Dynamic risk management

• US 8,595,844 B2
• Filed: 02/08/2011
• Issued: 11/26/2013
• Est. Priority Date: 02/06/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bahl, Pradeep
• Primary Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US13/023,518
• Publication Number:
  US 20110131658A1
• Time in Patent Office: 1,022 Days
• Field of Search: None
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A dynamic risk management system for operating systems that provides monitoring, detection, assessment, and follow-up action to reduce the risk whenever it rises. The system enables an operating system to protect itself automatically in dynamic environments. The risk management system monitors a diverse set of attributes of the system which determines the security state of the system and is indicative of the risk the system is under. Based on a specification of risk levels for the various attributes and for their combinations, the risk management system determines whether one or more actions are required to alleviate the overall risk to the system.

Claims

1. A method comprising determining a risk level R_New, where R_New=R_Current+Σ

rf_New−

Σ

rf_Old where R_Current is a current risk level, and where Σ

rf_New is a sum of scores assigned to one or more new risk factors, and where Σ

rf_Old is a sum of scores assigned to one or more old risk factors of R_Current that no longer apply, where the risk level R_New comprises ri_New−

ri_Old where ri_New is a new risk increment based on a combination of the new risk factors, and where ri_Old is an old risk increment based on a combination of the old risk factors, and where the method is performed by a computer.

2. The method of claim 1 further comprising determining that the risk level R_New exceeds a threshold.

3. The method of claim 2 further comprising, in response to the determining that the risk level R_New exceeds the threshold, causing at least one risk alleviation action to be performed, where the at least one risk alleviation action is selected from among two categories the include a first category that comprises risk mitigation actions and a second category that comprises risk remediation actions.

4. The method of claim 3 wherein the risk mitigation actions of the first category comprise generating a warning, putting a machine in a high security measure mode, terminating an application, terminating a communication, and putting the machine in a quarantine mode.

5. The method of claim 3 wherein the risk alleviation actions of the second category comprise providing a statement of health, updating software, scanning for viruses, activating filtering, and returning a machine to a previous state.

6. The method of claim 3 wherein the at least one risk alleviation action is selected based at least in part on policy.

7. At least one computer storage medium storing computer-readable instructions that, when executed by a computer, cause the computer to perform a method comprising determining a risk level R_New, where R_New=R_Current+Σ

rf_New−

Σ

rf_Old where R_Current is a current risk level, and where Σ

rf_New is a sum of scores assigned to one or more new risk factors, and where Σ

rf_Old is a sum of scores assigned to one or more old risk factors of R_Current that no longer apply, where the risk level R_New comprises ri_New−

ri_Old where ri_New is a new risk increment based on a combination of the new risk factors, and where ri_Old is an old risk increment based on a combination of the old risk factors.

8. The at least one computer storage medium of claim 7 further comprising determining that the risk level R_New exceeds a threshold.

9. The at least one computer storage medium of claim 8 further comprising, in response to the determining that the risk level R_New exceeds the threshold, causing at least one risk alleviation action to be performed, where the at least one risk alleviation action is selected from among two categories the include a first category that comprises risk mitigation actions and a second category that comprises risk remediation actions.

10. The at least one computer storage medium of claim 9 wherein the risk mitigation actions of the first category comprise generating a warning, putting a machine in a high security measure mode, terminating an application, terminating a communication, and putting the machine in a quarantine mode.

11. The at least one computer storage medium of claim 9 wherein the risk alleviation actions of the second category comprise providing a statement of health, updating software, scanning for viruses on the machine, activating filtering, and returning a machine to a previous state.

12. The at least one computer storage medium of claim 9 wherein the at least one risk alleviation action is selected based at least in part on policy.

13. A system comprising a computer including a risk manager configured for determining a risk level R_New, where R_New=R_Current+Σ

rf_New−

Σ

rf_Old where R_Current is a current risk level, and where Σ

rf_New is a sum of scores assigned to one or more new risk factors, and where Σ

rf_Old is a sum of scores assigned to one or more old risk factors of R_Current that no longer apply, where the risk level R_New comprises ri_New−

ri_Old where ri_New is a new risk increment based on a combination of the new risk factors, and where ri_Old is an old risk increment based on a combination of the old risk factors.

14. The system of claim 13 further comprising the risk manager further configured for determining that the risk level R_New exceeds a threshold.

15. The system of claim 14 further comprising the risk manager further configured for causing, in response to the determining that the risk level R_New exceeds the threshold, at least one risk alleviation action to be performed, where the at least one risk alleviation action is selected from among two categories the include a first category that comprises risk mitigation actions and a second category that comprises risk remediation actions.

16. The system of claim 15 wherein the risk mitigation actions of the first category comprise generating a warning, putting a machine in a high security measure mode, terminating an application, terminating a communication, and putting the machine in a quarantine mode.

17. The system of claim 15 wherein the risk alleviation actions of the second category comprise providing a statement of health regarding a machine, updating software, scanning for viruses, activating filtering, and returning a machine to a previous state.