Policy management

• US 10,333,990 B2
• Filed: 12/20/2017
• Issued: 06/25/2019
• Est. Priority Date: 09/13/2006
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Jacobs, Richard
• Primary Examiner(s): Korsak, Oleg
• Application Number:
  US15/849,083
• Publication Number:
  US 20180139242A1
• Time in Patent Office: 552 Days
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In embodiments of the present invention improved capabilities are described for the operation of a threat management facility, wherein the threat management facility may provide for a plurality of computer asset protection services to a corporate computer network. The threat management facility may provide a policy management service as one of the plurality of protection services, wherein the policy management service may be adapted to provide corporate policy updates to a plurality of computer facilities associated with the corporate computer network. In addition, the corporate policy updates, and a related corporate policy, may relate to the acceptability of an operation of a computer application.

Claims

1. A computer program product comprising non-transitory computer executable code embodied in a computer readable medium that, when executing on one or more computing devices, performs the steps of:

organizing a number of applications into a number of application types including at least a messaging category, an electronic mail category, a word processing category, a database category, and a browser category;

providing a policy management service for an enterprise network, the policy management service configured to provide protection services to one or more endpoints of the enterprise network by restricting usage of endpoint resources based on the number of application types and a connection type;

detecting an application executing on one of the endpoints;

identifying the connection type for the one of the endpoints;

determining one of the number of application types for the application by disassembling binary code of the application to recreate one or more functional blocks of the application and matching the one or more functional blocks to a phenotype representing one of the number of application types; and

applying the protection services to conditionally limit network access by the application on the endpoint based on the one of the number of application types and the connection type for the one of the endpoints.

2. A method comprising:

organizing a number of applications into a number of application types;

providing a policy management service for an enterprise network, the policy management service configured to provide protection services to one or more endpoints of the enterprise network;

detecting an application executing on one of the endpoints;

determining one of the number of application types for the application;

identifying a connection type for the endpoint; and

applying the protection services to conditionally restrict use of the application on the endpoint based on the one of the number of application types and the connection type for the endpoint.

3. The method of claim 2, wherein the number of application types includes at least one of a messaging category, an electronic mail category, and a browser category.

4. The method of claim 2, wherein the number of application types include at least one of a word processing category and a database category.

5. The method of claim 2, wherein identifying the connection type includes determining whether the connection type is a wired connection or a wireless connection.

6. The method of claim 2, wherein identifying the connection type includes determining whether the connection type is an out-of-enterprise connection or a within-enterprise connection.

7. The method of claim 2, wherein identifying the connection type includes determining whether the connection type is a virtual private network connection.

8. The method of claim 2, wherein applying the protection services includes conditionally limiting network access by the application.

9. The method of claim 2, wherein applying the protection services includes restricting access to external resources for the one of the endpoints.

10. The method of claim 2, wherein applying the protection services includes restricting access to internal functions of the one of the endpoints.

11. The method of claim 2, wherein applying the protection services includes blocking execution of the application.

12. The method of claim 2, wherein determining one of the number of application types for the application includes decompressing a file of the application.

13. The method of claim 2, wherein determining one of the number of application types for the application includes decrypting a file of the application.

14. The method of claim 2, wherein determining one of the number of application types for the application includes unpacking a file of the application.

15. The method of claim 2, wherein determining one of the number of application types for the application includes disassembling binary code of the application to recreate one or more functional blocks of the application and matching the one or more functional blocks to a phenotype representing one of the number of application types.

16. The method of claim 15, wherein the one or more functional blocks include one or more application programming interface calls and one or more string references.

17. The method of claim 15, wherein the one or more functional blocks illustrate a function and an execution flow for the application.

18. The method of claim 2, wherein the protection services are further configured to conditionally restrict use of the application on the one of the endpoints based on a user type for the one of the endpoints.

19. The method of claim 2, wherein applying the protection services includes applying the protection services from a threat management facility for the enterprise network.

20. A system comprising:

a threat management facility storing information in a database that organizes a number of applications into a number of application types, the threat management facility providing a policy management service including protection services for one or more endpoints of an enterprise network;

a data network; and

an endpoint coupled to the threat management facility through the data network the endpoint configured by computer executable code stored in a memory of the endpoint to perform the steps of detecting an application executing on the one of the endpoints, determining one of the number of application types for the application, and identifying a connection type for the endpoint, wherein the threat management facility is configured to conditionally restrict use of the application on the endpoint based on the one of the number of application types and the connection type for the endpoint.