Automated network security policy configuration

A security configuration management system comprising:

• one or more computer processors;
• and
• one or more non-transitory computer-readable mediums storing instructions that, when executed by the one or more computer processors, cause the security configuration management system to perform operations comprising:
• accessing, from two or more data sources, network data gathered from a network, the network including nodes, the network data including Internet Protocol (IP) addresses, device types and software used in the network;
• wherein the network data includes a first table and a second table;
• aggregating the network data, yielding an aggregated asset database, wherein the aggregating performs a single operation that identifies a first field in the first table that matches a second field in the second table, and when first field matches the second field, identifies related data records that can be merged, the related data records both being from a first device and having the same IP address;
• generating, based on the aggregated asset database, a network topology describing computing nodes in the network and interconnections between the computing nodes in the network;
• determining, based on the aggregated asset database and a database of known security vulnerabilities corresponding to device and software profiles, a set of security vulnerabilities for the network, wherein the database of known vulnerabilities is compiled based upon historical data and wherein the determining analyzes the aggregated asset database to identify a device and software profile of the first device, and then matches the device and software profile of the first device found in the aggregated asset database to a known device and software profile in the database of known vulnerabilities, wherein the known device and software profile relates to a first device;
• determining a set of security policies for the network based on the set of security vulnerabilities, wherein the generating creates a whitelisting policy of data traffic that is to be allowed, the whitelisting policy based upon an analysis of whether nodes in the entire network are likely to communicate with each other and the types of messages types or protocols that are likely to be transmitted amongst the nodes;
• generating network security configurations for the network based on the network topology and the set of security policies;
• and
• at least initiating implementation of the network security configurations on a network security device in the network.

A non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors of a security configuration management system, cause the security configuration management system to perform operations comprising:

• accessing, from two or more data sources, network data gathered from a network, the network including nodes, the network data including Internet Protocol (IP) addresses, device types and software used in the network;
• wherein the network data includes a first table and a second table;
• aggregating, using one or more hardware processors, the network data, yielding an aggregated asset database, wherein the aggregating performs a single operation that identifies a first field in the first table that matches a second field in the second table, and when first field matches the second field, identifies related data records that can be merged, the related data records both being from a first device and having the same IP address;
• generating, using the one or more hardware processors and based on the aggregated asset database, a network topology describing computing nodes in the network and interconnections between the computing nodes in the network;
• determining, using the one or more hardware processors and based on the aggregated asset database and a database of known security vulnerabilities corresponding to device and software profiles, a set of security vulnerabilities for the network, wherein the database of known vulnerabilities is compiled based upon historical data and wherein the determining analyzes the aggregated asset database to identify a device and software profile of the first device, and then matches the device and software profile of the first device found in the aggregated asset database to a known device and software profile in the database of known vulnerabilities, wherein the known device and software profile relates to a first device;
• determining a set of security policies for the network based on the set of security vulnerabilities, wherein the generating creates a whitelisting policy of data traffic that is to be allowed, the whitelisting policy based upon an analysis of whether nodes in the entire network are likely to communicate with each other and the types of messages types or protocols that are likely to be transmitted amongst the nodes;
• generating, using the one or more hardware processors, network security configurations for the network based on the network topology and the set of security policies;
• and
• at least initiating implementation of the network security configurations on a network security device in the network.

A system comprising:

• one or more processors;
• a network, the network including nodes;
• two or more data sources coupled to the network, the two or more data sources storing network data gathered from the network, the network data including Internet Protocol (IP) addresses, device types and software used in the network, the network data including a first table and a second table;
• by the one or more processors:
• accessing, from the two or more data sources, the network data;
• aggregating, using one or more hardware processors, the network data, yielding an aggregated asset database, wherein the aggregating performs a single operation that identifies a first field in the first table that matches a second field in the second table, and when first field matches the second field, identifies related data records that can be merged, the related data records both being from a first device and having the same IP address;
• generating, using the one or more hardware processors and based on the aggregated asset database, a network topology describing computing nodes in the network and interconnections between the computing nodes in the network;
• determining, using the one or more hardware processors and based on the aggregated asset database and a database of known security vulnerabilities corresponding to device and software profiles, a set of security vulnerabilities for the network, wherein the database of known vulnerabilities is compiled based upon historical data and wherein the determining analyzes the aggregated asset database to identify a device and software profile of the first device, and then matches the device and software profile of the first device found in the aggregated asset database to a known device and software profile in the database of known vulnerabilities, wherein the known device and software profile relates to a first device;
• determining a set of security policies for the network based on the set of security vulnerabilities, wherein the generating creates a whitelisting policy of data traffic that is to be allowed, the whitelisting policy based upon an analysis of whether nodes in the entire network are likely to communicate with each other and the types of messages types or protocols that are likely to be transmitted amongst the nodes;
• generating network security configurations for the network based on the network topology and the set of security policies;
• and
• at least initiating implementation of the network security configurations on a network security device in the network.