Service oriented software-defined security framework

A computer-implemented method comprising:

• receiving, by a security controller that communicates with a security control device and a computing asset, data identifying a security event associated with the computing asset;
• determining, by the security controller, a logical attribute of the security control device and a logical attribute of the computing asset;
• based on the logical attribute of the security control device and the logical attribute of the computing asset, accessing, by the security controller, a security playbook that includes set of security control commands for the security controller to perform in response to the security event;
• and
• based on the set of security control commands:
• identifying, by the security controller, a security service binding that matches a security service requirement for the computing asset and a security service description for the security control device, the security service description for the security control device being based on a security control capacity description of the security control device, and the security service requirement for the computing asset being based on a security policy and a security model for the computing asset;
• and
• adjusting, by the security controller, the security service binding that matches the security service requirement for the computing asset and the security service description for the security control device by adjusting the security service description for the security control device and adjusting the security service requirement for the computing asset.

A system comprising:

• one or more computers;
• and
• one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
• receiving, by a security controller that communicates with a security control device and a computing asset, data identifying a security event associated with the computing asset;
• determining, by the security controller, a logical attribute of the security control device and a logical attribute of the computing asset;
• based on the logical attribute of the security control device and the logical attribute of the computing asset, accessing, by the security controller, a security playbook that includes set of security control commands for the security controller to perform in response to the security event;
• and
• based on the set of security control commands:
• identifying, by the security controller, a security service binding that matches a security service requirement for the computing asset and a security service description for the security control device, the security service description for the security control device being based on a security control capacity description of the security control device, and the security service requirement for the computing asset being based on a security policy and a security model for the computing asset;
• and
• adjusting, by the security controller, the security service binding that matches the security service requirement for the computing asset and the security service description for the security control device by adjusting the security service description for the security control device and adjusting the security service requirement for the computing asset.

A non-transitory computer-readable medium storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

• receiving, by a security controller that communicates with a security control device and a computing asset, data identifying a security event associated with the computing asset;
• determining, by the security controller, a logical attribute of the security control device and a logical attribute of the computing asset;
• based on the logical attribute of the security control device and the logical attribute of the computing asset, accessing, by the security controller, a security playbook that includes set of security control commands for the security controller to perform in response to the security event;
• and
• based on the set of security control commands:
• identifying, by the security controller, a security service binding that matches a security service requirement for the computing asset and a security service description for the security control device, the security service description for the security control device being based on a security control capacity description of the security control device, and the security service requirement for the computing asset being based on a security policy and a security model for the computing asset;
• and
• adjusting, by the security controller, the security service binding that matches the security service requirement for the computing asset and the security service description for the security control device by adjusting the security service description for the security control device and adjusting the security service requirement for the computing asset.