NETWORK POLICY MANAGEMENT AND EFFECTIVENESS SYSTEM

• US 20110093914A1
• Filed: 10/27/2010
• Published: 04/21/2011
• Est. Priority Date: 06/25/1998
• Status: Active Grant

• Current Assignee: Longhorn HD LLC (Alpha Alpha Intellectual Partners LLC)
• Original Assignee: Yaszistra Fund III LLC (Intellectual Ventures LLC)
• Inventors: Jacobson, Andrea M.
• Granted Patent: US 8,381,305 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The present disclosure relates to a method and apparatus for maintaining policy compliance on a computer network. A system in accordance with some embodiments disclosed herein performs the steps of electronically monitoring network user compliance with a network security policy stored in a database, electronically evaluating network security policy compliance based on network user compliance and electronically undertaking a network policy compliance action in response to network security policy non-compliance. The network policy compliance actions may include automatically implementing a different network security policy selected from network security policies stored in the database, generating policy effectiveness reports and providing a retraining module to network users.

Claims

1. An apparatus for managing a network compliance policy in a computer network, the apparatus comprising a computer system including at least one processor and at least one memory, wherein the computer system is configured and arranged for:

storing a set of network compliance policy parameters on a database, the database being coupled to the computer network;

monitoring a plurality of electronic transactions from at least one user accessing the computer network;

comparing each of the plurality of electronic transactions with the set of network compliance policy parameters;

preparing a network compliance policy violation report in response to one of the plurality of electronic transactions matching one of the network compliance policy parameters;

filing the network policy compliance violation report;

conducting an appeals process in response to a request from the at least one user;

establishing an appeal report, the appeal report being based on the appeals process; and

taking action on the at least one user based on the network policy compliance violation report and the appeal report.

2. The apparatus of claim 1, wherein the set of network compliance policy parameters comprises parameters related to ethical, business and personnel parameters.

3. The apparatus of claim 2, wherein the ethical, business and personnel parameters comprise:

network hardware parameters;

electronic mail parameters;

Internet parameters;

software parameters;

document management parameters; and

network security parameters.

4. The apparatus of claim 2, further comprising providing a means for updating the set of network compliance policy parameters.

5. The apparatus of claim 4, wherein the means for updating comprises:

periodically reviewing the set of network compliance policy parameters;

determining the viability of each of the network compliance policy parameters; and

adjusting the set of network compliance policy parameters based on the determination of viability.

6. The apparatus of claim 1, wherein the set of network compliance policy parameters is generated by the steps of:

providing a preliminary set of network compliance policy parameters;

receiving a modified set of network compliance policy parameters from one of the users;

providing the modified set of network compliance policy parameters to each of the users; and

receiving the network compliance policy parameters.

7. The apparatus of claim 1, wherein the electronic transactions includes transactions using network hardware.

8. The apparatus of claim 1, wherein the electronic transactions includes electronic mail messages.

9. The apparatus of claim 1, wherein the electronic transactions include Internet activities.

10. The apparatus of claim 1, wherein the electronic transactions includes transactions using network software.

11. The apparatus of claim 1, wherein the electronic transactions includes network security activities.

12. The apparatus of claim 1, wherein the appeals process further comprises:

transmitting the network compliance policy violation report to the at least one user;

receiving an appear request from the user;

determining whether a network compliance policy parameter was violated; and

recommending a course of action based on the determination.

13. The apparatus of claim 1, wherein the network policy compliance violation report for one of the users is added to a list of network policy compliance violation reports of that user.

14. The apparatus of claim 13, further comprising taking action on that user based on the network policy compliance violation report, the appeal report and the list of network policy compliance violation reports of that user.

15. The apparatus of claim 1, wherein a preliminary set of network compliance policy parameters is based on the network policy compliance violation report.

16. The apparatus of claim 1, wherein a preliminary set of network compliance policy parameters is based on the appeal report.

17. The apparatus of claim 1, wherein the computer system is further configured and arranged for, prior to conducting the appeals process:

distributing a notification to the at least one user to respond to the filing of the network policy compliance violation report by providing confirmation of the at least one user'"'"'s attendance at a meeting to review network policies relating to the network compliance policy parameters;

receiving confirmation of the at least one user'"'"'s attendance at the meeting; and

storing the confirmation of the at least one user'"'"'s attendance at the meeting.

