Varmour Networks, Inc.

Marc Woolward

Keith Stewart

Jia-Jyi Lian

Choung-Yaw Shieh

Anthony Paterra

Matthew Murray Williamson

Colin Ross

Meng Xu

Hsisheng Wang

Hong Xiao

Yi Sun

Cheng-Lin Hou

Jason Parry

Paul Bigbee

Myo Zarny

Timothy Eades

Xiaodan Li

Zhiping Liu

Yi Hung Cheng

Chien Yang Hsu

Hsin Tien Tseng

A system and a method for modeling queue-based message-oriented middleware (MoM) are provided. The method commences with connecting with a MoM system and converting information associated with the MoM system into a standardized object model. The standardized object model may include a queue-based node, at least one producer application, and at least one consumer application. The at least one producer application provides a message to the queue-based node. The at least one consumer application receives the message from the queue-based node. The message persists in the queue until consumed by the at least one consumer application. The method continues with generating a standardized graph of relationships between a producer and a consumer over a period of time. The method further includes creating a policy, periodically analyzing the standardized graph for at least one deviation from the policy, and issuing an alert in response to detecting the at least one deviation.

Modeling queue-based message-oriented middleware relationships in a security system

Methods and systems for managing security in a cloud computing environment are provided. Exemplary methods include: gathering data about workloads and applications in the cloud computing environment; updating a graph database using the data, the graph database representing the workloads of the cloud computing environment as nodes and relationships between the workloads as edges; receiving a security template, the security template logically describing targets in the cloud computing environment to be protected and how to protect the targets; creating a security policy using the security template and information in the graph database; and deploying the security policy in the cloud computing environment.

Modeling application dependencies to identify operational risk

A system and a method for modeling topic-based message-oriented middleware (MoM) are provided. The method commences with connecting with a MoM system and converting information associated with the MoM system into a standardized object model. The standardized object model may include a topic-based node associated with a topic, at least one producer application, and at least one consumer application. The at least one producer application provides one or more messages related to the topic to the topic-based node. The at least one consumer application receives the one or more messages from the topic-based node. The method continues with generating a standardized graph of relationships between producers and consumers over a period of time. The method further includes creating a policy, periodically analyzing the standardized graph for at least one deviation from the policy, and issuing an alert in response to detecting the at least one deviation.

Modeling topic-based message-oriented middleware within a security system

Systems and methods for assessing an application access risk are provided. An example method commences with collecting data concerning relationships between an application, one or more client devices, and one or more users in a computing environment. The method includes updating a graph database including nodes and edges. The nodes represent the application, the one or more client devices, and the one or more users and the edges represent relationships between the application, the one or more client devices, and the one or more users. The method continues with enriching the graph database by associating the nodes with metadata including information concerning the one or more users accessing the application from the one or more client devices. The method further includes analyzing the graph database to identify a subset of nodes used to access the application and displaying a graphical representation of the subset of nodes.

Methods and systems for accurately assessing application access risk

Methods and systems for understanding identity and organizational access to applications within an enterprise environment are provided. Exemplary methods include collecting data about relationships between applications and metadata associated with the applications in a computing environment of an enterprise, the metadata including information concerning a plurality of users accessing the applications; updating a graph database including nodes representing the applications of the computing environment of the enterprise and edges representing relationships between the applications; enriching the graph database by associating the nodes with metadata associated with the applications and associating user accounts with metadata associated with roles, organizations membership, privileges, and permissions; analyzing the graph database to identify a subset of nodes being accessed by a user of the plurality of users; and displaying, via a graphical user interface, a graphical representation of the subset of nodes and relationships between the nodes in the subset of the nodes.

Systems and methods for understanding identity and organizational access to applications within an enterprise environment

Cloud security management

Methods and systems for validating security policy in a cloud computing environment are provided. An example method includes providing a graph database, the graph database representing workloads of the cloud computing environment as nodes and relationships between the workloads as edges, receiving a security policy, the security policy logically describing rules for the relationships between the workloads, determining, based on the security policy and the graph database, a list of violations, the list of violations including at least one relationship from the relationships between the workloads in the graph database, the at least one relationship being not allowed by at least one of the rules in the security policy, and providing the list of violations to a user.

Validation of cloud security policies

Methods and systems for reliability prediction of security policies in a cloud computing environment are provided. An example method includes providing a graph database representing workloads of the cloud computing environment as nodes and relationships between the workloads as edges, the relationships being associated with points in time, receiving a security policy including rules for the relationships between the workloads, generating a plurality of earliest points in time based on the rules and the graph database, wherein generating the plurality of earliest points in time includes: determining, for each rule of the rules, a subset of the relationships in the graph database such that each of the subset of the relationships matches the rule, and selecting an earliest point in time from points in time associated with relationships from the subset, and analyzing the plurality of earliest points in time to determine a reliability score for the security policy.

