Identifying and remediating at-risk resources in a computing environment

A system, comprising:

• a computing environment comprising resources with memory that are re-arranged into different topologies over time;
• and a server connected to the computing environment and configured to:
• periodically determine and store a respective topology of the computing environment by analyzing a configuration file for each the resources in the computing environment, the configuration file for a particular resource describing one or more other resources in the computing environment that the particular resource has access to at a particular time;
• detect an intrusion event in the computing environment after the periodic determining of the respective infrastructure topologies of the computing environment;
• identify a time and a location of the intrusion event, the time comprising a start time and a duration of the intrusion event, the location comprising particular resource in the computing environment where the intrusion was detected;
• access one or more stored infrastructure topologies that correspond to the identified time of the intrusion event by comparing the determined time of the intrusion event to times associated with the one or more stored infrastructure topologies;
• determine at-risk resources in the computing environment by analyzing the one or more accessed infrastructure topologies to determine which resources among a plurality of resources in the computing environment were accessible to the particular resource in the computing environment where the intrusion was detected at the time of the intrusion event;
• and perform a remediation action for the determined at-risk resources, wherein the remediation action provides protection for temporally at-risk accessible resources that are associated with the determined intrusion event at the time of the intrusion event.

A computer program product for identifying and remediating at-risk resources in a computing environment, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions being executable by a computer device to cause the computer device to:

• periodically determine and store a respective topology of a computing environment comprising a number of reconfigurable resources by analyzing a configuration file for each of the resources in the computing environment, the configuration file for a particular resource describing one or more other resources in the computing environment that the particular resource has access to at a particular time;
• detect an intrusion event including an intrusion time and an intrusion location in the computing environment after the periodic determining of the respective infrastructure topologies of the computing environment, the intrusion time comprising a start time and a duration of the intrusion event, the intrusion location comprising a particular resource in the computing environment where the intrusion was detected;
• access one or more stored infrastructure topologies that correspond to the intrusion time of the intrusion event by comparing the determined time of the intrusion event to times associated with the one or more stored infrastructure topologies;
• determine at-risk resources in the computing environment based on the determined intrusion event and the corresponding one or more accessed infrastructure topologies, by analyzing the one or more accessed infrastructure topologies to determine which resources among a plurality of resources in the computing environment were accessible to the particular resource in the computing environment where the intrusion was detected at the time of the intrusion event;
• perform a remediation action for the set of resources of the determined at-risk resources including at least one of:
• transmitting a message to an administrator identifying the determined at-risk resources;
• and altering the computing environment to isolate the determined at-risk resources, wherein the remediation action provides protection for temporally at-risk accessible resources that are associated with the determined intrusion event at the time of the intrusion event.