18. An article of manufacture for managing a network compliance policy in a computer network, the article of manufacture comprising a non-transitory computer-readable storage medium having a computer program embodied therein that causes at least one network device in the computer network to perform operations comprising:

storing a set of network compliance policy parameters on a database, the database being coupled to the computer network;

monitoring a plurality of electronic transactions from at least one user accessing the computer network;

comparing each of the plurality of electronic transactions with the set of network compliance policy parameters;

preparing a network compliance policy violation report in response to one of the plurality of electronic transactions matching one of the network compliance policy parameters;

filing the network policy compliance violation report;

conducting an appeals process in response to a request from the at least one user;

establishing an appeal report, the appeal report being based on the appeals process; and

taking action on the at least one user based on the network policy compliance violation report and the appeal report.

19. An apparatus for managing a network compliance policy in a computer network comprising:

means for storing a set of network compliance policy parameters on a database, the database being coupled to the computer network;

means for monitoring a plurality of electronic transactions from at least one user accessing the computer network;

means for comparing each of the plurality of electronic transactions with the set of network compliance policy parameters;

means for preparing a network compliance policy violation report in response to one of the plurality of electronic transactions matches one of the network compliance policy parameters;

means for filing the network policy compliance violation report;

means for conducting an appeals process in response to a request from the at least one user;

means for establishing an appeal report, the appeal report being based on the appeals process; and

means for taking action on the at least one user based on the network policy compliance violation report and the appeal report.

20. A method of initiating a training session in a computer network comprising:

receiving user input from a first participant, the user input including a selection of one of a plurality of screen personalities available for a training session;

recording the selected screen personality in a database;

presenting the first participant with a virtual training room for the particular training session, the virtual training room configured to accommodate a plurality of participants for the particular training session and to represent each of the plurality of participants using a corresponding screen personality;

presenting a virtual facilitator in the virtual training room to the plurality of participants, the virtual facilitator configured to explain rules associated with the particular training session; and

generating a network policy by presenting a suggested policy to the plurality of participants and collecting network policy recommendations regarding the suggested policy from the plurality of participants.

21. The method of claim 20, further comprising presenting one or both of a licensing agreement and a privacy agreement to the first participant prior to receiving the user input including the selection of the one of the plurality of screen personalities.

22. The method of claim 20, wherein at least one of the plurality of participants is a virtual participant.

23. An apparatus for initiating a training session in a computer network, the apparatus comprising a computer system including at least one processor and at least one memory, wherein the computer system is configured and arranged for:

receiving user input from a first participant, the user input including a selection of one of a plurality of screen personalities available for a training session;

recording the selected screen personality in a database;

presenting the first participant with a virtual training room for the particular training session, the virtual training room configured to accommodate a plurality of participants for the particular training session and to represent each of the plurality of participants using a corresponding screen personality;

presenting a virtual facilitator in the virtual training room to the plurality of participants, the virtual facilitator configured to explain rules associated with the particular training session; and

generating a network policy by presenting a suggested policy to the plurality of participants and collecting network policy recommendations regarding the suggested policy from the plurality of participants.

24. An article of manufacture for initiating a training session in a computer network, the article of manufacture comprising a non-transitory computer-readable storage medium having a computer program embodied therein that causes at least one network device in the computer network to perform operations comprising:

receiving user input from a first participant, the user input including a selection of one of a plurality of screen personalities available for a training session;

recording the selected screen personality in a database;

presenting the first participant with a virtual training room for the particular training session, the virtual training room configured to accommodate a plurality of participants for the particular training session and to represent each of the plurality of participants using a corresponding screen personality;

presenting a virtual facilitator in the virtual training room to the plurality of participants, the virtual facilitator configured to explain rules associated with the particular training session; and

generating a network policy by presenting a suggested policy to the plurality of participants and collecting network policy recommendations regarding the suggested policy from the plurality of participants.

25. An apparatus for initiating a training session in a computer network comprising:

means for receiving user input from a first participant, the user input including a selection of one of a plurality of screen personalities available for a training session;

means for recording the selected screen personality in a database;

means for presenting the first participant with a virtual training room for the particular training session, the virtual training room configured to accommodate a plurality of participants for the particular training session and to represent each of the plurality of participants using a corresponding screen personality;

means for presenting a virtual facilitator in the virtual training room to the plurality of participants, the virtual facilitator configured to explain rules associated with the particular training session; and

means for generating a network policy by presenting a suggested policy to the plurality of participants and collecting network policy recommendations regarding the suggested policy from the plurality of participants.