DYNAMIC RISK MANAGEMENT

• US 20110131658A1
• Filed: 02/08/2011
• Published: 06/02/2011
• Est. Priority Date: 02/06/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bahl, Pradeep
• Granted Patent: US 8,595,844 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A dynamic risk management system for operating systems that provides monitoring, detection, assessment, and follow-up action to reduce the risk whenever it rises. The system enables an operating system to protect itself automatically in dynamic environments. The risk management system monitors a diverse set of attributes of the system which determines the security state of the system and is indicative of the risk the system is under. Based on a specification of risk levels for the various attributes and for their combinations, the risk management system determines whether one or more actions are required to alleviate the overall risk to the system.

Claims

1. A method comprising determining, by a computer, a risk level R_New, wherein R_New=R_Current+Σ

rf_New−

Σ

rf_Old where R_Current is a current risk level, and where Σ

rf_New is a sum of scores assigned to one or more new risk factors, and where Σ

rf_Old is a sum of scores assigned to one or more old risk factors of R_Current that no longer apply.

2. The method of claim 1 further comprising determining that the risk level R_New exceeds a threshold of a plurality of thresholds, wherein each of the plurality of thresholds indicates a level of risk that is different than each other level of risk.

3. The method of claim 2 further comprising, in response to the determining that the risk level R_New exceeds the threshold, causing at least one risk alleviation action to be performed, wherein the at least one risk alleviation action is selected from among two categories the include a first category that comprises risk mitigation actions and a second category that comprises risk remediation actions.

4. The method of claim 3 wherein the risk mitigation actions of the first category comprise generating a warning, putting a machine in a high security measure mode, terminating a high risk application, terminating communication with another device, and putting the machine in a quarantine mode.

5. The method of claim 3 wherein the risk alleviation actions of the second category comprise providing a statement of health regarding a machine, updating software of the machine, scanning for and cleaning any viruses on the machine, activating filtering, and returning the machine to a previous known good state.

6. The method of claim 3 wherein the at least one risk alleviation action is selected based at least in part on policy.

7. The method of claim 1 wherein the risk level R_New further comprises ri_New−

ri_Old where ri_New is a new risk increment based on a combination of the new risk factors, and where ri_Old is an old risk increment based on a combination of the old risk factors.

8. At least one computer storage medium storing computer-readable instructions that, when executed by a computer, cause the computer to perform a method comprising determining a risk level R_New, wherein R_New=R_Current+Σ

rf_New−

Σ

rf_Old where R_Current is a current risk level, and where Σ

rf_New is a sum of scores assigned to one or more new risk factors, and where Σ

rf_Old is a sum of scores assigned to one or more old risk factors of R_Current that no longer apply.

9. The at least one computer storage medium of claim 8 further comprising determining that the risk level R_New exceeds a threshold of a plurality of thresholds, wherein each of the plurality of thresholds indicates a level of risk that is different than each other level of risk.

10. The at least one computer storage medium of claim 9 further comprising, in response to the determining that the risk level R_New exceeds the threshold, causing at least one risk alleviation action to be performed, wherein the at least one risk alleviation action is selected from among two categories the include a first category that comprises risk mitigation actions and a second category that comprises risk remediation actions.

11. The at least one computer storage medium of claim 10 wherein the risk mitigation actions of the first category comprise generating a warning, putting a machine in a high security measure mode, terminating a high risk application, terminating communication with another device, and putting the machine in a quarantine mode.

12. The at least one computer storage medium of claim 10 wherein the risk alleviation actions of the second category comprise providing a statement of health regarding a machine, updating software of the machine, scanning for and cleaning any viruses on the machine, activating filtering, and returning the machine to a previous known good state.

13. The at least one computer storage medium of claim 10 wherein the at least one risk alleviation action is selected based at least in part on policy.

14. The at least one computer storage medium of claim 8 wherein the risk level R_New further comprises ri_New−

ri_Old where ri_New is a new risk increment based on a combination of the new risk factors, and where ri_Old is an old risk increment based on a combination of the old risk factors.

15. A system comprising a risk manager of a computer, the risk manager configured for determining a risk level R_New, wherein R_New=R_Current+Σ

rf_New−

Σ

rf_Old where R_Current is a current risk level, and where Σ

rf_New is a sum of scores assigned to one or more new risk factors, and where Σ

rf_Old is a sum of scores assigned to one or more old risk factors of R_Current that no longer apply.

16. The system of claim 15 further comprising the risk manager further configured for determining that the risk level R_New exceeds a threshold of a plurality of thresholds, wherein each of the plurality of thresholds indicates a level of risk that is different than each other level of risk.

17. The system of claim 16 further comprising the risk manager further configured for causing, in response to the determining that the risk level R_New exceeds the threshold, at least one risk alleviation action to be performed, wherein the at least one risk alleviation action is selected from among two categories the include a first category that comprises risk mitigation actions and a second category that comprises risk remediation actions.

18. The system of claim 17 wherein the risk mitigation actions of the first category comprise generating a warning, putting a machine in a high security measure mode, terminating a high risk application, terminating communication with another device, and putting the machine in a quarantine mode.

19. The system of claim 17 wherein the risk alleviation actions of the second category comprise providing a statement of health regarding a machine, updating software of the machine, scanning for and cleaning any viruses on the machine, activating filtering, and returning the machine to a previous known good state.

20. The system of claim 15 wherein the risk level R_New further comprises ri_New−

ri_Old where ri_New is a new risk increment based on a combination of the new risk factors, and where ri_Old is an old risk increment based on a combination of the old risk factors.