System and method to create zero trust framework for security as a service
AssigneeSkyhigh Security LLC
InventorsAnamika Bhattacharya, Deepak Bharadwaj, Sriranga Seetharamaiah, Abhisek Sanyal, Siddaraya Revashetti
Life of this patent
Estimating the term…
Abstract
An apparatus includes a network interface that performs a reception of a launch request and receives a policy for a service. The launch request includes an identifier of a workload and an identifier of an application. A processor determines a customer security posture, at least in part based on the identifier of the workload and the identifier of the application. Further, the processor determines to deny the launch request, at least in part based on the policy and the customer security posture.
Claims20
An apparatus, comprising:
- a network interface that performs a reception of a launch request to launch an application and receives a policy for a service, wherein the launch request includes an identifier of a workload within a customer infrastructure making the launch request and an identifier of the application;
- and
- a processor configured to determine a customer security posture, at least in part based on the identifier of the workload, activities performed by the workload, and the identifier of the application, and to determine to deny the launch request, at least in part based on the policy and the customer security posture, wherein determining to deny the launch request includes determining whether the workload meets hardening rules and determining whether a checksum of the application matches a predetermined checksum and determining whether a risk score exceeds a predetermined value indicated in the policy, wherein the risk score is based on an evaluation of hardware running a virtual machine (VM) or container that produced the workload within the customer infrastructure.
A method, comprising:
- receiving a launch request to launch an application including an identifier of a workload within a customer infrastructure making the launch request and an identifier of the application;
- receiving a policy for a service;
- determining a customer security posture, at least in part based on the identifier of the workload, activities performed by the workload, and the identifier of the application;
- and
- determining to deny the launch request, at least in part based on the policy and the customer security posture, wherein determining to deny the launch request includes determining whether the workload meets hardening rules and determining whether a checksum of the application matches a predetermined checksum and determining whether a risk score exceeds a predetermined value indicated in the policy, wherein the risk score is based on an evaluation of hardware running a virtual machine (VM) or container that produced the workload within the customer infrastructure.
A non-transitory, computer-readable medium encoded with executable instructions that, when executed by a processing unit, perform operations comprising:
- receiving a launch request to launch an application, wherein the launch request includes an identifier of a workload within a customer infrastructure making the launch request and an identifier of the application;
- receiving a policy for a service;
- determining a customer security posture, at least in part based on the identifier of the workload, activities performed by the workload, and the identifier of the application;
- and
- determining to deny the launch request, at least in part based on the policy and the customer security posture, wherein determining to deny the launch request includes determining whether the workload meets hardening rules and determining whether a checksum of the application matches a predetermined checksum and determining whether a risk score exceeds a predetermined value indicated in the policy, wherein the risk score is based on an evaluation of hardware running a virtual machine (VM) or container that produced the workload within the customer infrastructure exceeds.
Dependencies are inferred from the claim text.