Systems and methods for updating security policies for network traffic

One or more non-transitory computer-readable storage media storing instructions which, when executed by one or more hardware processors, cause performance of a method to update a security policy, the method comprising:

• monitoring network traffic using a plurality of microservices;
• detecting that the monitored network traffic indicates activity directed to a first externally accessible resource at a first level of resources in an internal network, the activity directed from a second externally accessible resource at the first level of resources in the internal network, the first and second externally accessible resources reachable via an interface configured to receive the network traffic from outside the internal network;
• in response to detecting the network traffic indicates the activity directed to the first externally accessible resource at the first level of resources in the internal network, correlating the activity with the second externally accessible resource;
• determining internally accessible resources at a second level of resources in the internal network associated with the second externally accessible resource at the first level of resources in the internal network, the internally accessible resources not reachable directly from an external network;
• updating the security policy associated with the internally accessible resources, the security policy regarding communications from externally accessible resources at the first level of resources in the internal network to the internally accessible resources at the second level of resources in the internal network;
• and
• applying the updated security policy to subsequent network traffic directed to the internally accessible resources.

An apparatus, comprising:

• one or more hardware processors;
• memory coupled to the one or more hardware processors, the memory storing instructions which, when executed by the one or more hardware processors, causes the apparatus to:
• monitor network traffic using a plurality of microservices;
• detect that the monitored network traffic indicates activity directed to a first externally accessible resource at a first level of resources in an internal network, the activity directed from a second externally accessible resource at the first level of resources in the internal network, the first and second externally accessible resources reachable via an interface configured to receive the network traffic from outside the internal network;
• in response to detecting the network traffic indicates the activity directed to the first externally accessible resource at the first level of resources in the internal network, correlate the activity with the second externally accessible resource;
• determine internally accessible resources at a second level of resources in the internal network associated with the second externally accessible resource at the first level of resources in the internal network, the internally accessible resources not reachable directly from an external network;
• update a security policy associated with the internally accessible resources, the security policy regarding communications from externally accessible resources at the first level of resources in the internal network to the internally accessible resources at the second level of resources in the internal network;
• and
• apply the updated security policy to subsequent network traffic directed to the internally accessible resources.

A computer-implemented method to update a security policy, the method comprising:

• monitoring network traffic using a plurality of microservices;
• detecting that the monitored network traffic indicates activity directed to an internally accessible resource at a second level of resources in an internal network, the activity directed from an externally accessible resource at a first level of resources in the internal network, the internally accessible resource not reachable directly from an external network;
• in response to detecting the network traffic indicates the activity directed to the internally accessible resource, correlating the activity with the externally accessible resource;
• determining externally accessible resources at the first level of resources in the internal network associated with the internally accessible resource at the second level of resources in the internal network, the externally accessible resources reachable via an interface configured to receive the network traffic from outside the internal network;
• updating the security policy associated with the externally accessible resources, the security policy regarding communications between externally accessible resources;
• and
• applying the updated security policy to subsequent network traffic directed to the externally accessible resources.

One or more non-transitory computer-readable storage media storing instructions which, when executed by one or more hardware processors, cause performance of a method to update a security policy, the method comprising:

• monitoring network traffic using a plurality of microservices;
• detecting that the monitored network traffic indicates activity directed to an internally accessible resource at a second level of resources in an internal network, the activity directed from an externally accessible resource at a first level of resources in the internal network, the internally accessible resource not reachable directly from an external network;
• in response to detecting the network traffic indicates the activity directed to the internally accessible resource, correlating the activity with the externally accessible resource;
• determining externally accessible resources at the first level of resources in the internal network associated with the internally accessible resource at the second level of resources in the internal network, the externally accessible resources reachable via an interface configured to receive the network traffic from outside the internal network;
• updating the security policy associated with the externally accessible resources, the security policy regarding communications between externally accessible resources;
• and
• applying the updated security policy to subsequent network traffic directed to the externally accessible resources.

An apparatus, comprising:

• one or more hardware processors;
• memory coupled to the one or more hardware processors, the memory storing instructions which, when executed by the one or more hardware processors, causes the apparatus to:
• monitor network traffic using a plurality of microservices;
• detect that the monitored network traffic indicates activity directed to an internally accessible resource at a second level of resources in an internal network, the activity directed from an externally accessible resource at a first level of resources in the internal network, the internally accessible resource not reachable directly from an external network;
• in response to detecting the network traffic indicates the activity directed to the internally accessible resource, correlate the activity with the externally accessible resource;
• determine externally accessible resources at the first level of resources in the internal network associated with the internally accessible resource at the second level of resources in the internal network, the externally accessible resources reachable via an interface configured to receive the network traffic from outside the internal network;
• update a security policy associated with the externally accessible resources, the security policy regarding communications between externally accessible resources;
• and
• apply the updated security policy to subsequent network traffic directed to the externally accessible resources.