Security feature enforcement using AI-based security policy gap summarization

A method implemented by a computing system, the method comprising:

• causing an artificial intelligence model to perform a comparison of a security policy, which comprises a plurality of enforced security features that are enforced in a system, and a security policy template, which comprises a plurality of reference security features, by providing the security policy and the security policy template as first inputs to the artificial intelligence model, wherein performance of the comparison comprises determining that a subset of the plurality of reference security features is absent from the plurality of enforced security features;
• causing the artificial intelligence model to generate a summary of the subset of the plurality of reference security features by providing a representation of the subset of the plurality of reference security features as a second input to the artificial intelligence model;
• determining extents to which identified reference security features, which are comprised in the subset of the plurality of reference security features, are to increase security of the system;
• causing the summary and an explanation to be presented via a user interface, the explanation indicating that the subset of the plurality of reference security features is absent from the plurality of enforced security features in the security policy and indicating a mapping of the identified reference security features to the extents;
• and
• the subset of the plurality of reference security features to be enforced in the system by adding the subset of the plurality of reference security features to the plurality of enforced security features in the security policy.

A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, the operations comprising:

• determining that a subset of a plurality of reference security features that define a security policy template is absent from a plurality of enforced security features that define a security policy, which is enforced in a system, using an artificial intelligence model by providing the security policy and the security policy template as first inputs to the artificial intelligence model;
• generating a summary of the subset of the plurality of reference security features using the artificial intelligence model by providing a representation of the subset of the plurality of reference security features as a second input to the artificial intelligence model;
• determining extents to which identified reference security features, which are comprised in the subset of the plurality of reference security features, are to increase security of the system;
• causing the summary and an explanation to be presented via a user interface, the explanation indicating that the subset of the plurality of reference security features is absent from the plurality of enforced security features in the security policy and indicating a mapping of the identified reference security features to the extents;
• and
• causing the subset of the plurality of reference security features to be enforced in the system by redefining the security policy using the summary of the subset of the plurality of reference security features, wherein redefining the security policy comprises adding the subset of the plurality of reference security features to the plurality of enforced security features.