PRE-EMPTIVE PRE-INDEXING OF SENSITIVE AND VULNERABLE ASSETS

• US 20090288141A1
• Filed: 05/19/2008
• Published: 11/19/2009
• Est. Priority Date: 05/19/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Khachaturov, Vassilii
• Granted Patent: US 8,800,043 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A system and method for identifying sensitive content or indications of vulnerabilities is provided. A local search engine may index content at a data center. Specifications of sensitive data or fingerprints of vulnerabilities may be received from various internal or external sources. Targeted data may include vulnerable software, confidential content, dynamic or static web pages, or application data. Based on searches for targeted data, one or more components may be notified, enabling one or more security actions, including restricting publication of the targeted data.

Claims

1. A system for identifying targeted content at a data center, comprising:

a) a local indexing component configured to perform actions including creating an index of content at the data center; and

b) a manager component configured to perform actions including;

receiving one or more search specifications;

employing the index and the one or more search specifications to identify the targeted content at the data center; and

enabling a mechanism that performs a security action on the targeted content.

2. They system of claim 1, the manager component further configured to receive specifications of fingerprints of at least one vulnerability and wherein identifying the targeted content includes identifying at least a portion of the content that includes the fingerprints based on the received fingerprint specifications.

3. The system of claim 1, wherein the one or more search specifications comprises specifications of confidential content, and the targeted content comprises confidential content corresponding to the specifications of confidential content.

4. The system of claim 1, wherein receiving the one or more search specifications comprises receiving at least one search specification of a fingerprint of a vulnerability from an external source and receiving at least one search specification of confidential content.

5. The system of claim 1, wherein the one or more search specifications comprises specifications of confidential content and at least one specification of a fingerprint of a vulnerability, and the targeted content comprises confidential content and a portion of content that matches the fingerprint.

6. The system of claim 1, wherein the manager component provides an interface to enable a local client to search the content at the data center.

7. The system of claim 1, enabling the mechanism that restricts access comprising notifying a security component of the identity of the targeted content.

8. A method for restricting targeted content at a data center, comprising:

a) creating an index of content at the data center;

b) retrieving a plurality of specifications of the targeted content;

c) employing the plurality of specifications to search the index of content for the targeted content; and

d) selectively performing at least one security action based on a result of the search of the index.

9. The method of claim 8, the at least one security action including at least one of restricting publication of the targeted content, preventing an external crawler from retrieving the targeted content, or restricting access to the targeted content to a privileged group of users.

10. The method of claim 8, wherein indexing the content comprises:

a) retrieving application content from an application server;

b) retrieving a plurality of static documents and a plurality of dynamic documents from a web server; and

c) including data representative of the application content, the plurality of static documents, and the plurality of dynamic documents in the index.

11. The method of claim 8, wherein retrieving the plurality of specifications of the targeted content comprises receiving a plurality of specifications of vulnerable content and receiving a plurality of specifications of confidential content.

12. The method of claim 8, further comprising publishing the content at the data center to at least one external client prior to retrieving the plurality of specifications and searching the index of content for the targeted content.

13. The method of claim 8, further comprising providing an interface that enables a local client to retrieve information descriptive of sensitive content and information descriptive of a vulnerability at the data center.

14. A system for distributing content of a data center, comprising:

a) an indexing component configured to perform actions including creating an index of the content at the data center; and

b) identification means for employing the index of the content to identify targeted content; and

c) publishing means for publishing a proper subset of the content at the data center, the proper subset based on the identified targeted content.

15. The system of claim 14, further comprising an API that enables a local client to search the index of content for a content item.

16. The system of claim 14, the identification means comprising a search specification repository that stores search specifications corresponding to at least one fingerprint of at least one software vulnerability and search specifications corresponding to confidential content.

17. The system of claim 14, the publishing means comprising a component that selectively enables content to be sent to an external network based on the identification of the targeted content.

18. The system of claim 14, the publishing means restricting external distribution of content that has previously been published based on the identification of the targeted content.

19. The system of claim 14, the identification means comprising a component that receives fingerprints of publicly known software vulnerabilities, receives fingerprints of zero-day vulnerabilities, and receives specifications of confidential content.

20. The system of claim 14, further comprising an interface means for enabling a local client to retrieve the targeted content.