Abstract: Some embodiments of the invention provide a novel method for managing layer four (L4) ports associated with a machine executing on a host computer. The method collects a set of contextual attributes relating to applications executing on the machine. It then analyzes the collected contextual attributes to identify at least one L4 port that has to have its status modified. Next, it modifies the status of the identified L4 port. In some embodiments, the status of an L4 port can be either open or closed, and the modification can open a closed port or close an open port. In some embodiments, the method is performed when the machine starts up on the host computer, performed each time a new application is installed on the machine, performed periodically to close unused L4 ports, and/or performed periodically to close L4 ports that should not be open based on a set of L4-port control policies.

Abstract: Some embodiments of the invention provide a novel method for managing layer four (L4) ports associated with a machine executing on a host computer. The method collects a set of contextual attributes relating to applications executing on the machine. It then analyzes the collected contextual attributes to identify at least one L4 port that has to have its status modified. Next, it modifies the status of the identified L4 port. In some embodiments, the status of an L4 port can be either open or closed, and the modification can open a closed port or close an open port. In some embodiments, the method is performed when the machine starts up on the host computer, performed each time a new application is installed on the machine, performed periodically to close unused L4 ports, and/or performed periodically to close L4 ports that should not be open based on a set of L4-port control policies.

Abstract: Some embodiments of the invention provide a novel method for managing layer four (L4) ports associated with a machine executing on a host computer. The method collects a set of contextual attributes relating to applications executing on the machine. It then analyzes the collected contextual attributes to identify at least one L4 port that has to have its status modified. Next, it modifies the status of the identified L4 port. In some embodiments, the status of an L4 port can be either open or closed, and the modification can open a closed port or close an open port. In some embodiments, the method is performed when the machine starts up on the host computer, performed each time a new application is installed on the machine, performed periodically to close unused L4 ports, and/or performed periodically to close L4 ports that should not be open based on a set of L4-port control policies.

Abstract: The disclosure provides an approach for compliance management in a network. Embodiments include receiving, by a manager, a system health plugin. Embodiments include determining a configuration change for a network. Embodiments include receiving data indicating a current security posture of the network. Embodiments include determining an impact to the security posture of the network based on the configuration change. Embodiments include generating a notification relating to the impact to the security posture of the network. Embodiments include receiving a decision relating to the configuration change in response to the notification. Embodiments include performing an action based on the decision.

Abstract: The disclosure provides an approach for compliance management in a network. Embodiments include receiving, by a manager, a system health plugin. Embodiments include determining a configuration change for a network. Embodiments include receiving data indicating a current security posture of the network. Embodiments include determining an impact to the security posture of the network based on the configuration change. Embodiments include generating a notification relating to the impact to the security posture of the network. Embodiments include receiving a decision relating to the configuration change in response to the notification. Embodiments include performing an action based on the decision.

Abstract: The disclosure herein describes determining the compliance of software applications to compliance standards based on capabilities of the software applications. The capabilities of a software application are identified, and the compliance controls of a compliance standard are identified from respective data stores. The capabilities are mapped to the compliance controls based on defined capability map data. Based on at least one capability of the software application being mapped to each compliance control of the compliance standard, a positive compliance indicator is provided, whereby compliance of the software application with the compliance standard is confirmed. The described systems and methods provide efficient means for determining compliance of software applications based on defined capabilities that are abstracted to be comparable to a variety of compliance controls.

Abstract: The disclosure herein describes determining the compliance of software applications to compliance standards based on capabilities of the software applications. The capabilities of a software application are identified, and the compliance controls of a compliance standard are identified from respective data stores. The capabilities are mapped to the compliance controls based on defined capability map data. Based on at least one capability of the software application being mapped to each compliance control of the compliance standard, a positive compliance indicator is provided, whereby compliance of the software application with the compliance standard is confirmed. The described systems and methods provide efficient means for determining compliance of software applications based on defined capabilities that are abstracted to be comparable to a variety of compliance controls.