Determination and autocorrection of modified security policies

A method and a system for automatically managing security policies at multiple resources are provided. A policy management engine receives and deploys a security policy configured for each resource with one or more configuration parameters on a security component of each resource. The policy management engine determines modifications made to the security policy at a corresponding resource and automatically corrects the security policy at the corresponding resource. The policy management engine generates and renders a notification including the security policy, the modifications, and detailed information of the modifications and the automatic correction of the security policy to an administrator device. The detailed information includes a description, a type, a timestamp, number of instances, etc., of each modification, volume and type of traffic flow incurred due to the modifications, historical modification information, a timestamp and a status of the automatic correction, historical correction information, a resource identification, event information, etc.

BACKGROUND

Technical Field

The embodiments disclosed herein, in general, relate to management of security policies. More particularly, the embodiments disclosed herein relate to detecting, automatically correcting, and notifying modifications made to security policies at multiple resources.

Description of the Related Art

In conventional perimeter firewalls, firewall systems are standalone units that strictly control access to an internal private network and network resources, thereby making it difficult for users to modify security policies, for example, firewall policies. Moreover, the list of software applications installed on these firewall systems is firmly controlled, making it difficult for malware to be installed on these firewall systems. Adoption of microsegmentation using host-based or distributed firewalls is on the rise. Most enterprises are moving towards microsegmented networks. Microsegmentation is used to segment and control access between resources and servers in a granular way. However, with microsegmentation and, host-based or distributed firewalls, security policies, for example, host-based firewall policies, are directly configured on the resources or endpoint devices, for example, servers, workstations, user machines, laptops, tablet computing devices, etc., on which user access cannot be restricted. Furthermore, on these resources, it is difficult to restrict the type of software being installed. There is a high possibility that either an insider threat from a malicious user or a malicious software may modify the security policies to gain access to the internal private network and network resources, when such an access has been prevented explicitly. Since these resources are accessed by many employees of an organization and many applications are installed on these resources, there is a risk of an employee or software with malicious intent modifying the security policies, as the security policies are directly configured on the resources. There is a need for detecting such modifications and automatically correcting the security policies. Moreover, there is a need for notifying these modifications to system administrators to allow them to investigate the resources involved in security breaches and identify reasons behind the security breaches. Conventional solutions do not support detecting, identifying, correcting, and notifying modifications made to security policies at endpoints.

Hence, there is a long-felt need for a method and a system for automatically managing security policies at multiple resources by detecting, identifying, automatically correcting, and notifying modifications made to the security policies at the resources.

SUMMARY

This summary is provided to introduce a selection, of concepts in a simplified form that are further disclosed in the detailed description. This summary is not intended to determine the scope of the claimed subject matter.

The method and the system disclosed herein address the above-recited need for automatically managing security policies at multiple resources, or endpoint devices by detecting, identifying, automatically correcting, and notifying modifications made to the security policies at the resources. The method and the system disclosed herein allow system administrators to be notified of unauthorized modifications made to security policies and for such modifications to be automatically corrected at the resources. The method disclosed herein employs a policy management engine and at least one processor configured to execute computer program instructions defined by the policy management engine for detecting, identifying, automatically correcting, and notifying modifications made to the security policies at multiple resources. In an embodiment, the resources comprise grouped sets of resources.

The policy management engine receives and deploys a security policy configured for each of the resources with one or more of multiple configuration parameters on a security component of each of the resources. The security component is, for example, a host-based firewall deployed on each of the resources. The security policy is, for example, a host-based firewall policy implemented at each of the resources. The configuration parameters comprise, for example, a type of each rule of the security policy, a source internet protocol (IP) address, a destination IP address, a destination port, a traffic protocol, etc. In an embodiment, the policy management engine transforms the security policy into a format applicable to each of the resources and configures the transformed security policy on the security component of each of the resources. The policy management engine creates and stores a policy digest comprising the security policy and the configuration parameters in a storage device at each of the resources. The policy management engine monitors the security component and determines modifications made to the security policy at a corresponding resource. The modifications comprise, for example, additions, deletions, and changes made to the security policy. The changes made to the security policy comprise, for example, allowing or denying access to one or more resources for one or more protocols. In an embodiment, the policy management engine recomputes the security policy at the security component of the corresponding resource and compares the recomputed security policy with the deployed security policy for determining the modifications made to the security policy at the corresponding resource.

On determining the modifications made to the security policy, the policy management engine automatically corrects the security policy at the corresponding resource. The policy management engine generates and renders a notification comprising the security policy, the modifications, and detailed information of the modifications and the automatic correction of the security policy to at least one administrator device for analysis and management of the security policy. The detailed information of the modifications and the automatic correction of the security policy comprises, for example, an identification of the corresponding resource, a description of the modifications made to the security policy at the corresponding resource, a type of each of the modifications, a timestamp of each of the modifications, locations of the modifications, a number of instances of each of the modifications, volume and type of traffic flow incurred due to the modifications, historical modification information associated with each of the resources, corrections required in the security policy, a timestamp of the automatic correction, a status of the automatic correction, historical correction information associated with each of the resources, and event information that triggered the modifications. The historical modification information provides an indication of a corresponding resource where the security policy is continuously modified. In an embodiment, the policy management engine determines an extent and patterns of changes incurred due to the modifications made to the security policy at each of the resources using one or more items of the detailed information.

In an embodiment, the policy management engine is implemented at a policy controller on an administrator device and at a policy agent deployed on each of multiple resources in a one-to-one correspondence, where one policy agent corresponds to one resource. The policy controller supports the configuration of security policies between grouped sets of resources. The policy controller supports derivation of resource specific security policies and sending the resource specific security policies to the resources. The policy controller supports receiving the modified security policies from the resources and by comparing the modified security policies with the original security policies, determines, for example, port and protocol based rules added and/or deleted, IP addresses added to existing port and protocol based rules, IP addresses deleted in existing port and protocol based rules, etc. The policy controller also determines the traffic which was allowed or denied due to the modifications made to the security policies. Furthermore, the policy controller notifies a system administrator of, for example, the exact nature of modifications made to the security policies, a time of each modification, a time of each correction, history of such modifications including a count of such modifications and details of such modifications, traffic that was allowed due to the modifications made to the security policies, etc. The policy agent deployed at each of the resources receives the set of security policies from the policy controller and converts, the security policies to a format that can be interpreted by operating system (OS) application programming interfaces (APIs) or commands. The policy agent creates and maintains a digest of rules from the received security policy. The policy agent monitors the security component deployed at the resource for any modifications made to the security policy deployed at the security component and, on identifying such modifications, the policy agent generates and renders a notification comprising, for example, a complete set of rules including the modified rules of the security policy, time of modification, time of autocorrection, etc.

In one or more embodiments, related systems comprise circuitry and/or programming for effecting the methods disclosed herein. The circuitry and/or programming can be any combination of hardware, software, and/or firmware configured to effect the methods disclosed herein depending upon the design choices of a system designer. Also, in an embodiment, various structural elements can be employed depending on the design choices of the system designer.

DETAILED DESCRIPTION

Various aspects of the present disclosure may be embodied as a system, a method, or a non-transitory, computer-readable storage medium having one or more computer-readable program codes stored thereon. Accordingly, various embodiments of the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment comprising, for example, microcode, firmware, software, etc., or an embodiment combining software and hardware aspects that may be referred to herein as a “system”, a “module”, an “engine”, a “circuit”, or a “unit”.

