Custom node and profile classifications for enterprise security management tool
Methods and systems for configuring a security policy for an enterprise within an enterprise security management tool are disclosed. In some aspects, such systems receive a definition of at least one custom classification within a user interface of the enterprise security management configuration tool, including a name of a profile and network activity associated with one or more nodes to be included within the profile. Such systems also generate a security settings file to be applied within the enterprise, the security settings file including, for each profile, a common security policy to each of the nodes included in the profile. The profiles to which the security settings file is applied include the profile defined by the at least one custom classification.
1. A method of configuring a security policy for an enterprise network within an enterprise security management configuration tool, the method comprising:
receiving network concordance data at an enterprise security management configuration tool, the network concordance data including a record of communications among a plurality of nodes within the enterprise;
receiving a definition of at least one custom classification within a user interface of the enterprise security management configuration tool, the at least one custom classification including a name of the custom classification and network activity associated with the custom classification;
receiving, in a configuration user interface, a selection of an affinitization level selected from a plurality of discrete affinitization levels, each of the discrete affinitization levels corresponding to a different extent to which nodes within an enterprise are grouped into profiles, wherein the nodes and profiles are classified according to a plurality of different classifications including the at least one custom classification;
grouping each of the plurality of nodes identified in the network concordance data into a plurality of profiles based on the selected affinitization level; and
generating a security settings file to be applied within the enterprise, the security settings file including, for each profile included in the plurality of profiles, a common security policy to each of the nodes included in the profile;
wherein the plurality of profiles includes the profile classified according to the at least one custom classification.
2. The method of claim 1 , further comprising:
defining a priority order of classifications of potential root profiles within the enterprise security management configuration tool; and
automatically forming one or more solutions within the enterprise security management tool based at least in part on root profiles identified within the plurality of profiles.
3. The method of claim 2 , further comprising adding the profile classified according to the at least one custom classification to the priority order of potential root profiles.
4. The method of claim 2 , further comprising deploying the one or more solutions, via the security settings file, wherein the security settings file describes security settings for each of the one or more nodes included in the identified one or more solutions.
5. The method of claim 4 , further comprising importing the security settings file into an enterprise management database defining an enterprise security topology.
6. The method of claim 2 , wherein defining one or more solutions includes logically associating two or more profiles via a channel.
7. The method of claim 1 , further comprising defining a custom service including a name of a service and network activity associated with the service.
8. The method of claim 7 , wherein the custom service is associated with one or more nodes to be included within the profile classified according to the at least one custom classification.
9. The method of claim 1 , wherein grouping each of the plurality of nodes into a plurality of profiles is performed automatically based at least in part on selection of the affinitization level.
10. The method of claim 1 , wherein grouping each of the plurality of nodes generates an enterprise topology graph within the configuration user interface.
11. The method of claim 1 , wherein the enterprise topology graph includes the profile defined by the at least one custom classification.
12. A computing system comprising:
a programmable circuit;
a memory communicatively connected to the programmable circuit, the memory storing computer-executable instructions implementing an enterprise security management tool which, when executed, causes the computing system to:
receive network concordance data including a record of communications among a plurality of nodes within the enterprise;
receive a definition of at least one custom classification within a user interface of the enterprise security management configuration tool, the at least one custom classification including a name of the custom classification and network activity associated with the custom classification;
receive, in a configuration user interface, a selection of an affinitization level selected from a plurality of discrete affinitization levels, each of the discrete affinitization levels corresponding to a different extent to which nodes within an enterprise are grouped into profiles, wherein the nodes and profiles are classified according to a plurality of different classifications including the at least one custom classification;
group each of the plurality of nodes identified in the network concordance data into a plurality of profiles based on the selected affinitization level; and
generate a security settings file to be applied within the enterprise, the security settings file including, for each profile included in the plurality of profiles, a common security policy to each of the nodes included in the profile;
wherein the plurality of profiles includes the profile classified according to the at least one custom classification.
13. The computing system of claim 12 , further comprising a plurality of server computers communicatively interconnected within an enterprise.
14. The computing system of claim 12 , wherein the at least one custom classification includes the name, one or more ports associated with the network activity, a type of network traffic associated with the network activity, and a consumer/provider flag.
15. The computing system of claim 12 , wherein the custom classification is reusable across a plurality of projects within the enterprise security management configuration tool.
16. The computing system of claim 12 , wherein the enterprise security management tool includes at least one predefined classification.
17. The computing system of claim 16 , wherein the predefined classification includes a name of the classification and network activity associated with one or more nodes to be classified according to the predefined classification, the name and the network activity being unmodifiable by a user.
18. The computing system of claim 12 , wherein the enterprise security management tool is further configured to:
define a priority order of potential root profiles within the enterprise security management configuration tool; and
automatically form one or more solutions within a user interface of the enterprise security management tool based at least in part on root profiles identified within the plurality of profiles.
19. The computing system of claim 18 , wherein the enterprise security management tool is further configured to:
in response to at least one of (a) editing the priority order of potential root profiles, (b) editing heuristics of the custom classification, or (c) adding or removing a custom classification:
automatically re-form the one or more solutions within the user interface of the enterprise security management configuration tool.
20. The computing system of claim 18 , wherein the enterprise security management tool is further configured to:
in response to changing the priority order of potential root profiles, automatically re-form the one or more solutions within the user interface of the enterprise security management configuration tool.
21. The computing system of claim 12 , wherein the enterprise security management tool, when executed, causes the computing system to:
display a configuration user interface including a logical network topology for an enterprise network based on the network concordance data received by the enterprise security management tool, wherein display of the plurality of profiles including the profile classified according to the at least one custom classification reduces a number of nodes displayed in the enterprise security configuration user interface.
22. The enterprise security management server of claim 21 , wherein the enterprise security management tool is further configured to, when executed, cause the computing system to:
receive, at the classification manager user interface, a root ordering of the classifications, including the custom classification; and
display, in the configuration user interface, at least one solution including a plurality of profiles, the at least one solution defined based on the root ordering.
23. The enterprise security management server of claim 21 , wherein the enterprise security management tool is further configured to, when executed, cause the computing system to:
receive, at a service manager user interface, a definition of a service including a name of the service and network activity associated with the service;
wherein the service is selectable within the classification manager user interface to define network activity associated with the custom classification.