Role-Based Control of Incident Response in a Secure Collaborative Environment

• US 20150235164A1
• Filed: 05/04/2015
• Published: 08/20/2015
• Est. Priority Date: 03/15/2013
• Status: Abandoned Application

• Current Assignee: Fortinet Inc.
• Original Assignee: Cybersponse, Inc. (Fortinet Inc.)
• Inventors: Key, William
• Application Number:
  US14/703,881
• Publication Number:
  US 20150235164A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06Q 10/063118 Staff planning in a project environment
• CPC Class Codes: G06Q 50/18 Legal services
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety

Abstract

Various systems and method for incident response may benefit from role-based control. More particularly, role-based control of incident response may be of benefit in a secure collaborative environment. A method can include determining, by a computer for a computer-controlled workflow, whether filtering is activated. The method can also include determining, by the computer when filtering is activated, whether a threshold severity level is met by the workflow or whether a critical data type is implemented in the workflow. The method can further include alerting, by the computer, an attorney about the workflow when the threshold is met or the critical data type is implemented.

Claims

1. A method, comprising:

determining, by a computer for a computer-controlled workflow, whether filtering is activated;

determining, by the computer when filtering is activated, whether a threshold severity level is met by the workflow or whether a critical data type is implemented in the workflow; and

alerting, by the computer, an attorney about the workflow when the threshold is met or the critical data type is implemented.

2. The method of claim 1, further comprising:

suspending, by the computer, the workflow until an attorney involvement type selection is made.

3. The method of claim 2, further comprising:

resuming, by the computer, the workflow upon the attorney involvement type selection being made; and

controlling, by the computer, the workflow in accordance with the attorney involvement type selection.

4. The method of claim 3, wherein control of the workflow in accordance with the attorney involvement type selection comprises routing at least a portion of communications of the workflow through the attorney or a person designated by the attorney.

5. The method of claim 3, wherein control of the workflow in accordance with the attorney involvement type selection comprises altering at least one of a content or a header of communications of the workflow based on the attorney involvement type selection.

6. The method of claim 1, further comprising:

detecting, by the computer, at least one keyword in an alert, incident report, or communication of the workflow;

halting, by the computer, the workflow when the at least one keyword is detected; and

alerting, by the computer when the filtering is not activated, the attorney about the workflow based on the detected at least one keyword.

7. An apparatus, comprising:

at least one processor; and

at least one memory including computer program code,

wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to

determine, for a computer-controlled workflow, whether filtering is activated;

determine, when filtering is activated, whether a threshold severity level is met by the workflow or whether a critical data type is implemented in the workflow; and

alert an attorney about the workflow when the threshold is met or the critical data type is implemented.

8. The apparatus of claim 7, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to

suspend the workflow until an attorney involvement type selection is made.

9. The apparatus of claim 8, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to

resume the workflow upon the attorney involvement type selection being made;

and

control the workflow in accordance with the attorney involvement type selection.

10. The apparatus of claim 9, wherein control of the workflow in accordance with the attorney involvement type selection comprises routing at least a portion of communications of the workflow through the attorney or a person designated by the attorney.

11. The apparatus of claim 9, wherein control of the workflow in accordance with the attorney involvement type selection comprises altering at least one of a content or a header of communications of the workflow based on the attorney involvement type selection.

12. The apparatus of claim 7, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to:

detect at least one keyword in an alert, incident report, or communication of the workflow;

halt the workflow when the at least one keyword is detected; and

alert, by the computer when the filtering is not activated, the attorney about the workflow based on the detected at least one keyword.

18. The non-transitory computer-readable medium of claim 11, further comprising:

detecting, by the computer, at least one keyword in an alert, incident report, or communication of the workflow;

halting, by the computer, the workflow when the at least one keyword is detected; and

alerting, by the computer when the filtering is not activated, the attorney about the workflow based on the detected at least one keyword.

13. A non-transitory computer-readable medium encoded with instructions that, when executed in hardware, perform a process, the process comprising:

determining, by a computer for a computer-controlled workflow, whether filtering is activated;

determining, by the computer when filtering is activated, whether a threshold severity level is met by the workflow or whether a critical data type is implemented in the workflow; and

alerting, by the computer, an attorney about the workflow when the threshold is met or the critical data type is implemented.

14. The non-transitory computer-readable medium of claim 13, further comprising:

suspending, by the computer, the workflow until an attorney involvement type selection is made.

15. The non-transitory computer-readable medium of claim 14, further comprising:

resuming, by the computer, the workflow upon the attorney involvement type selection being made; and

controlling, by the computer, the workflow in accordance with the attorney involvement type selection.

16. The non-transitory computer-readable medium of claim 15, wherein control of the workflow in accordance with the attorney involvement type selection comprises routing at least a portion of communications of the workflow through the attorney or a person designated by the attorney.

17. The non-transitory computer-readable medium of claim 15, wherein control of the workflow in accordance with the attorney involvement type selection comprises altering at least one of a content or a header of communications of the workflow based on the attorney involvement type selection.