FIG. 1illustrates a method for automatically managing security policies at multiple resources. The method disclosed herein employs a policy management engine and at least one processor configured to execute computer program instructions defined by the policy management engine for detecting, identifying, automatically correcting, and notifying modifications made to security policies at multiple resources. The resources are devices on which security policies are configured by creating and applying rules of the security policies on security components deployed on the resources. The rules of the security policies, for example, allow only specific and restricted access from resources such as endpoint devices to only allowed resources such as servers. The resources comprise, for example, endpoint devices such as personal computers, tablet computing devices, mobile computers, mobile phones, smart phones, portable computing devices, laptops, personal digital assistants, wearable computing devices such as smart glasses, smart watches, etc., touch centric devices, workstations, client devices, servers, portable electronic devices, network-enabled computing devices, interactive network-enabled communication devices, gaming devices, image capture devices, web browsers, any other suitable computing equipment, combinations of multiple pieces of computing equipment, etc. In an embodiment, the resources comprise grouped sets of resources, where each grouped set of resources is provided specific and restricted access to only allowed resources.

The security policies comprise, for example, host-based firewall policies configured on security components, for example, host-based firewalls deployed at the resources. A host-based firewall is a firewall that runs on each individual resource connected to a network. The host-based firewall determines whether to allow incoming and outgoing network traffic into and out of an individual resource, protects the individual resource from viruses and malware, and controls the spread of malware attacks throughout the network. The host-based firewall blocks inbound and outbound network traffic that is not expressly permitted by a host-based firewall policy. The security policies comprise rules that define how inbound and outbound network traffic should be handled for specific Internet protocol (IP) addresses, address ranges, protocols, applications, etc. The rules of the security policies are typically configured based on a source IP address, a destination IP address, and a port and protocol combination. The rules of the security policies define what IP protocols to pass, appropriate source and destination IP addresses to be used, transmission control protocol (TCP) and user datagram protocol (UDP) ports to be accessed, particular internet control message protocol (ICMP) types and codes to be used, etc. For example, rules of the host-based firewall policy typically use an IP address, a port, a protocol, and a direction of traffic, that is, inbound or outbound, as filters to determine whether to allow traffic to either enter or exit a resource on which the host-based firewall policy is applied.

In the method disclosed herein, the policy management engine receives and deploys101a security policy configured for each of the resources with one or more of multiple configuration parameters on a security component, for example, a host-based firewall, of each of the resources. The security policy is, for example, a host-based firewall policy implemented at each of the resources. The configuration parameters comprise, for example, a type of each rule of the security policy, a source IP address, a destination IP address, a destination port, a traffic protocol, etc. In an embodiment, the policy management engine transforms the security policy into a format applicable to each of the resources, and configures the transformed security policy on the security component of each of the resources. The policy management engine creates and stores a policy digest comprising the security policy and the configuration parameters in a storage device at each of the resources. The policy management engine monitors102the security component and determines modifications made to the security policy at a corresponding resource. The modifications comprise, for example, additions, deletions, and changes made to the security policy that tamper the originally configured security policy. The additions comprise, for example, addition of one or more rules to the security policy. The deletions comprise, for example, deletion of one or more rules from the security policy. The changes comprise, for example, allowing access to particular IP addresses that were not part of the originally configured security policy, denying access to specific IP addresses that were part of the originally configured security policy, adding a port and a protocol that were not part of the originally configured security policy, etc. The policy management engine identifies when the security policy was tampered, that is, when an unauthorized modification was made to the security policy within a particular resource.

In an embodiment, the policy management engine recomputes the security policy at the security component of the corresponding resource and compares the recomputed security policy with the deployed security policy for determining the modifications made to the security policy at the corresponding resource. On determining the modifications made to the security policy, the policy management engine automatically corrects103the security policy at the corresponding resource. The policy management engine reapplies the correct security policy as originally configured for the corresponding resource where the modifications were determined, thereby automatically correcting the modified security policy at the corresponding resource. The policy management engine generates and renders104a notification comprising the security policy, the modifications, and detailed information of the modifications and the automatic correction (autocorrection) of the security policy to at least one administrator device for analysis and management of the security policy.

The detailed information of the modifications and the autocorrection of the security policy comprises, for example, an identification of the corresponding resource where the modifications were determined, a description of the modifications made to the security policy at the corresponding resource, a type of each of the modifications, a timestamp of each of the modifications, locations of the modifications, a number of instances of each of the modifications, volume and type of traffic flow incurred due to the modifications, historical modification information associated with each of the resources, corrections required in the security policy, a timestamp of the autocorrection, a status of the autocorrection, historical correction information associated with each of the resources, and event information that triggered the modifications. The historical modification information provides an indication of a corresponding resource where the security policy is continuously modified. Using the detailed information in the notification, the policy management engine notifies, for example, the time of modification of rules in the security policy, the type of modification such as addition of one or more rules, deletion of one or more rules, changes made to one or more rules such as allowing or denying access to one or more resources for one or more protocols, etc., status of autocorrection of the security policy, that is, whether the autocorrection succeeded or not, number of modification instances with a timestamp of each modification, an extent of unauthorized traffic flow incurred due to the modification, etc., to a system administrator via a graphical user interface (GUI) of an administrator device. Using the detailed information in the notification, the system administrator can generate insights on the reasons for the modifications, for example, allowing access to a restricted server through a transmission control protocol (TCP) port443to steal information from that restricted server or allowing access to a restricted website such as an entertainment website on an work computer, etc. In an embodiment, the policy management engine determines an extent and patterns of changes incurred due to the modifications made to the security policy at each of the resources using one or more items of the detailed information, for example, the historical modification information, the historical correction information, etc. The history of modifications and corrections made to security policies at particular resources allows a system administrator to determine and investigate the resources involved in security breaches and identify reasons behind the security breaches. The extent and patterns of changes made to the security policy at a corresponding resource over time allow the system administrator to generate insights related to security breaches at the corresponding resource.

The policy management engine monitors and detects any unauthorized modifications made to the security policies deployed at the security components of the resources. The policy management engine also autocorrects and adds the correct security policy in case of any modifications made to the security policy at a resource. The policy management engine derives and displays exact modifications made to the security policy, for example, in terms of port and protocol rules added to and deleted from the security policy. For example, the policy management engine derives and displays exact modifications made to the security policy in terms of IP addresses added to and/or deleted from the rules of the security policy. The policy management engine also provides additional information, for example, an exact time of a modification made to each of the rules of the security policy and the exact time of correction. Furthermore, the policy management engine correlates and identifies the extent of damage caused by the modifications made to the security policy by correlating the traffic allowed during the duration for which the security policy implemented on the security component was modified.

Through the generated notification, the policy management engine notifies the system administrator about the security policy being tampered at the resources. The detailed information related to each modification, for example, the port and protocol and IP addresses allowed, in the notification helps the system administrator to identify the intent behind each modification and type of data that may have leaked front the network. The quick autocorrection performed by the policy management engine helps to prevent data leakage. The historical modification information and number of tampering attempts or instances of the modifications contained in the detailed information helps the system administrator to identify the resource that is continuously being attacked and to take actions, for example, quarantining the resource, etc.

