Context-based cloud security assurance system
A cloud infrastructure is enhanced to provide a context-based security assurance service to enable secure application deployment. The service inspects network and cloud topologies to identify potential security capabilities and needs. Preferably, these options are then surfaced to the user with easy-to-understand, pre-configured templates representing security assurance levels. When a template (e.g., representing a pre-configured assurance level) is selected by the user, the system then applies specific capabilities and controls to translate the user-selected generalized specification (e.g., “high security”) into granular requirements for a specific set of security resources. Preferably, the identification of these security resources is based on system configuration, administration, and information associated with the pre-configured template.
1. A method for improving a cloud application deployment service operative in a cloud application environment, comprising:
receiving information on a set of security capabilities available in the cloud application environment to define a security context, the security capabilities including identification of at least one security product or its current security settings;
receiving a selection of a security assurance level, wherein the security assurance level is specified in a template by a set of general security requirements, at least one of the set of general security requirements being specified in a manner that does not expose at least some specific security resource requirements necessary to implement the security assurance level, the template including an interface to enable receipt of an instruction to wire a security capability into an application being deployed by the cloud application deployment service;
for a given security assurance level, mapping the at least one of the set of general security requirements being specified to the identification of the at least one security product or its current security settings; and
responsive to receipt of the selection of the security assurance level that includes the mapping, and based at least in part on the security context, applying, via automation, configuration changes to a set of security resources in the cloud application environment to provide a context-based security assurance zone for the application being deployed by the cloud application deployment service, the configuration changes installing the at least one security product or adjusting its current security settings, and enforcing a wiring instruction as specified in the template, wherein enforcing the wiring instruction enforces a wiring restriction between a first security resource and a second security resource in response to receipt of an instruction to wire the security capability;
wherein the receiving and configuring steps are carried out in software executing in a hardware element.
2. The method as described in claim 1 further including providing a set of templates, each template having associated therewith one of the security assurance levels, and wherein the selection of the security assurance level corresponds to selection of a template.
3. The method as described in claim 2 wherein the set of templates are provided to an end user via user interface tooling associated with the cloud application environment, wherein receipt of the selection corresponds to a selection by the end user via the user interface tooling.
4. The method as described in claim 2 wherein the templates are provided to a security administrator via an administrative interface.
5. The method as described in claim 4 further including adjusting the set of security requirements associated with a template via the administrative interface.
6. The method as described in claim 1 wherein the method further includes adjusting the set of security resources configured.
7. The method as described in claim 6 wherein the adjusting occurs upon one of: de-configuration of a security environment when an application is un-deployed, modification of a security environment for a first application when a second application is deployed, and modification of a security environment for a first application when a second application having a higher security level than that of the first application is de-configured.
8. Apparatus, comprising:
a processor;
computer memory holding computer program instructions executed by the processor to improve a cloud application deployment service operative in a cloud application environment, the computer program instructions comprising:
program code, operative to receive information on a set of security capabilities available in the cloud application environment, to define a security context, the security capabilities including identification of at least one security product or its current security settings;
program code, operative to receive a selection of a security assurance level, wherein the security assurance level is specified in a template by a set of general security requirements, at least one of the set of general security requirements being specified in a manner that does not expose at least some specific security resource requirements necessary to implement the security assurance level, the template including an interface to enable receipt of an instruction to wire a security capability into an application being deployed by the cloud application deployment service;
program code, operative for a given security assurance level, to map the at least one of the set of general security requirements being specified to the identification of the at least one security product or its current security settings; and
program code, responsive to receipt of the selection of the security assurance level that includes the mapping, and based at least in part on the security context, to apply, via automation, configuration changes to a set of security resources in the cloud application environment to provide a context-based security assurance zone for the application being deployed by the cloud application deployment service, the configuration changes installing the at least one security product or adjusting its current security settings, and enforcing any a wiring instruction as specified in the template, wherein enforcing the wiring instruction enforces a wiring restriction between a first security resource and a second security resource in response to receipt of an instruction to wire the security capability.
9. The apparatus as described in claim 8 wherein the computer program instructions further include program code to provide a set of templates, each template having associated therewith one of the security assurance levels, and wherein the selection of the security assurance level corresponds to selection of a template.
10. The apparatus as described in claim 9 wherein the set of templates are provided to an end user via user interface tooling associated with the cloud application environment, wherein receipt of the selection corresponds to a selection by the end user via the user interface tooling.
11. The apparatus as described in claim 9 further including an administrative interface, and wherein the templates are provided to a security administrator via the administrative interface.
12. The apparatus as described in claim 11 wherein the computer program instructions further include program code to adjust the set of security requirements associated with a template via the administrative interface.
13. The apparatus as described in claim 8 further including program code operative to adjust the set of security resources configured.
14. The apparatus as described in claim 13 wherein the adjusting occurs upon one of: de-configuration of a security environment when an application is un-deployed, modification of a security environment for a first application when a second application is deployed, and modification of a security environment for a first application when a second application having a higher security level than that of the first application is de-configured.
15. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions executed by the data processing system to improve a cloud application deployment service operative in a cloud application environment, the computer program instructions comprising:
program code, operative to receive information on a set of security capabilities available in the cloud application environment, to define a security context, the security capabilities including identification of at least one security product or its current security settings;
program code, operative to receive a selection of a security assurance level, wherein the security assurance level is specified in a template by a set of general security requirements, at least one of the set of general security requirements being specified in a manner that does not expose at least some specific security resource requirements necessary to implement the security assurance level, the template including an interface to enable receipt of an instruction to wire a security capability into an application being deployed by the cloud application deployment service;
program code, operative for a given security assurance level, to map the at least one of the set of general security requirements being specified to the identification of the at least one security product or its current security settings; and
program code, responsive to receipt of the selection of the security assurance level that includes the mapping, and based at least in part on the security context, to apply, via automation, configuration changes to a set of security resources in the cloud application environment to provide a context-based security assurance zone for the application being deployed by the cloud application deployment service, the configuration changes installing the at least one security product or adjusting its current security settings, and enforcing a wiring instruction as specified in the template, wherein enforcing the wiring instruction enforces a wiring restriction between a first security resource and a second security resource in response to receipt of an instruction to wire the security capability.
16. The computer program product as described in claim 15 wherein the computer program instructions further include program code to provide a set of templates, each template having associated therewith one of the security assurance levels, and wherein the selection of the security assurance level corresponds to selection of a template.
17. The computer program product as described in claim 16 wherein the set of templates are provided to an end user via user interface tooling associated with the cloud application environment, wherein receipt of the selection corresponds to a selection by the end user via the user interface tooling.
18. The computer program product as described in claim 16 further including an administrative interface, and wherein the templates are provided to a security administrator via the administrative interface.
19. The computer program product as described in claim 18 wherein the computer program instructions further include program code to adjust the set of security requirements associated with a template via the administrative interface.
20. The computer program product as described in claim 15 further including program code operative to adjust the set of security resources configured.
21. The computer program product as described in claim 20 wherein the adjusting occurs upon one of: de-configuration of a security environment when an application is un-deployed, modification of a security environment for a first application when a second application is deployed, and modification of a security environment for a first application when a second application having a higher security level than that of the first application is de-configured.