Reliability prediction for cloud security policies

Methods and systems for managing security in a cloud computing environment are provided. Exemplary methods include: receiving a target, the target specifying workloads of a plurality of workloads to be included in the security policy, the plurality of workloads being associated with the cloud computing environment; identifying nodes and edges in the graph database using the target, the graph database representing the plurality of workloads as nodes and relationships between the plurality of workloads as edges; getting a security intent, the security intent including a high-level security objective in a natural language; obtaining a security template associated with the security intent; and applying the security template to the identified nodes and edges to produce security rules for the security policy, the security rules at least one of allowing and denying communications between the target and other workloads of the plurality of workloads.

Template-driven intent-based security

Methods, systems, and media for producing a firewall rule set are provided herein. Exemplary methods may include receiving a declarative policy associated with a computer network security policy; collecting information from at least one external system of record; generating a firewall rule set using the declarative policy and information, the firewall rule set including addresses to or from which network communications are permitted, denied, redirected or logged, the firewall rule set being at a lower level of abstraction than the declarative policy; and provisioning the firewall rule set to a plurality of enforcement points of a distributed firewall, the firewall selectively policing network communications among workloads using the firewall rule set.

Conditional declarative policies

Methods, systems, and media for security in virtualization, bare-metal server, and cloud computing environments are provided herein. Exemplary methods include: receiving network traffic associated with a primary workload; generating first metadata using the network traffic; determining a primary categorization associated with the primary workload, using the first metadata; confirming the primary categorization is reliable; determining a secondary categorization associated with at least one secondary workload, the at least one secondary workload being communicatively coupled to the primary workload; ascertaining the primary categorization and the secondary categorization are consistent with each other and are each stable; producing a model using the primary categorization and the secondary categorization; checking the model for sustained convergence; and generating a high-level declarative security policy associated with the primary workload using the model, the high-level declarative security policy indicating at least an application or service with which the primary workload can communicate.

Security policy generation for virtualization, bare-metal server, and cloud computing environments

Systems for providing security to distributed microservices are provided herein. In some embodiments, a system includes a plurality of microservices, each of the plurality of microservices having a plurality of distributed microservice components. At least a portion of the distributed microservice components execute on different physical or virtual servers in a data center or a cloud. The system also includes a plurality of logical security boundaries, with each of the plurality of logical security boundaries being created by a plurality of enforcement points positioned in association with the plurality of distributed microservice components. Each of plurality of microservices is bounded by one of the plurality of logical security boundaries.

Methods and systems for providing security to distributed microservices

Methods and systems for deception using distributed threat detection are provided. Exemplary methods by an enforcement point, the enforcement point communicatively coupled to a first data network and a second data network, the enforcement point not providing services in the second data network, include: receiving, from a first workload in the second data network, a data packet addressed to a second workload in the second data network, the data packet requesting a service from the second workload; determining the data packet is for unauthorized access of the second workload, the determining using at least some of a 5-tuple of the data packet; identifying a deception point using the service, the deception point being in the first data network and including a decoy for the service; and redirecting the data packet to the deception point in the first data network.

Deception using distributed threat detection

Systems and methods for delivering security functions to a distributed network are described herein. An exemplary method may include: processing a data packet received from a switch, the data packet directed to the at least one network asset; selectively forwarding the data packet using the processing and a rule set; inspecting the forwarded packet; directing the enforcement point to at least one of forward the data packet to the at least one network asset and drop the data packet, using the inspection and the rule set; accumulating data associated with at least one of the data packet, the processing, and the inspection; analyzing the at least one of the data packet, the processing, and the inspection; and initiating compilation of a high-level security policy by the compiler using the analysis to produce an updated rule set.

Delivering security functions to distributed networks

Methods and systems for microsegmentation of data networks are provided herein. Exemplary methods include: receiving a high-level declarative policy; getting metadata associated with a plurality of containers from an orchestration layer; determining a low-level firewall rule set using the high-level declarative policy and the metadata; and configuring by a plurality of enforcement points a respective virtual switch of a plurality of virtual switches to process packets in accordance with the low-level firewall ruleset, the virtual switches being collectively communicatively coupled to the plurality of containers, such that network communications between a first group of containers and a second group of containers of the plurality of containers are not permitted, and communications between containers of the first group of containers are permitted.

Growing community of inventors

Santa Cruz, CA, United States of America

Marc Woolward