FIG. 2exemplarily illustrates a system200for automatically managing security policies at multiple resources, for example,211a,211b, and211c. In an embodiment, the system200disclosed herein is implemented in a cloud computing environment. As used herein, “cloud computing environment” refers to a processing environment comprising configurable computing physical and logical resources, for example, networks, servers, storage media, virtual machines, applications, services, etc., and data distributed over a network221. The cloud computing environment provides an on-demand network access to a shared pool of the configurable computing, physical and logical resources. In another embodiment, the system200disclosed herein is a cloud computing-based platform implemented as a service for automatically managing security policies at multiple resources211a,211b, and211c. In another embodiment, the system200disclosed herein is implemented as an on-premise platform comprising on-premise software installed and run on computers on the premises of an organization such as an enterprise. In an exemplary implementation as shown inFIG. 2, the system200disclosed herein comprises a policy controller207deployed at an administrator device201and a policy agent218deployed at each of multiple resources211a,211b, and211c, for example, endpoint devices, of an organization.

The administrator device201and the resources211a,211b, and211care computer systems that are programmable using high-level computer programming languages. In an embodiment, the administrator device201and the resources211a,211b, and211care implemented using programmed and purposeful hardware. The administrator device201is an electronic device, for example, one or more of a server, a workstation, a personal computer, a tablet computing device, a mobile computer, a smart phone, a portable computing device, a network-enabled computing device, an interactive network-enabled communication device, any other suitable computing equipment, combinations of multiple pieces of computing equipment, etc., operated by a system administrator. In an embodiment, the administrator device201is in operable communication with the resources211a,211b, and,211cvia a network221, for example, a short-range network or a long-range network. The network221is, for example, one of the Internet, an intranet, a wired network a wireless network, a communication network that implements Bluetooth® of Bluetooth Sig, Inc., a network that implements Wi-Fi® of Wi-Fi Alliance Corporation, an ultra-wideband communication network (UWB), a wireless universal serial bus (USB) communication network, a communication network that implements ZigBee® of ZigBee Alliance Corporation, a general packet radio service (GPRS) network, a mobile telecommunication network such as a global system for mobile (GSM) communications network, a code division multiple access (CDMA) network, a third generation (3G) mobile communication network, a fourth generation (4G) mobile communication network, a fifth generation (5G) mobile communication network, a long-term evolution (LTE) mobile communication network, a public telephone network, etc., a local area network, a wide area network, an internet connection network, an infrared communication network, etc., or a network formed from any combination of these networks.

The system200disclosed herein further comprises non-transitory, computer-readable storage media, for example, memory units206and216, for storing computer program instructions defined by the policy controller207on the administrator device201and the policy agent218on each of the resources211a,211b, and211crespectively. As used herein, “non-transitory computer-readable storage media” refers to all computer-readable media, for example, non-volatile media, volatile media, and transmission media, except for a transitory, propagating signal. Non-volatile media comprise, for example, solid state drives, optical discs or magnetic disks, and other persistent memory volatile media including a dynamic random-access memory (DRAM), which typically constitute a main memory. Volatile media comprise, for example, a register memory, a processor cache, a random-access memory (RAM), etc. Transmission media comprise, for example, coaxial cables, copper wire, fiber optic cables, modems, etc., including wires that constitute a system bus coupled to a processor. The system200disclosed herein further comprises processors202and212operably and communicatively coupled to the corresponding memory units206and216respectively, for executing the computer program instructions defined by the policy controller207on the administrator device201and the policy agent218of each of the resources211a,211b, and211crespectively.

The memory units206and216of the administrator device201and the resources2111a,211b, and211crespectively, are used for storing program instructions, applications, and data. The memory units206and216are, for example, random-access memories (RAMs) or other types of dynamic storage devices that store information and instructions for execution by the respective processors202and212. The memory units206and216also store temporary variables and other intermediate information used during execution of the instructions by the respective processors202and212. The administrator device201and the resources211a,211b, and211cfurther comprise read only memories (ROMs) or other types of static storage devices that store static information and instructions for the respective processors202and212. In an embodiment, the policy controller207is stored in the memory unit206of the administrator device201. Similarly, the policy agent218is stored in the memory unit216of each of the resources211a,211b, and211c.

The system200disclosed herein further comprises storage devices, for example, policy data stores209and219or databases stored in the memory unit206of the administrator device201and the memory unit216of each of the resources211a,211b, and211crespectively. The policy data stores209and219of the administrator device201and the resources211a,211b, and211crefer to any storage area or medium that can be used for storing data and files. The policy data stores209and219can be, for example, any of a structured query language (SQL) data store or a not only SQL (NoSQL) data store such as the Microsoft® SQL Server®, the Oracle® servers, the MySQL® database of MySQL AB Limited Company, the mongoDB® of MongoDB, Inc., the Neo4j graph database of Neo Technology Corporation, the Cassandra database of the Apache Software Foundation, the HBase® database of the Apache Software Foundation, etc. In an embodiment, the policy data stores209and219can also be locations on file systems of the administrator device201and the resources211a,211b, and211c. In another embodiment, the policy data stores209and219can be remotely accessed by the administrator device201and the resources211a,211b, and211cvia the network221. In another embodiment, the policy data store209is, for example, a database server, that stores the security policies and is remotely accessible by the administrator device201. In another embodiment, the policy data stores209and219are configured as cloud-based databases implemented in a cloud computing environment, where computing resources are delivered as a service over the network221.

The processor202of the administrator device201is configured to execute the computer program instructions defined by the policy controller207for automatically managing security policies at multiple resources211a,211b, and211c. The processor212of each of the resources211a,211b, and211cis configured to execute the computer program instructions defined by the policy agent218for automatically managing security policies at multiple resources211a,211b, and211c. The processors202and212refer to any one or more microprocessors, central processing unit (CPU) devices, finite state machines, computers, microcontrollers, digital signal processors, logic, logic devices, user circuits, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), chips, etc., or any combination thereof, capable of executing computer programs or a series of commands, instructions, or state transitions. In an embodiment, the processors202and212are implemented as processor sets comprising, for example, a programmed microprocessor and a math or, graphics co-processor. The administrator device201and the resources211a,211b, and211care not limited to employing their respective processors202and212. In an embodiment, the administrator device201and the resources211a,211b, and211cemploy controllers or microcontrollers. The processor202of the administrator device201executes the modules, for example,208aand208b, of the policy controller207. The processor212of each of the resources211a,211b, and211cexecutes the modules, for example,208c,208d,208e, and208f, of each of the resources211a,211b, and211c.

As exemplarily illustrated inFIG. 2, the administrator device201further comprises a data bus210, a display unit203, a network interface204, and common modules205. Similarly, as exemplarily illustrated inFIG. 2, each of the resources211a,211b, and211cfurther comprises a data bus220, a display unit213, a network interface214, and common modules215. The data bus210of the administrator device201pert its communications between the modules, for example,202,203,204,205,206, etc., of the administrator device201. The data bus220of each of the resources211a,211b, and211cpermits communications between the modules, for example,212,213,214,215,216, etc., of each of the resources211a,211b, and211c. The display unit203of the administrator device201, via a graphical user interface (GUI)203a, displays information, display interfaces, user interface elements such as checkboxes input text fields, etc., for example, for allowing a system administrator to configure security policies for the resources211a,211b, and211c, review notifications comprising the detailed information of the modifications and the autocorrection of the security policies rendered by the resources211a,211b, and211c, analyze and manage the security policies, etc. The administrator device201renders the GUI203aon the display unit203for receiving the system administrator's configuration inputs and parameters, etc., for automatically managing security policies of the resources211a,211b, and211c. In an embodiment, the display unit203is externally coupled to the administrator device201. The display unit213of each of the resources211a,211b, and211c, via a GUI213a, displays information, display interfaces, user interface elements such as checkboxes, input text fields, etc., for example, for allowing a user such as an administrator of each of the resources211a,211b, and211cto configure and deploy the security policies at the resources211a,211b, and211c. Each of the resources211a,211b, and211crenders the GUI213aon the display unit213for displaying information related to the security policy. In an embodiment, the display unit213is externally coupled to each of the resources211a,211b, and211c. The GUIs203aand213aof the administrator device201and each of the resources211a,211b, and211crespectively, comprise, for example, online web interfaces, web-based downloadable application interfaces, mobile-based downloadable application interfaces, etc. The display units203and213of the administrator device201and each of the resources211a,211b, and211crespectively, display the GUIs203aanti213arespectively.

