Method and apparatus for creating an information security policy based on a pre-configured template

• US 20050086252A1
• Filed: 07/15/2004
• Published: 04/21/2005
• Est. Priority Date: 09/18/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Jones, Chris, Rowney, Kevin T., Bothwell, Eric
• Granted Patent: US 8,225,371 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

A method and apparatus for creating a policy based on a pre-configured template is described. In one embodiment, source data having a tabular structure is identified. Further, one of multiple policy templates is used to automatically create a policy for detecting information from any one or more rows within the tabular structure of the source data.

Claims

1. A method comprising:

identifying source data having a tabular structure; and

using one of a plurality of policy templates to automatically create a policy for detecting information from any one or more rows of the tabular structure of the source data in messages.

2. The method of claim 1 further comprising:

receiving data identifying user selection of the one of the plurality of policy templates.

3. The method of claim 1 further comprising:

receiving data identifying user selection of the source data having the tabular structure.

4. The method of claim 1 wherein each of the plurality of policy templates is defined based on a corresponding regulation.

5. The method of claim 1 wherein one of the plurality of policy templates contains a plurality of rules.

6. The method of claim 5 wherein:

one of the plurality of rules specifies a set of inclusion columns from the tabular data structure; and

the policy is created to detect in messages information from the set of inclusion columns within any single row of the tabular structure.

7. The method of claim 5 wherein:

one of the plurality of rules specifies one or more exclusion columns from the tabular data structure; and

the policy is created to detect in messages information from any single row of the tabular structure, the detected information excluding data from the one or more exclusion columns.

8. The method of claim 6 wherein:

the one of the plurality of rules further specifies a minimum number of inclusion columns from the set; and

the policy is created to detect in messages information from at least the minimum number of inclusion columns within any single row of the tabular structure.

9. The method of claim 8 wherein using one of the plurality of policy templates to automatically create the policy comprises:

comparing the set of inclusion columns specified in the one of the plurality of rules with columns of the tabular structure of the source data;

determining that at least one column from the set is missing from the tabular structure of the source; and

removing the at least one missing column from the set specified in the one of the plurality of rules.

10. The method of claim 9 further comprising:

determining that all columns are removed from the set specified in the one of the plurality of rules; and

removing the one of the plurality of rules from the policy.

11. The method of claim 9 further comprising:

determining that a number of columns remained in the set is less than the minimum number of inclusion columns that is specified in the one of the plurality of rules; and

removing the one of the plurality of rules from the policy.

12. The method of claim 9 further comprising:

determining that a number of columns remained in the set is less than the minimum number of inclusion columns that is specified in the one of the plurality of rules; and

updating the minimum number of inclusion columns that is specified in the one of the plurality of rules with the number of columns remained in the set.

13. The method of claim 6 wherein:

the one of the plurality of rules further specifies a minimum number of rows; and

the policy is created to detect in messages data from the set of inclusion columns within at least the minimum number of rows of the tabular structure.

14. The method of claim 5 wherein:

one of the plurality of rules specifies an expression pattern; and

the policy is created to detect the expression pattern in messages.

15. The method of claim 5 wherein:

one of the plurality of rules specifies one or more keywords; and

the policy is created to detect in messages the one or more keywords.

16. The method of claim 5 wherein:

one of the plurality of rules specifies an attachment type; and

the policy is created to detect messages containing attachments of the attachment type.

17. The method of claim 5 wherein:

one of the plurality of rules specifies an attachment size; and

the policy is created to detect messages containing attachments with size exceeding the attachment size.

18. The method of claim 5 wherein:

one of the plurality of rules specifies sender identifying information; and

the policy is created to detect messages with senders matching the sender identifying information.

19. The method of claim 5 wherein:

one of the plurality of rules specifies recipient identifying information; and

the policy is created to detect messages with recipients matching the recipient identifying information.

20. The method of claim 1 further comprising:

maintaining the plurality of policy templates in a data store;

receiving a new version of one of the plurality of templates over a network; and

replacing the one of the plurality of templates with the new version.

21. The method of claim 1 wherein the source data includes content of a plurality of sources, content of each of the plurality of sources having a tabular structure.

22. A system comprising:

a template data store to store a plurality of templates; and

a policy specifier to identify source data having a tabular structure, and to use one of the plurality of policy templates to automatically create a policy for detecting information from any one or more rows of the tabular structure of the source data in messages.

23. The system of claim 22 further comprising:

a user interface to receive data identifying user selection of the one of the plurality of policy templates.

24. The system of claim 22 further comprising:

a user interface to receive data identifying user selection of the source data having the tabular structure.

25. The system of claim 22 wherein each of the plurality of policy templates is defined based on a corresponding regulation.

26. The system of claim 22 wherein one of the plurality of policy templates contains a plurality of rules.

27. The system of claim 26 wherein:

one of the plurality of rules specifies a set of inclusion columns from the tabular data structure; and

the policy is created to detect in messages information from the set of inclusion columns within any single row of the tabular structure.

28. The system of claim 26 wherein:

one of the plurality of rules specifies one or more exclusion columns from the tabular data structure; and

the policy is created to detect in messages information from any single row of the tabular structure, the detected information excluding data from the one or more exclusion columns.

29. The system of claim 27 wherein:

the one of the plurality of rules further specifies a minimum number of inclusion columns from the set; and

the policy is created to detect in messages information from at least the minimum number of inclusion columns within any single row of the tabular structure.

30. The system of claim 29 wherein the policy specifier is to create the policy by comparing the set of inclusion columns specified in the one of the plurality of rules with columns of the tabular structure of the source data, determining that at least one column from the set is missing from the tabular structure of the source, and removing the at least one missing column from the set specified in the one of the plurality of rules.

31. The system of claim 30 wherein the policy specifier is further to determine that all columns are removed from the set specified in the one of the plurality of rules, and to remove the one of the plurality of rules from the policy.

32. The system of claim 30 wherein the policy specifier is further to determine that a number of columns remained in the set is less than the minimum number of inclusion columns that is specified in the one of the plurality of rules, and to remove the one of the plurality of rules from the policy.

33. The system of claim 30 wherein the policy specifier is further to determine that a number of columns remained in the set is less than the minimum number of inclusion columns that is specified in the one of the plurality of rules, and to update the minimum number of inclusion columns that is specified in the one of the plurality of rules with the number of columns remained in the set.

34. The system of claim 27 wherein:

the one of the plurality of rules further specifies a minimum number of rows; and

the policy is created to detect in messages data from the set of inclusion columns within at least the minimum number of rows of the tabular structure.

35. The system of claim 22 wherein the policy specifier is further to receive a new version of one of the plurality of templates over a network, and to replace the one of the plurality of templates with the new version.

36. The system of claim 22 wherein the source data includes content of a plurality of sources, content of each of the plurality of sources having a tabular structure.

37. An apparatus comprising:

means for identifying source data having a tabular structure; and

means for automatically creating, based on one of a plurality of policy templates, a policy for detecting information from any one or more rows of the tabular structure of the source data in messages.

38. A computer readable medium that provides instructions, which when executed on a processor cause the processor to perform a method comprising:

identifying source data having a tabular structure; and

using one of a plurality of policy templates to automatically create a policy for detecting information from any one or more rows of the tabular structure of the source data in messages.