ENDPOINT SECURITY IMPLEMENTATION

• US 20140380491A1
• Filed: 06/24/2013
• Published: 12/25/2014
• Est. Priority Date: 06/24/2013
• Status: Abandoned Application

• Current Assignee: GlobalFoundries, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Abuelsaad, Tamer E., Lingafelt, Steven Charles
• Application Number:
  US13/924,942
• Publication Number:
  US 20140380491A1
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method includes a computer detecting an element from a data flow for at least one endpoint device; the computer using the detected element and a protection engine to assess security requirements for the flow of data for the at least one endpoint device; and the computer causing the protection engine to issue additional security controls for the at least one endpoint device.

Claims

1. A method comprising:

a computer detecting an element from a data flow for at least one endpoint device;

the computer using the detected element and a protection engine to assess security requirements for the flow of data for the at least one endpoint device; and

the computer causing the protection engine to issue additional security controls for the at least one endpoint device.

2. The method of claim 1, wherein the data flow is being transmitted from the at least one endpoint device to a computer network.

3. The method of claim 1, wherein the data flow is received by the at least one endpoint device from a computer network.

4. The method of claim 1, wherein the protection engine uses data from an IP address database to determine the security controls.

5. The method of claim 1, wherein the protection engine uses data from a security business rules database to determine the security controls.

6. The method of claim 1, wherein the protection engine uses data from a system security posture database to determine the security controls.

7. The method of claim 1, wherein the data flow is between a storage device and the at least one endpoint device.

8. The method of claim 7, wherein the protection engine uses data from an owner database to determine the security controls.

9. A computer system comprising:

one or more processors, one or more computer-readable memories and one or more computer-readable, tangible storage devices;

a protection engine, operatively coupled to at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, configured to receive an element from a data flow for at least one endpoint device;

the protection engine, operatively coupled to at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, being further configured to determine security requirements for the flow of data for the at least one endpoint device based upon the received element; and

the protection engine, operatively coupled to at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, being yet further configured to issue additional security controls for the at least one endpoint device.

10. The system according to claim 9, wherein the protection engine uses data from an IP address database as part of the determination for the security requirements for the data flow.

11. The system according to claim 9, wherein the protection engine uses data from a security business rules database as part of the determination for the security requirements for the data flow.

12. The system according to claim 9, wherein the protection engine uses data from a system security posture database as part of the determination for the security requirements for the data flow.

13. The system according to claim 9, wherein the data flow is between a computer network and the at least one endpoint device.

14. The system according to claim 9, wherein the data flow is between a storage device and the at least one endpoint device.

15. The system according to claim 14, wherein the protection engine uses data from an owner database as part of the determination for the security requirements for the data flow.

16. A computer program product comprising:

one or more computer-readable, tangible storage medium;

program instructions, stored on at least one of the one or more storage medium, to detect an element from a data flow for at least one endpoint device;

program instructions, stored on at least one of the one or more storage medium, using the detected element and a protection engine to assess security requirements for the data flow; and

program instructions, stored on at least one of the one or more storage medium, causing the protection engine to issue additional security controls for the at least one endpoint device.

17. The computer program product according to claim 16, wherein the protection engine uses data from an IP address database to determine the security controls.

18. The computer program product according to claim 16, wherein the protection engine uses data from a security business rules database to determine the security controls.

19. The computer program product according to claim 16, wherein the protection engine uses data from a system security posture database to determine the security controls.

20. The computer program product according to claim 16, wherein the data flow is between a storage device and the at least one endpoint device.