The network interfaces204and214of the administrator device201and each of the resources211a,211b, and211crespectively, enable connection of the administrator device201and each of the resources211a,211b, and211crespectively, to the network221. In an embodiment, the network interfaces204and214are provided as interface cards also referred to as line cards. The network interfaces204and214are, for example, one or more of infrared interfaces, interfaces implementing of Wi-Fi® Alliance Corporation, universal serial bus interfaces, FireWire interfaces of Apple Inc., Ethernet interfaces, frame relay interfaces, cable interfaces, digital subscriber line interfaces, token ring interfaces, peripheral controller interconnect interfaces, local area network interfaces, wide area network interfaces, interfaces using serial protocols, interfaces using parallel protocols, Ethernet communication interfaces, asynchronous transfer mode interfaces, high speed serial interfaces, fiber distributed data interfaces, interfaces based on transmission control protocol (TCP)/interact protocol (IP), interfaces based on wireless communications technology such as satellite technology, radio frequency technology, near field communication, etc. The common modules205and215of the administrator device201and each of the resources211a,211b, and211crespectively comprise, for example, input/output (I/O) controllers, input devices such as alphanumeric keyboards, microphones, touchpads, pointing devices, etc., output devices, fixed media drives such as hard drives, removable media drives for receiving removable media, etc. Computer applications and programs are used for operating the administrator device201and the resources211a,211b, and211c. The programs are loaded onto fixed media drives and into the memory units206and216of the administrator device201and each of the resources211a,211b, and211crespectively, via their respective removable media drives. In an embodiment, the computer applications and the programs are loaded into the memory units206and216of the administrator device201and each of the resources211a,211b, and211crespectively, directly via the network221.

In an embodiment, the policy controller207is configured as a central module on which a user, for example, a system administrator, configures security policies that allow access between different grouped sets of resources. The policy controller207computes security policies specific to each resource, for example,211a,211b, and211c, stores the security policies in the policy data store209, and pushes the security policies to the resources211a,211b, and211cfor application of the security policies at the respective resources211a,211b, and211c. Each individual resource, for example,211a,211b, or211c, comprises its own policy agent218in a one-to-one correspondence, where one policy agent218corresponds to one resource. In an embodiment, the policy agent218deployed at each of the resources211a,211b, and211cis configured as a thin client application that runs on each of the corresponding resources211a,211b, and211c. The policy agent218is configured to establish remote connections in a server-based computing environment. In the system200disclosed herein, the policy agent218communicates with the policy controller207to download rules of the security policy for the respective resource211a,211b, or211c. The policy agent218stores the downloaded rules of the security policy in the policy data store219. The policy agent218at each of the resources211a,211b, and211cconverts the rules of the security policy received from the policy controller207, for example, into operating system (OS) specific commands and/or application programming interface (API) messages, and applies the converted rules of the security policy on a respective resource211a,211b, or211c. The policy agent218also detects when the security policy is tampered with, autocorrects modifications made to the security policy, and sends the tampered security policy to the policy controller207for further analysis.

The system200disclosed herein further comprises the policy management engine208for automatically managing security policies at multiple resources, for example,211a,211b, and211cby detecting, identifying, automatically correcting, and notifying modifications made to the security policies at the resources211a,211band211c. The memory units206and216are configured to store computer program instructions defined by the policy management engine208. The processors202and212are configured to execute the computer program instructions defined by the policy management engine208. In an exemplary implementation of the system200disclosed herein, the policy management engine208comprises multiple modules implemented at the policy controller207and the policy agent218. The modules of the policy management engine208comprise, for example, a policy configuration module208a, an information analysis module208b, a policy deployment module208c, a modification determination module208d, an autocorrection module208e, and an information generation and notification module208f. In an exemplary implementation as shown inFIG. 2, the policy configuration module208aand the information analysis module208bof the policy management engine208are implemented at the policy controller207, while the policy deployment module208c, the modification determination module208d, the autocorrection module208e, and the information generation and notification module208fof the policy management engine208are implemented at the policy agent218of each of the resources211a,211b, and211c. In an embodiment, the policy controller207is implemented as a processor configured to execute computer program instructions defined by modules, for example,208aand208b, of the policy management engine208. In various embodiments, different configurations, arrangements, and positions of the modules208a,208b,208c,208d,208e,208f, etc., of the policy management engine208are configured at and/or between the policy controller207and each policy agent218for automatically managing security policies in accordance with the method disclosed in the detailed description ofFIG. 1. In the system200disclosed herein, the policy management engine208interfaces with the policy controller207, and a security component217and the policy agent218on each of the resources211a,211b, and211c, and therefore more than one specifically programmed computer system is used for automatically managing security policies at multiple resources211a,211b, and211cby detecting, identifying, automatically correcting, and notifying modifications made to the security policies at the resources211a,211b, and211c.

The policy configuration module208aat the policy controller207configures a security policy for each of the resources211a,211b, and211c, for example, to allow access from one set of resources to another set of resources on certain ports and protocols based on configuration parameters, for example, type of each rule of the security policy, a source IP address, a destination IP address, a destination port, a traffic protocol, etc., and inputs received from a system administrator using the GUI203aon the administrator device201. The policy deployment module208cat the policy agent218of each of the resources211a,211b, and211creceives and deploys the security policy configured for each of the resources211a,211b, and211cwith one or more of the configuration parameters on the security component217, for example, a host-based firewall, of each of the resources211a,211b, and211c. The security component217is implemented as a hardware component, or a software component, or a combination of a hardware component and a software component on each of the resources211a,211b, and211c. In an embodiment, the policy deployment module208ctransforms the security policy into a format, for example, OS specific commands and/or API messages, applicable to each of the resources211a,211b, and211cand configures the transformed security policy on the security component217of each of the resources211a,211b, and211cfor the deployment of the security policy on the security component217of each of the resources211a,211b, and211c. In an embodiment, the policy deployment module208ccreates and stores a policy digest comprising the security policy and the configuration parameters in the policy data store219at each of the resources211a,211b, and211c.

The modification determination module208dmonitors the security component217and determines modifications made to the security policy at a corresponding resource, for example,211c. On determining the modifications made to the security policy, the autocorrection module208e, in communication with the modification determination module208dand the policy data store219, automatically corrects the security policy at the corresponding resource211c. The modification determination module208drecomputes the security policy at the security component217of the corresponding resource211cand compares the recomputed security policy with the deployed security policy for the determination of the modifications made to the security policy at the corresponding resource211c. The information generation and notification module208fgenerates and renders a notification comprising the security policy, the modifications, and detailed information of the modifications and the automatic correction of the security policy as disclosed in the detailed description ofFIG. 1, to the administrator device201for analysis and management of the security policy. The information analysis module208bat the policy controller207receives the security policy, the modifications, and the detailed information of the modifications and the automatic correction of the security policy from the policy agent218at the corresponding resource211cand determines an extent and patterns of changes incurred due to the modifications made to the security policy at the corresponding resource211cusing one or more items of the detailed information.

