The computer-implemented method of claim 1 further comprising combining the impacted resource group and the non-impacted resource group into a single resource group in response to determining if the security exploit has been resolved with one or more of the plurality of security microservices.
6 . The computer-implemented method of claim 2 , wherein determining if the security exploit has been resolved with one or more of the plurality of security microservices comprises determining that the first set of resource group members are updated to the same version of an application as the second set of resource group members.
7 . One or more non-transitory computer-readable storage media storing instructions which, when executed by one or more hardware processors, cause performance of a method comprising:
during runtime, identifying, by a security service executing on one or more processors, a plurality of resource groups, each resource group having at least one computing resource available to a host computing system, wherein the host computing system provides a plurality of security microservices that have a hierarchical organization and are independent of each other;
identifying a security exploit and, using at least one of the plurality of microservices, identifying a first a resource group from the plurality of resource groups as impacted by a security exploit;
splitting the first resource group into an impacted resource group comprising those impacted by the security exploit and a second resource group comprising those not impacted by the security exploit;
intercepting traffic directed to and from the first resource group by configuring an interface microservice to operate in-line for the first resource group while not intercepting traffic directed to a non-impacted resource group;
applying an exploit mitigation to at least a portion of the intercepted traffic with one or more of the plurality of security microservices; and
determining that the security exploit has been resolved with the one or more of the plurality of security microservices.
8 . The non-transitory computer-readable storage media of claim 7 , wherein identifying that there is a disparate impact to the resource group members of the identified resource group comprises identifying a first set of resource group members as impacted by a security exploit and a second set of resource group members as non-impacted by the security exploit with one or more of the plurality of security microservices.
9 . The non-transitory computer-readable storage media of claim 8 , further comprising splitting the identified resource group into the impacted resource group and the non-impacted resource group with one or more of the plurality of security microservices by:
generating a first data structure for the first set of resource group members and a second data structure for the second set of resource group members;
moving first metadata for the first set of resource group members to the first data structure;
moving second metadata for the second set of resource group members to the second data structure; and
associating the first data structure and the second data structure.
10 . The non-transitory computer-readable storage media of claim 8 , further comprising splitting the identified resource group into the impacted resource group and the non-impacted resource group with one or more of the plurality of security microservices by:
generating a first data structure for the first set of resource group members;
moving metadata for the first set of resource group members to the first data structure; and
associating the first data structure with the identified resource group.
11 . The non-transitory computer-readable storage media of claim 7 further comprising combining the impacted resource group and the non-impacted resource group into a single resource group in response to determining if the security exploit has been resolved with one or more of the plurality of security microservices.
12 . The non-transitory computer-readable storage media of claim 8 , wherein determining if the security exploit has been resolved with one or more of the plurality of security microservices comprises determining that the first set of resource group members are updated to a same version of an application as the second set of resource group members.
13 . An apparatus comprising:
one or more hardware processors;
memory coupled to the one or more hardware processors, the memory storing instructions which, when executed by the one or more hardware processors, causes the apparatus to:
during runtime, identify, by a security service executing on one or more processors, a plurality of resource groups, each resource group having at least one computing resource available to a host computing system, wherein the host computing system provides a plurality of security microservices that have a hierarchical organization and are independent of each other;
identify a security exploit and, using at least one of the plurality of microservices, identifying a first a resource group from the plurality of resource groups as impacted by a security exploit;
split the first resource group into an impacted resource group comprising those impacted by the security exploit and a second resource group comprising those not impacted by the security exploit;
intercept traffic directed to and from the first resource group by configuring an interface microservice to operate in-line for the first resource group while not intercepting traffic directed to a non-impacted resource group;
apply an exploit mitigation to at least a portion of the intercepted traffic with one or more of the plurality of security microservices; and
determine that the security exploit has been resolved with the one or more of the plurality of security microservices.
14 . The apparatus of claim 13 , wherein identifying that there is a disparate impact to the resource group members of the identified resource group comprises identifying a first set of resource group members as impacted by a security exploit and a second set of resource group members as non-impacted by the security exploit with one or more of the plurality of security microservices.
15 . The apparatus of claim 14 , further comprising splitting the identified resource group into the impacted resource group and the non-impacted resource group with one or more of the plurality of security microservices by:
generating a first data structure for the first set of resource group members and a second data structure for the second set of resource group members;
moving first metadata for the first set of resource group members to the first data structure;
moving second metadata for the second set of resource group members to the second data structure; and
associating the first data structure and the second data structure.
16 . The apparatus of claim 14 , further comprising splitting the identified resource group into the impacted resource group and the non-impacted resource group with one or more of the plurality of security microservices by:
generating a first data structure for the first set of resource group members;
moving metadata for the first set of resource group members to the first data structure; and
associating the first data structure with the identified resource group.
17 . The apparatus of claim 14 further comprises combining the impacted resource group and the non-impacted resource group into a single resource group in response to determining if the security exploit has been resolved with one or more of the plurality of security microservices.
18 . The apparatus of claim 14 , wherein determining if the security exploit has been resolved with one or more of the plurality of security microservices comprises determining that the first set of resource group members are updated to a same version of an application as the second set of resource group members.