# US 2018/0027009 A1 · Automated container security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0027009 A1 - Document ID: US20180027009A1 - Status: Published application - Kind: A1 - Application number: 15/215,494 - Filed: 2016-07-20 - Published: 2018-01-25 - Earliest claimed: 2016-07-20 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Omar Santos; Jazib Frahim - Web page: https://patentgrep.com/patent/US20180027009A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and computer-readable storage media for determining threat mitigation policies and deploying tested security fixes. In some cases, the present technology involves gathering threat intelligence, identifying a security threat, identifying an application container that is affected by the security threat, determining a threat level for the security threat on the application container, applying a threat mitigation policy to the affected application container, spawning a clone of the affected application container, testing the clone with one or more security fixes, and deploying the clone of the affected container as a replacement for the affected container. ## Claims ### Claim 1 A computer-implemented method comprising: gathering, by a server in a distributed network of application containers, security threat intelligence; identifying, in the security threat intelligence, a security threat; automatically identifying an application container that is affected by the security threat; determining a threat level for the security threat on the application container; applying a threat mitigation policy on the affected application container based on the threat level; spawning a clone of the affected application container; testing one or more security fixes on the clone of the affected application container; and after the testing is successful, deploying the clone of the affected container as a replacement for the affected container. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein gathering threat intelligence further comprises one or more of: gathering external intelligence relating to an active exploit that affected another application container, processing a vulnerability report from a commercial vendor, processing a vulnerability report from a governmental organization, and analyzing local indicators of compromise. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein automatically identifying an application container that is affected by the security threat further comprises: correlating the threat intelligence with local indicators of compromise to identify affected application containers. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising: gathering information relating to the operating environment of the affected application container. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, further comprising: applying the information relating to the operating environment of the affected application container when determining a threat level for the security threat on the application container. ### Claim 6 (depends on 4) The computer-implemented method of claim 4, further comprising applying the information relating to the operating environment of the affected application container to the clone of the affected application container, wherein testing one or more security fixes on the clone of the affected application container further comprises testing the clone of the application container in accordance with the information relating to the operating environment of the affected application container. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: after identifying a security threat, determining that a security patch is available for addressing the security threat; and deploying the security patch to the affected application container. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein applying a threat mitigation policy on the affected application container involves one or more of: hardening an access policy for the affected application container, encrypting a database for the affected application container, suspending a service offered by the affected application container, and shutting down the affected application container. ### Claim 9 A system in a distributed network of application containers comprising: a processor; and a computer-readable storage medium having stored therein instructions which, when executed by the processor, cause the processor to perform operations comprising: gathering security threat intelligence; identifying, in the security threat intelligence, a security threat; automatically identifying an application container that is affected by the security threat; determining a threat level for the security threat on the application container; applying a threat mitigation policy on the affected application container based on the threat level; spawning a clone of the affected application container; testing one or more security fixes on the clone of the affected application container; and after the testing is successful, deploying the clone of the affected container as a replacement for the affected container. ### Claim 10 (depends on 9) The system of claim 9, wherein the instruction further cause the processor to perform operations comprising: gathering information relating to the operating environment of the affected application container. ### Claim 11 (depends on 10) The system of claim 10, wherein the instruction further cause the processor to perform operations comprising: applying the information relating to the operating environment of the affected application container when determining a threat level for the security threat on the application container. ### Claim 12 (depends on 10) The system of claim 10, wherein the instruction further cause the processor to perform operations comprising: applying the information relating to the operating environment of the affected application container to the clone of the affected application container, wherein testing one or more security fixes on the clone of the affected application container further comprises testing the clone of the application container in accordance with the information relating to the operating environment of the affected application container. ### Claim 13 (depends on 9) The system of claim 9, wherein applying a threat mitigation policy on the affected application container involves one or more of: hardening an access policy for the affected application container, encrypting a database for the affected application container, suspending a service offered by the affected application container, and shutting down the affected application container. ### Claim 14 A non-transitory computer-readable storage medium having stored therein instructions which, when executed by a processor, cause the processor to perform operations comprising gathering security threat intelligence; identifying, in the security threat intelligence, a security threat; automatically identifying an application container that is affected by the security threat; determining a threat level for the security threat on the application container; applying a threat mitigation policy on the affected application container based on the threat level; spawning a clone of the affected application container; testing one or more security fixes on the clone of the affected application container; and after the testing is successful, deploying the clone of the affected container as a replacement for the affected container. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instruction further cause the processor to perform operations comprising: gathering information relating to the operating environment of the affected application container. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the instruction further cause the processor to perform operations comprising: applying the information relating to the operating environment of the affected application container when determining a threat level for the security threat on the application container. ### Claim 17 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the instruction further cause the processor to perform operations comprising: applying the information relating to the operating environment of the affected application container to the clone of the affected application container, wherein testing one or more security fixes on the clone of the affected application container further comprises testing the clone of the application container in accordance with the information relating to the operating environment of the affected application container. ### Claim 18 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein applying a threat mitigation policy on the affected application container involves one or more of: hardening an access policy for the affected application container, encrypting a database for the affected application container, suspending a service offered by the affected application container, and shutting down the affected application container. ### Claim 19 A computer-implemented method comprising: identifying a security threat for an application container; spawning a clone of the affected application container; testing one or more security fixes on the clone of the affected application container; and deploying the clone of the affected container as a replacement for the affected container. ### Claim 20 A computer-implemented method comprising: gathering threat intelligence; correlating the threat intelligence to identify a security threat; automatically identifying an application container that is affected by the security threat; determining a threat level for the security threat on the application container; applying a threat mitigation policy on the affected application container based on the threat level.