In an embodiment, on determining the modifications made to the security policy, the information generation and notification module208fat the policy agent218generates and renders a notification comprising the security policy, the modifications, a timestamp of each of the modifications, and information of the automatic correction of the security policy to the administrator device201for analysis and management of the security policy. In this embodiment, the information analysis module208bat the policy controller207performs a detailed analysis of the received security policy, the modifications, and the autocorrections from the notification and generates the detailed information of the modifications comprising, for example, an identification of the corresponding resource211c, a description of the modifications made to the security policy at the corresponding resource211c, a type of each of the modifications, locations of the modifications, a number of instances of each of the modifications, volume and type of traffic flow incurred due to the modifications, historical modification information associated with each of the resources211a,211b, and211c, corrections required in the security policy, historical correction information associated with each of the resources211a,211b, and211c, event information that triggered the modifications, etc., by comparing the received security policy with the originally configured security policy stored in the policy data store209. The information analysis module208bthen generates an additional notification comprising the detailed information generated at the policy controller207and renders the additional notification on the administrator device201via the GUI203a. In various embodiments, the system200disclosed herein allows the generation of the detailed information of the modifications and the automatic correction of the security policy, and the detailed analysis of the security policy, the modifications, and the automatic corrections to be performed partially by the policy controller207at the administrator device201and partially by the policy agent218at each of the resources211a,211b, and211c.

The policy configuration module208aand the information analysis module208bof the policy management engine208implemented at the policy controller207are disclosed above as software implemented on the processor202of the administrator device201. Similarly, the policy deployment module208c, the modification determination module208d, the autocorrection module208e, and the information generation and notification module208fof the policy management engine208implemented at the policy agent218are disclosed above as software implemented on the processor212of each of the resources211a,211b, and211c. In an embodiment, the modules, for example,208aand208bof the policy controller207, and the modules, for example,208c,208d,208e, and208f, of the policy agent218are implemented completely in hardware. In another embodiment, the modules, for example,208aand208b, of the policy controller207, and the modules, for example,208e,208d,208e, and208f, of the policy agent218are implemented by logic circuits to carry out their respective functions disclosed above. In another embodiment, the system200disclosed herein is also implemented as a combination of hardware and software including the policy controller207, the policy agent218, and processors, for example,202and212, that are used to implement the modules, for example,208aand208bof the policy controller207at the administrator device201, and the modules, for example,208c,208d,208e, and2081of the policy agent218at each of the resources211a,211b, and211c.

The processor202of the administrator device201retrieves instructions defined by the policy configuration module208aand the information analysis module208bof the policy management engine208at the policy controller207for performing respective functions disclosed above. The processor212of each of the resources211a,211b, and211cretrieves instructions defined by the policy deployment module208c, the modification determination module208d, the autocorrection module208e, and the information generation and notification module208fof the policy management engine208at the policy agent218at each of the resources211a,211b, and211cfor performing respective functions disclosed above. The processor202of the administrator device201retrieves instructions for executing the modules, for example,208aand208bof the policy controller207from the memory unit206of the administrator device201. The processor212of each of the resources211a,211b, and211cretrieves instructions for executing the modules, for example,208c,208d,208e, and208f, of the policy agent218from the memory unit216of each of the resources211a,211b, and211c. A program counter determines the location of the instructions in the respective memory units206and216. The program counter stares a number that identifies the current position in the program of each of the modules, for example,208aand208b, of the policy controller207, and the modules, for example,208c,208d,208e, and208f, of the policy agent218. The instructions fetched by the processors202and212of the administrator device201and each of the resources211a,211b, and211crespectively, from the respective memory units206and216after being processed are decoded. The instructions are stored in an instruction register in the respective processors202and212. After processing and decoding, the processors202and212execute their respective instructions, thereby performing one or more processes defined by those instructions.

At the time of execution, the instructions stored in the instruction register are examined to determine the operations to be performed. The processors202and212then perform be specified operations. The operations comprise arithmetic operations and logic operations. Operating systems perform multiple routines for performing a number of tasks required to assign the input devices, the output devices, and the respective memory units206and216for execution of the modules, for example,208aand208b, of the policy controller207, and the modules, for example,208c,208d,208e, and208f, of the policy agent218respectively. The tasks performed by the operating systems comprise, for example, assigning memory to the modules, for example,208aand208b, of the policy controller207and the modules, for example,208c,208d,208e, and208f, of the policy agent218and to data used by the administrator device201and the resources211a,211b, and211c, moving data between the respective memory units206and216and disk units, and handling input/output operations. The operating systems perform the tasks on request by the operations and after performing the tasks, the operating systems transfer the execution control back to the respective processors202and212. The processors202and212continue the execution to obtain one or more outputs.

For purposes of illustration, the detailed description refers to the modules, for example,208aand208b, of the policy controller207, and the modules, for example,208c,208d,208e, and208f, of the policy agent218being run locally on single computer systems; however the scope of the method and the system200disclosed herein is not limited to the modules, for example,208aand208b, of the policy controller207, and the modules, for example,208e,208d,208e, and208f, of the policy agent218being run locally on single computer systems via the operating systems and the respective processors202and212, but may be extended to run remotely over the network221by employing a web browser and a remote, server, a mobile phone, or other electronic devices. In an embodiment, one or more portions of the system200are distributed across one or more computer systems (not shown) coupled to the network221.

The non-transitory computer-readable storage media disclosed herein store computer program instructions executable by the processors202and212for automatically managing security policies at multiple resources211a,211b, and211cby detecting, identifying, automatically correcting, and notifying modifications made to the security policies at the resources211a,211b, and211c. The computer program instructions implement the processes of various embodiments disclosed above and perform additional steps that may be required and contemplated fir automatically managing security policies at multiple resources211b, and211cby detecting, identifying, automatically correcting, and notifying modifications made to the security policies at the resources211a,211b, and211c. When the computer program instructions are executed by the processors202and212, the computer program instructions cause the processors202and212to perform the steps of the method for automatically managing security policies at multiple resources211a,211b, and211cby detecting, identifying, automatically correcting, and notifying modifications made to the security policies at the resources211a,211b, and211cas disclosed in the detailed description ofFIGS. 1-2. In an embodiment, a single piece of computer program code comprising computer program instructions performs one or more steps of the method disclosed in the detailed description ofFIG. 1. The processors202and212of the administrator device201and each of the resources211a,211b, and211crespectively, retrieve these computer program instructions and execute them.

A module, or an engine, or a unit, as used herein, refers to any combination of hardware, software, and/or firmware. As an example, a module, or an engine, or a unit may include hardware, such as a microcontroller, associated with a non-transitory, computer-readable storage medium to store computer program codes adapted to be executed by the microcontroller. Therefore, references to a module, or an engine, or a unit, in an embodiment, refer to the hardware that is specifically configured to recognize and/or execute the computer program codes to be stored on a non-transitory, computer-readable storage medium. Furthermore, in another embodiment, use of a module, or an engine, or a unit refers to the non-transitory, computer-readable storage medium including the computer program codes, that is specifically adapted to be executed by the microcontroller to perform predetermined operations. In another embodiment, the term “module” or “engine” or “unit” refers to the combination of the microcontroller and the non-transitory, computer-readable storage medium. Often module or engine boundaries that are illustrated as separate commonly vary and potentially overlap. For example, a module or an engine or a unit may share hardware, software, firmware, or a combination thereof, while potentially retaining some independent hardware, software, or firmware. In various embodiments, a module or an engine or a unit includes any suitable logic.

