Dynamic risk management

• US 20080189788A1
• Filed: 02/06/2007
• Published: 08/07/2008
• Est. Priority Date: 02/06/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bahl, Pradeep
• Granted Patent: US 7,908,660 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A dynamic risk management system for operating systems that provides monitoring, detection, assessment, and follow-up action to reduce the risk whenever it rises. The system enables an operating system to protect itself automatically in dynamic environments. The risk management system monitors a diverse set of attributes of the system which determines the security state of the system and is indicative of the risk the system is under. Based on a specification of risk levels for the various attributes and for their combinations, the risk management system determines whether one or more actions are required to alleviate the overall risk to the system.

Claims

1. A method of dynamic risk management for an operating system, comprising:

automatically assessing a security state of the operating system independent of security state changes;

determining a risk level according to the security state;

causing an action related to the operating system to be performed based on the risk level.

2. The method according to claim 1, further comprising:

detecting a change in the state of the operating system.

3. The method according to claim 1, wherein the action is caused to be performed if the risk level exceeds a predetermined threshold.

4. The method according to claim 1, wherein automatically assessing the security state includes monitoring a risk factor of the operating system.

5. The method according to claim 1, wherein automatically assessing the security state includes at least one of:

pushing a data inquiry to at least one component and pulling data from the at least one component.

6. The method according to claim 1, wherein the security state is automatically assessed periodically over a predefined time interval.

7. The method according to claim 1, wherein the operating system is coupled to a network.

8. The method according to claim 1, wherein the action caused to be performed includes an action of a type that is at least one of:

risk mitigation and risk remediation.

9. The method according to claim 1, wherein the action includes at least one of:

generating an alert;

activating a security measure;

restoring to an earlier state of the operating system;

terminating a network connection;

disabling a component;

disabling operation of at least a portion of software code;

initiating a software protection program.

10. The method according to claim 1, wherein the risk level is determined based on at least one risk factor identified in relation to the security state.

11. The method according to claim 10, wherein the risk level is determined based on a combination of at least two risk factors.

12. A computer readable medium having computer executable instructions for performing the steps recited in claim 1.

13. A system having at least one processor that performs the steps recited in claim 1.

14. A method of dynamic risk management for an operating system, comprising:

assessing a security state of the operating system;

automatically causing a tiered set of actions related to the security state of the operating system to be performed, wherein the tiered set of actions includes;

(i) determining a risk level based on at least one risk factor of the security state and (ii) causing a risk alleviation action related to the operating system to be performed based on the risk level.

15. The method according to claim 14, wherein the security state of the operating system is assessed synchronously with a change of state of the operating system.

16. The method according to claim 14, wherein the security state of the operating system is assessed asynchronously with a change of state of the operating system.

17. The method according to claim 14, wherein the risk level is determined based on a combination of at least two risk factors.

18. The method according to claim 14, wherein the risk alleviation action includes at least one of:

a risk mitigation action and a risk remediation action.

19. A computer readable medium having computer executable instructions for performing the steps recited in claim 14.

20. A system having at least one processor that performs the steps recited in claim 14.