Critical period protection

• US 7,600,259 B2
• Filed: 06/08/2005
• Issued: 10/06/2009
• Est. Priority Date: 06/08/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Qi, Fei
• Primary Examiner(s): Cervetti; David Garcia
• Application Number:
  US11/148,965
• Publication Number:
  US 20060282896A1
• Time in Patent Office: 1,581 Days
• Field of Search: 713/166, 726/22, 726/23, 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect

Abstract

Systems and methods for protecting a computer during a period of increased vulnerability. In one implementation, a method for protecting a computer is provided. The method includes monitoring a computing device having an first security state for one or more events indicating a time period of increased vulnerability. The method includes adjusting one or more security policies in response to the one or more events to generate a second security state. The method also includes identifying an end of the time of increased vulnerability, and restoring the computing to the first security state. In one implementation, the computer is an embedded device.

Claims

1. A method, comprising:

monitoring a computing device having a first security state for one or more events indicating a time period of increased vulnerability, the one or more events comprising receiving an update file from a remote server for installation on the computing device;

adjusting one or more security policies in response to the one or more events to initiate a second security state comprising restricting network access from network sources other than the remote server;

identifying an end of the time period of increased vulnerability comprising identifying a message from the computing device to the remote server that the update file has been installed; and

initiating a third security state.

2. The method of claim 1, the third security state and the first security state being a same security state.

3. The method of claim 1, further comprising:

verifying changes to the computing device during the time period of increased vulnerability.

4. The method of claim 1, the monitoring further comprising:

monitoring a behavior of one or more applications.

5. The method of claim 1, the monitoring further comprising:

monitoring a behavior of an enhanced write filter.

6. The method of claim 1, the monitoring further comprising:

monitoring input traffic over a network.

7. The method of claim 1, the monitoring further comprising:

monitoring one or more registry entries.

8. The method of claim 1, the adjusting further comprising:

initiating a virus scan of the computing device memory.

9. The method of claim 1, the adjusting further comprising:

disabling unnecessary devices coupled to the computing device.

10. The method of claim 1, the monitoring further comprising:

monitoring a plurality of computing devices for one or more events indicating a time period of increased vulnerability.

11. A security device, comprising:

a processor;

a memory coupled to the processor;

a monitoring engine operable to monitor a computing device for events indicating a time period of increased vulnerability, the events comprising receiving an update file from a remote server for installation on the computing device;

a security engine operable to execute one or more security policies including different security policies for different states of the computing device, wherein one of the states comprises restricting network access from network sources other than the remote server;

the monitoring engine further operable to identify an end of the time period of increased vulnerability comprising identifying a message from the computing device to the remote server that the update file has been installed; and

a policy module operable to store the one or more security policies.

12. The security device of claim 11, further comprising:

a verification engine operable to verify one or more changes to the computing device during the time period of increased vulnerability.

13. The security device of claim 11, the monitoring engine further comprising:

an application behavior monitor; and

a network monitor.

14. The security device of claim 11, the monitoring engine operable to monitor one or more of a network traffic, a behavior of an application, a file modification, and a registry entry change.

15. The security device of claim 11, wherein the computing device is an embedded device.

16. The security device of claim 11, the security engine operable to dynamically adjust one or more security policies in response to a triggering condition.

17. An embedded device, comprising:

a security device, comprising;

a processor;

a memory coupled to the processor;

a monitoring engine operable to monitor the embedded device for events indicating a time period of increased system vulnerability, the events comprising receiving an update file from a remote server for installation on the computing device;

a security engine operable to execute one or more security policies including different security policies for different states of the computing device, wherein one of the states comprises restricting network access from network sources other than the remote server;

the monitoring engine further operable to identify an end of the time period of increased vulnerability comprising identifying a message from the computing device to the remote server that the update file has been installed; and

an enhanced write filter operable to write data to an overlay, the events further comprising disabling the enhanced write filter.

18. A computer program product, tangibly stored on a computer-readable storage medium, comprising instructions operable to cause a programmable processor to:

monitor a computing device having a first security state for one or more events indicating a time period of increased vulnerability, the one or more events comprising receiving an update file from a remote server for installation on the computing device;

adjust one or more security policies in response to the one or more events to initiate a second security state comprising restricting network access from network sources other than the remote server;

identify an end of the time period of increased vulnerability comprising identifying a message from the computing device to the remote server that the update file has been installed; and

initiate a third security state.