FIG. 3exemplarily illustrates a schematic diagram showing automatic management of security policies at multiple resources, for example,211a,211b, and211c. Consider an example where the policy management engine208of the system200shown inFIG. 2, is implemented at the policy controller207on an administrator device201and at the policy agents218deployed on three resources211a,211b, and211cshown inFIG. 3. A user, for example, a system administrator who operates the administrator device201enters configuration parameters on the graphical user interface (GUI)203adisplayed on the administrator device201shown inFIG. 2, for configuring security policies for the three resources211a,211b, and211cto allow access from one set of resources to another set of resources on certain ports and protocols. For example, the system administrator configures a security policy comprising rules that allow a set of systems having interact protocol (IP) addresses in a subnet range of 10.102.20.0/24 in Group-1 to access a set of servers tagged as “WEB” in Group-2 over a port “443” and a protocol “TCP”. This security policy allows traffic to flow from resources belonging to Group-1 to resources belonging to Group-2 over port443and a transmission control protocol (TCP). The system administrator may configure many such rules in the security policy for each resource.

The policy controller207receives the configurations of the security policies with the configuration parameters entered by the system administrator via the GUI203aand converts the security policies into resource specific security policies, that is, security policies corresponding to the resources211a,211b, and211c. In this example, the policy controller207converts the security policies specified by the system administrator into resource specific policies as follows. The policy controller207identifies the resources matching the parameter defined in Group-1, that is, subnet range of 10.102.20.0/24, by querying the policy data store209shown inFIG. 2, that stores resource information. The policy controller207identifies the resources matching the parameter defined in Group-2, that is, resources tagged as “WEB”, by querying the policy data store209that stores the resource information. The policy controller207then computes the security policy for allowing each resource in Group-1 to send outbound traffic to the resources in Group-2. Similarly, the policy controller207computes the security policy for each resource in Group-2 to receive inbound traffic from the resources in Group-1. In an example where host-based firewalls are deployed as security components217shown inFIG. 2, on the resources211a,211b, and211c, the policy controller207computes host-based firewall policies based on IP addresses, and hence utilizes IP address information from each of the resources211a,211b, and211cfor the computation.

The policy controller207computes the resource specific policies with the configuration parameters comprising, for example, a type of rule such as add or delete, source IP, destination IP, destination port, and traffic protocol for each of the resources211a,211b, and211c. The type of rule indicates whether a rule must be added or deleted in a resource specific policy. The source IP indicates a list of source IP addresses from where traffic is allowed when the traffic is inbound. The destination IP indicates a list of destination IP addresses to where traffic is allowed when the traffic is outbound. The destination port indicates a port on which inbound traffic and outbound traffic are allowed, for example, 443, 80, 53, etc. The traffic protocol indicates a protocol through which inbound traffic and outbound traffic are allowed. The policy controller207sends the computed resource specific policies with the configuration parameters to the policy agent218on each of the resources211a,211b, and211c. In an embodiment, the policy agent218on each of the resources211a,211b, and211ccommunicates with the policy controller207at periodic time intervals and requests for the security policy specific to the respective resource211a,211b, and211c. In this embodiment, the policy controller207sends the security policy configured for each of the resources211a,211b, and211cto the policy agent218on the respective resources211a,211b, and211c, when the policy agent218requests for the security policy.

The policy agent218running on each, of the resources211a,211b, and211creceives the respective security policy specific to the respective resource211a,211b, and211cfrom the policy controller207. In this example, the policy agents218on the resources211a,211b, and211cconvert the security policies received from the policy controller207into a format that can be used to configure host-based firewalls. A host-based firewall typically expects “port”, “protocol”, “direction of traffic”, “source-ip” and “destination-ip” to configure a rule in a host-based firewall policy to be deployed on the host-based firewall. After converting the security policies to a host-based firewall acceptable format, the policy agent218of each resource211a,211b, and211ccreates a digest of all the rules applicable for the corresponding resource211a,211b, or211cand stores the digest in the policy data store219shown inFIG. 2. The policy agent218then applies the rules of the host-based firewall policy on the host-based firewall by calling either an appropriate operating system (OS) specific application programming interface (API) or a command depending on the operating system on which the host-based firewall policy is being applied.

The policy agent218monitors the host-based firewall periodically, for example, every 15 seconds, to determine modifications made to the rules of the host-based firewall policy. In an embodiment, the policy agent218determines the modifications by calculating a digest of all the rules in the host-based firewall policy and comparing the digest with the previously stored digest in the policy data store219. In another embodiment, the policy agent218determines the modifications by comparing a hash of the original host-based firewall policy previously stored in the policy data store219and a hash of the modified host-based firewall policy. In this embodiment, the policy agent218generates a hash of the original host-based firewall policy and a hash of the modified host-based firewall policy by executing a hash function. The hash function maps data of the host-based firewall policies of an arbitrary size onto data of a fixed size. If there is a mismatch, then the policy agent218detects an unauthorized modification made to one or more rules of the host-based firewall policy. In another embodiment, the operating system of each resource211a,211b, and211cis configured to notify modifications made to the rules of the host-based firewall policy. Once the policy agent218detects that the rules of the host-based firewall policy have been modified, the policy anent218collects all the rules in the host-based firewall policy including the modified rules and sends the modified host-based firewall policy to the policy controller207at the administrator device201, specifying a timestamp at which each of the modifications were detected. The policy agent218also reapplies the correct, set of rules of the originally deployed host-based firewall policy on the host-based firewall immediately to automatically restore or correct the host-based firewall policy and sends the timestamp of the autocorrection to the policy controller207. In an embodiment, for automatically correcting the host-based firewall policy after the modifications are detected, the policy agent218uses the correct set of rules of the host-based firewall policy locally stored in the policy data store219. In another embodiment, the policy agent218contacts the policy controller207for retrieving the correct set of rules of the host-based firewall policy configured for that particular resource, for example,211a,211b, or211c, to automatically correct the host-based firewall policy after the modifications are detected. In this embodiment, the policy controller207retrieves the correct set of rules of the host-based firewall policy configured for that particular resource, for example,211a,211b, or211c, from the policy data store209and transmits the correct set of rules to the policy agent218deployed on that particular resource, for example,211a,211b, or211c.

The policy controller207receives the modified host-based firewall policy from the policy agent218and parses the modified host-based firewall policy to identify the modifications that were performed in the rules of the modified host-based firewall policy. The modified host-based firewall policies are typically of a format supported by different operating systems (OSs). The policy controller207parses and converts the modified host-based firewall policy into a common format, that is, the format in which the policy controller207originally computed the host-based firewall policy. In an embodiment, the policy controller207parses and converts the modified host-based firewall policy into a common format based on the operating system of the resource from where the modified host-based firewall policy is received. In an embodiment, the policy controller207compares the modified host-based firewall policy and the original host-based firewall policy to determine the type of modifications made to the host-based firewall policy. The modifications comprise, for example, addition of a new port and protocol that were not configured by the system administrator to allow malicious traffic to a set of IP addresses; addition of a new set of IP addresses to an existing port and protocol that were allowed by the system administrator, to allow traffic to unauthorized or external IP addresses; removal of a set of IP addresses from an existing port and protocol that were allowed by the system administrator, to cause denial of service; removal of a port and a protocol that were configured by the system administrator, to cause denial of service, etc. The policy controller207identifies the rules of the modified host-based firewall policy that were added, deleted, and modified.

