Security for computing clouds

A system for automatic provisioning of a plurality of cloud-specific security services on a plurality of computing clouds, comprising:

• at least one processor executing a code for:
• collecting a plurality of datasets by a plurality of code sensors monitoring a plurality of cloud-specific security services and/or security resources running in a plurality of computing clouds of a common entity, wherein the plurality of datasets include usage information specific to the cloud-specific security services and/or security resources, and exclude data stored within the plurality of cloud-specific security services and/or security resources;
• generating a technical architecture including a common security policy and/or security objective to achieve across the plurality of security services and/or security resources on the plurality of computing clouds according to an analysis of the plurality of datasets including the usage information and excluding data stored within the plurality of cloud-specific security services and/or security resources;
• computing a plurality of architectural adaptations to the plurality of cloud-specific security services and/or security resources for normalizing current architectures to generate the technical architecture in each of the plurality of cloud-specific security services and/or security resources of the plurality of cloud-specific computing clouds for meeting the common security policy and/or security objective;
• generating a plurality of code-scripts according to the plurality of architectural adaptations for installation at corresponding cloud-specific security service and/or security resource running on each corresponding computing cloud for implementing the technical architecture across the plurality of computing clouds of the common entity;
• in response to the installation of the plurality of code-scripts for implementing the technical architecture, analyzing the plurality of datasets for detecting drift from the generated technical architecture, wherein the drift comprises unauthorized changes to the technical architecture and/or security policy implemented by the code-scripts, automatically re-computing the plurality of architectural adaptations for resolving the drift by determining modifications to the code-scripts necessary to restore compliance with the technical architecture, and automatically generating a plurality of adapted code-scripts according to the re-computed plurality of architectural adaptations;
• and
• automatically re-installing the adapted code-scripts on the corresponding cloud-specific security service and/or security resource running on the corresponding computing clouds to resolve the drift.

A non-transitory medium storing program instructions for automatic provisioning of a plurality of security services on a plurality of computing clouds, which when executed by at least one processor, cause the at least one processor to:

• collect a plurality of datasets by a plurality of code sensors monitoring a plurality of cloud-specific security services and/or security resources running in a plurality of computing clouds of a common entity, wherein the plurality of datasets include usage information specific to the cloud-specific security services and/or security resources, and exclude data stored within the plurality of cloud-specific security services and/or security resources;
• generate a technical architecture including a common security policy and/or security objective to achieve across the plurality of security services and/or security resources on the plurality of computing clouds according to an analysis of the plurality of datasets including the usage information and excluding data stored within the plurality of cloud-specific security services and/or security resources;
• compute a plurality of architectural adaptations to the plurality of cloud-specific security services and/or security resources for normalizing current architectures to generate the technical architecture in each of the plurality of cloud-specific security services and/or security resources of the plurality of cloud-specific computing clouds for meeting the common security policy and/or security objective;
• generate a plurality of code-scripts according to the plurality of architectural adaptations for installation at corresponding cloud-specific security service and/or security resource running on each corresponding computing cloud for implementing the technical architecture across the plurality of computing clouds of the common entity;
• in response to the installation of the plurality of code-scripts for implementing the technical architecture, wherein the drift comprises unauthorized changes to the technical architecture and/or security policy implemented by the code-scripts, analyze the plurality of datasets for detecting drift from the generated technical architecture, automatically re-compute the plurality of architectural adaptations for resolving the drift by determining modifications to the code-scripts necessary to restore compliance with the technical architecture, and automatically generate a plurality of adapted code-scripts according to the re-computed plurality of architectural adaptations;
• and
• automatically re-install the adapted code-scripts on the corresponding cloud-specific security service and/or security resource running on the corresponding computing clouds to resolve the drift.