The policy controller207identifies the exact type of modifications made to the host-based firewall policy and generates a notification comprising detailed information on, for example, the resource on which modification has occurred, the time of the modification, the exact type of modification as disclosed above, the time of the automatic correction, traffic flow between the time of the modification and the time of the automatic correction to indicate the nature of compromise, that is, between the time of the modification and the time of the automatic correction, indicating the type of data leak or denial of service that has occurred, history of such modifications and corrections for a particular resource etc. The policy controller207renders the notification on the administrator device201via the GUI203ato allow the system administrator to review, analyze, and manage the host-based firewall policy. The history of the modifications and the corrections in the notification allows the system administrator to identify a pattern of changes to determine the change being performed by a malicious software or a manual hacker within an organization. Through the notification, the policy controller207notifies the system administrator about tampering of the host-based firewall policy with detailed information of the tampering, the resource where the host-based firewall policy was tampered, and a time of occurrence of the tampering.

Consider another example where the policy management engine208of the system200shown inFIG. 2, is implemented at the policy controller207on the administrator device201and at the policy agents218deployed on three resources211a,211b, and211cas shown inFIG. 3. A user, for example, a system administrator who operates the administrator device201enters configuration parameters on the GUI203adisplayed on the administrator device201for configuring security policies for the three resources211a,211b, and211c. For example, the system administrator configures a security policy1301comprising an inbound rule “TCP-80: 10.0.0.1” and an outbound rule “TCP-443: 20.0.0.1” for resource1211a; a security policy2302comprising an inbound rule “TCP-443: 10.0.0.2” and an outbound rule “TCP-443: 20.0.0.1” for resource2211b; and a security policy3303comprising an inbound rule “TCP-88: 10.0.0.3” and an outbound rule “TCP-443: 20.0.0.1” for resource3211c.

The policy controller207receives the configurations of the security policies301,302, and303with the configuration parameters entered by the system administrator via the GUI203aand converts the security policies301,302, and303into resource specific security policies301,302, and303, that is, security policies301,302, and303corresponding to the resources211a,211b, and211crespectively. The policy controller207sends the computed resource specific policies301,302, and303with the configuration parameters to the policy agents218on the resources211a,211b, and211crespectively. The policy agents218running on the resources211a,211b, and211creceive the security policies301,302, and303specific to the resources211a,211b, and211crespectively. In this example, the policy agents218on the resources211a,211b, and211cconvert the security policies301,302, and303received from the policy controller207respectively, into a format that can be used to configure the security components217deployed on the resources211a,211b, and211crespectively. After converting the security policies301,302, and303into a security component acceptable format, the policy agents218of the resources211a,211b, and211crespectively, create digests of the rules applicable for the respective resources211a,211b, and211cand store the digests in the respective policy data stores219shown inFIG. 2.

The policy agents218then apply the rules of the security policies301,302, and303on the respective security components of the resources211a,211b, and211crespectively, by calling either an appropriate OS specific API or a command depending on the operating system on which each of the security policies301,302, and303are being applied. For example, the policy agent218at resource1211aapplies the security policy1301comprising the inbound rule “TCP-80: 10.0.0.1” and the outbound rule “TCP-443: 20.0.0.1” on the security component deployed on resource1211aby calling either an appropriate OS specific API or a command depending on the operating system of resource1211a. Similarly, the policy agent218at resource2211bapplies the security policy2302comprising the inbound rule “TCP-443: 10.0.0.2” and the outbound rule “TCP-443: 20.0.0.1” on the security component deployed on resource2211bby calling either an appropriate OS specific API or a command depending on the operating system of resource2211b. Similarly, the policy agent218at resource3211capplies the security policy3303comprising the inbound rule “TCP-88: 10.0.0.3” and an outbound rule “TCP-443: 20.0.0.1” on the security component deployed on resource3211cby calling either an appropriate OS specific API or a command depending on the operating system of resource3211c.

The policy agents218on the resources211a,211b, and211cmonitor their respective security components periodically, for example, every 15 seconds, to determine modifications made to the rules of the security policies301,302, and303respectively. Consider an example where an employee who operates resource3211cmodifies the inbound rule “TCP-88: 10.0.0.3” of the security policy3303deployed on the security component of resource3211cto “TCP-88: 20.0.0.3” to allow traffic from the IP address “20.0.0.3” into resource3211c. The policy agent218deployed at resource3211cdetermines the modification made to the security policy3303by calculating a digest of the rules in the security policy3303and comparing the digest with the previously stored digest in the policy data store219. Since there is a mismatch of the inbound rule in the security policy3303, the policy agent218detects an unauthorized modification made to the inbound rule of the security policy3303. On detecting the unauthorized modification, the policy agent218collects the rules in the security policy3303including the modified inbound rule and sends the modified security policy to the policy controller207at the administrator device201, specifying a timestamp at which the unauthorized modification to the inbound rule of the security policy3303was detected. The policy agent218also reapplies the correct set of rules of the originally deployed security policy3303on the security component of resource3211cto automatically correct the inbound rule of the security policy3303back to “TCP-88: 10.0.0.3” and sends the timestamp of the autocorrection to the policy controller207.

The policy controller207at the administrator device201receives the modified security policy from the policy agent218and parses the modified security policy to identify the modifications that were performed in the rules of the modified security policy. The policy controller207parses and converts the modified security policy into a common format, that is, the format in which the policy controller207originally computed the security policy3303. The policy controller207compares the modified security policy and the or security policy3303to determine the type of modifications made to the security policy3303. In this example, the modification comprises addition of a new set of IP addresses to an existing port and protocol that were allowed by the system administrator, to allow traffic to unauthorized or external IP addresses. The policy controller207identifies the exact type of modification made to the security policy3303and generates a notification304comprising detailed information on, for example, the resource on which the modification occurred, the time of the modification, the type of modification as disclosed above, the time of the automatic correction, traffic flow between the time of the modification and the time of the automatic correction to indicate the nature of compromise, that is, between the time of the modification and the time of the automatic correction, indicating the type of data leak or denial of service that occurred, history of such modifications and corrections for a particular resource, etc.

The policy controller207renders the notification304on the administrator device201via the GUI203aas exemplarily illustrated inFIG. 3, to allow the system administrator review, analyze, and manage the security policy3303configured for resource3211c. In an embodiment, the policy agent218at resource3211ccompares the modified security policy and the original security policy3303to determine the type of modifications made to the security policy3303. The policy agent218identifies the exact type of modifications made to the security policy3303and generates a notification304comprising detailed information on the modifications. The policy agent218renders the generated notification304to the policy controller207. The policy controller207displays the notification304on the GUI203aof the administrator device201to allow the system administrator to review, analyze, and manage the security policy3303configured for resource3211c. The method and the system200disclosed herein allows the system administrator to secure any breach in a resource of the organization and determine the modifications made to the security policies by hackers.

The method and the system200disclosed herein implement one or more, specific computer programs for automatically managing security policies of multiple resources, for example,211a,211b, and211c. The method and the system200disclosed herein improve the functionality of a computer and provide an improvement in network security, microsegmentation and firewall technology related to automatically managing security policies of multiple resources as follows: On implementing the method disclosed herein, the policy management engine208shown inFIG. 2, receives and deploys a security policy configured for each of the resources with one or more of multiple configuration parameters on a security component217shown inFIG. 2, of each of the resources. Moreover, the policy management engine208monitors the security component217and determines modifications made to the security policy at a corresponding resource. Then, the policy management engine208, through the use of separate and autonomous computer programs, automatically corrects the security policy at the corresponding resource and generates and renders a notification comprising the security policy, the modifications, and detailed information of the modifications and the automatic correction of the security policy to the administrator device201for analysis and management of the security policy. Furthermore, the policy management engine208determines an extent and patterns of changes incurred due to the modifications at each of the resources using one or more items of the detailed information.

The focus of the method and the system200disclosed herein is on an improvement to network security, microsegmentation and firewall technology and computer functionalities for automatically managing security policies at multiple resources by detecting, identifying, automatically correcting, and notifying modifications made to the security policies at the resources, and not on tasks for which a generic computer is used in its ordinary capacity. Rather, the method and the system200disclosed herein are directed to a specific improvement to the way processors in the system200operate, embodied in, for example, receiving and deploying a security policy configured for each of the resources with one or more of multiple configuration parameters on a security component217of each of the resources; monitoring the security component217and determining modifications made to the security policy at a corresponding resource; on determining the modifications made to the security policy, automatically correcting the security policy at the corresponding resource; and generating and rendering a notification comprising the security policy, the modifications, and detailed information of the modifications and the automatic correction of the security policy to the administrator device201for analysis and management of the security policy.

In the method disclosed herein, the design and the flow of data and interactions between the policy controller207and the policy agents218deployed on the corresponding resources are deliberate, designed, and directed. The interactions between the policy controller207and the policy agents218allow the system200to automatically manage security policies at multiple resources by detecting, identifying, automatically correcting, and notifying modifications made to the security policies at the resources. The steps performed by the policy management engine208implemented at the policy controller207and the policy agents218disclosed above require six or more separate computer programs and subprograms, the execution of which cannot be performed by a person using a generic computer with a generic program. The steps performed by the system200disclosed above are tangible, provide useful results, and are not abstract. The hardware and software implementation of the system200disclosed herein comprising the policy management engine208implemented at the policy controller207and the policy agents218, and one or more processors, is an improvement in network security, microsegmentation and firewall technology.

It is apparent in different embodiments that the various methods, algorithms, and computer readable programs disclosed herein are implemented on non-transitory, computer readable storage media appropriately programmed for computing devices. The non-transitory, computer readable storage media participate in providing data, for example, instructions that are read by a computer, a processor or a similar device. In different embodiments, the “non-transitory, computer readable storage media” also refer to a single medium or multiple media, for example, a centralized database, a distributed database, and/or associated caches and servers that store one or more sets of instructions that are read by a computer, a processor or a similar device. The “non-transitory, computer readable storage media” also refer to any medium capable of storing or encoding a set of instructions for execution by a computer, a processor or a similar device and that causes a computer, a processor or a similar device to perform any one or more of the methods disclosed herein. Common forms of the non-transitory, computer readable storage media comprise, for example, a floppy disk, a flexible disk, a hard disk, magnetic tape, a laser disc, a Blu-ray Disc® of the Blu-ray Disc Association, any magnetic medium, a compact disc-read-only memory (CD-ROM), a digital versatile disc (DVD), any optical medium, a flash memory card, punch cards, paper tape, any other physical medium with patterns of holes, a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, any other memory chip or cartridge, or any other medium from which a computer can read.

In an embodiment, the computer programs that implement the methods and algorithms disclosed, herein are stored and transmitted using a variety of media, for example, the computer readable media in various manners. In an embodiment, hard-wired circuitry or custom hardware is used in place of, or in combination with, software instructions for implementing the processes of various embodiments. Therefore, the embodiments are not limited to any specific combination of hardware and software. The computer program codes comprising computer executable instructions can be implemented in any programming language. Examples of programming languages that can be used comprise C, C++, C#, Java®, JavaScript®, Fortran, Ruby, Perl®, Python®, Visual Basic®, hypertext preprocessor (PRP), Microsoft®, .NET, Objective-C®, etc. Other object-oriented, functional, scripting, and/or logical programming languages can also be used. In an embodiment, the computer program codes or software programs are stored on or in one or more mediums as object code. In another embodiment, various aspects of the method and the system200disclosed herein are implemented in a non-programmed environment comprising, documents created, for example, in a hypertext markup language (HTML), an extensible markup language (XML), or other format that render aspects of a GUI or perform other functions, when viewed in a visual area or a window of a browser program. In another embodiment, various aspects of the method and the system200disclosed herein are implemented as programmed elements, or non-programmed elements, or any suitable combination thereof.

Where databases are described such as the policy data stores209and219shown inFIG. 2, it will be understood by one of ordinary skill in the art that (i) alternative database structures to those described may be employed, and (ii) other memory structures besides databases may be employed. Any illustrations or descriptions of any sample databases disclosed herein are illustrative arrangements for stored representations of information. In an embodiment, any number of other arrangements are employed besides those suggested by tables illustrated in the drawings or elsewhere. Similarly, any illustrated entries of the databases represent exemplary information only; one of ordinary skill in the art will understand that the number and content of the entries can be different from those disclosed herein. In another embodiment, despite any depiction of the databases as tables, other formats including relational databases, object-based models, and/or distributed databases are used to store and manipulate the data types disclosed herein. Object methods or behaviors of a database can be used to implement various processes such as those disclosed herein. In another embodiment, the databases are, in a known manner, stored locally or remotely from a device that accesses data in such a database. In embodiments where there are multiple databases in the system200, the databases are integrated to communicate with each other for enabling simultaneous updates of data linked across the databases, when there are any updates to the data in one of the databases.

The method and the system200disclosed herein can be configured to work in a network environment comprising one or more computers that are in communication with one or more devices via a network. In an embodiment, the computers communicate with the devices directly or indirectly, via a wired medium or a wireless medium such as the Internet, a local area network (LAN), a wide area network (WAN) or the Ethernet, a token ring, or via any appropriate communications mediums or combination of communications mediums. Each of the devices comprises processors, examples of which are disclosed above, that are adapted to communicate with the computers. In an embodiment, each of the computers is equipped with a network communication device, for example, a network interface card, a modem, or other network connection device suitable for connecting to a network. Each of the computers and the devices executes an operating system, examples of which are disclosed above. While the operating system may differ depending on the type of computer, the operating system provides the appropriate communications protocols to establish communication links with the network. Any number and type of machines may be in communication with the computers.

The method and the system200disclosed herein are not limited to a particular computer system platform, processor, operating system, or network. In an embodiment, one or more embodiments of the method and the system200disclosed herein are distributed among one or more computer systems, for example, servers configured to provide one or more services to one or more client computers, or to perform a complete task in a distributed system. For example, one or more embodiments of the method and the system200disclosed herein are performed on a client-server system that comprises components distributed among one or more server systems that perform multiple functions according to various embodiments. These components comprise, for example, executable, intermediate, or interpreted code, which communicate over a network using a communication protocol. The method and the system200disclosed herein are not limited to be executable on any particular system or group of systems, and are not limited to any particular distributed architecture, network, or communication protocol.

The foregoing examples and illustrative implementations of various embodiments have been provided merely for explanation and are in no way to be construed as limiting of the method and the system200disclosed herein. While the method and the system200have been described with reference to various embodiments, illustrative implementations, drawings, and techniques, it is understood that the words, which have been used herein, are words of description and illustration, rather than words of limitation. Furthermore, although the method and the system200have been described herein with reference to particular means, materials, techniques, and embodiments, the method and the system200are not intended to be limited to the particulars disclosed herein; rather, the method and the system200extend to all functionally equivalent structures, methods and uses, such as are within the scope of the appended claims. While multiple embodiments are disclosed, it will be understood by those skilled in the art, having the benefit of the teachings of this specification, that the method and the system200disclosed herein are capable of modifications and other embodiments may be effected and changes may be made thereto, without departing from the scope and spirit of the method and the system200disclosed herein.