Methods and systems for enabling community-tested security features for legacy applications

• US 8,713,687 B2
• Filed: 12/17/2008
• Issued: 04/29/2014
• Est. Priority Date: 12/17/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sobel, William E., Satish, Sourabh
• Primary Examiner(s): CHAO, MICHAEL W
• Application Number:
  US12/336,668
• Publication Number:
  US 20100154027A1
• Time in Patent Office: 1,959 Days
• Field of Search: 726/1, 726/22, 726/25, 726/26
• US Class Current: 726/26
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/126 Interacting with the operating system
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer-implemented method for enabling community-tested security features for legacy applications may include: 1) identifying a plurality of client systems, 2) identifying a legacy application on a client system within the plurality of client systems, 3) identifying a security-feature-enablement rule for the legacy application, 4) enabling at least one security feature for the legacy application by executing the security-feature-enablement rule, 5) determining the impact of the security-feature-enablement rule on the health of the legacy application, and then 6) relaying the impact of the security-feature-enablement rule on the health of the legacy application to a server. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for enabling community-tested security features for legacy applications, the method comprising:

identifying a legacy application that has yet to be updated to take advantage of at least one existing security feature provided by an operating system on which the legacy application is installed;

identifying a security-feature-enablement rule provided for the legacy application by a security vendor;

executing the security-feature-enablement rule provided by the security vendor to update the legacy application to take advantage of the existing security feature provided by the operating system, wherein executing the security-feature-enablement rule comprises injecting an instruction into the legacy application'"'"'s code that calls the existing security feature provided by the operating system;

automatically determining, using at least one module provided by the security vendor, health-impact information that identifies the impact of the security-feature-enablement rule on the health of the legacy application by;

performing a first health evaluation prior to executing the security-feature-enablement rule;

after executing the security-feature-enablement rule, performing a second health evaluation;

relaying the health-impact information that identifies the impact of the security-feature-enablement rule on the health of the legacy application to a server provided by the security vendor;

receiving an instruction from the server to disable the security-feature-enablement rule for the legacy application in response to a determination, based on the health-impact information, that the security-feature-enablement rule is likely to decrease at least one of performance and stability of the legacy application.

2. The method of claim 1, wherein identifying the security-feature-enablement rule comprises receiving the security-feature-enablement rule from the server.

3. The method of claim 1, wherein automatically determining the health-impact information that identifies the impact of the security-feature-enablement rule on the health of the legacy application comprises using the module provided by the security vendor

to compare the second health evaluation with the first health evaluation to determine how the security-feature-enablement rule impacted the health of the legacy application.

4. The method of claim 1, further comprising, prior to identifying the security-feature-enablement rule, identifying a request from a user of the operating system to opt in to early testing of security-feature-enablement rules.

5. The method of claim 1, further comprising transmitting a list to the server that identifies each legacy application on the operating system.

6. The method of claim 1, wherein the security-feature-enablement rule comprises a particular combination of security-feature-enablement rules.

7. The method of claim 1, further comprising:

disabling the security-feature-enablement rule for the legacy application.

8. The method of claim 1, wherein executing the security-feature-enablement rule comprises:

identifying startup of the legacy application;

retrieving a security configuration for the legacy application;

enabling the existing security feature in the security configuration, as specified by the security-feature-enablement rule.

9. A computer-implemented method for enabling community-tested security features for legacy applications, the method comprising:

identifying a plurality of client systems;

identifying a subset of the plurality of client systems that is designated to test security features for at least one legacy application that has yet to be updated to take advantage of at least one existing security feature provided by an operating system on which the legacy application is installed;

transmitting a security-feature-enablement rule provided for the legacy application by a security vendor to at least one client system in the subset, wherein the security-feature-enablement rule injects an instruction into the legacy application'"'"'s code that calls the existing security feature provided by the operating system;

receiving, from the client system in the subset, automatically generated health-impact information that identifies the impact of the security-feature-enablement rule on the health of the legacy application on the client system, the health-impact information comprising;

a first health evaluation performed prior to executing the security-feature-enablement rule;

a second health evaluation performed after executing the security-feature-enablement rule;

determining, based on the automatically generated health-impact information, whether to roll out the security-feature-enablement rule to the plurality of client systems;

transmitting an instruction to disable the security-feature-enablement rule for the legacy application in response to a determination, based on the health-impact information, that the security-feature-enablement rule is likely to decrease at least one of performance and stability of the legacy application.

10. The method of claim 9, further comprising:

determining that the security-feature-enablement rule did not negatively impact the health of the legacy application;

initiating a staged roll-out of the security-feature-enablement rule to the plurality of client systems.

11. The method of claim 10, further comprising:

receiving, from at least one additional client system within the plurality of client systems, automatically generated health-impact information for the security-feature-enablement rule;

determining that the security-feature-enablement rule negatively impacted the health of the legacy application on the additional client system;

aborting the staged roll-out of the security-feature-enablement rule.

12. The method of claim 10, wherein initiating the staged roll-out comprises increasing distribution of the security-feature-enablement rule by increments in multiple stages until the distribution encompasses the plurality of client systems.

13. The method of claim 9, wherein the security-feature-enablement rule comprises a particular combination of security-feature-enablement rules.

14. The method of claim 9, wherein the automatically generated health-impact information comprises:

a performance index containing results for at least one performance metric;

a stability index containing results for at least one stability metric.

15. A system for enabling community-tested security features for legacy applications, the system comprising at least one central processing unit configured to execute a client module programmed to:

identify a legacy application that has yet to be updated to take advantage of at least one existing security feature provided by an operating system on which the legacy application is installed;

identify a security-feature-enablement rule provided for the legacy application by a security vendor;

execute the security-feature-enablement rule provided by the security vendor to update the legacy application to take advantage of the existing security feature provided by the operating system, wherein executing the security-feature-enablement rule comprises injecting an instruction into the legacy application'"'"'s code that calls the existing security feature provided by the operating system;

automatically determine health-impact information that identifies the impact of the security-feature-enablement rule on the health of the legacy application by;

performing a first health evaluation prior to executing the security-feature-enablement rule;

after executing the security-feature-enablement rule, performing a second health evaluation;

relay the health-impact information that identifies the impact of the security-feature-enablement rule on the health of the legacy application to a server provided by the security vendor;

receive an instruction from the server to disable the security-feature-enablement rule for the legacy application in response to a determination, based on the health-impact information, that the security-feature-enablement rule is likely to decrease at least one of performance and stability of the legacy application.

16. The system of claim 15, further comprising a server module programmed to:

identify a plurality of client systems;

identify a subset of the plurality of client systems that is designated to test security features for legacy applications;

transmit the security-feature-enablement rule to at least one client system in the subset;

receive, from the client system in the subset, the automatically determined health-impact information that identifies the impact of the security-feature-enablement rule on the health of the legacy application on the client system;

determine, based on the automatically determined health-impact information, whether to roll out the security-feature-enablement rule to the plurality of client systems.

17. The system of claim 16, wherein the server module is further programmed to:

determine that the security-feature-enablement rule did not negatively impact the health of the legacy application;

initiate a staged roll-out of the security-feature-enablement rule to the plurality of client systems.

18. The system of claim 17, wherein the server module is further programmed to:

receive, from at least one additional client system within the plurality of client systems, automatically generated health-impact information for the security-feature-enablement rule;

determine that the security-feature-enablement rule negatively impacted the health of the legacy application on the additional client system;

abort the staged roll-out of the security-feature-enablement rule.

19. The system of claim 17, wherein the staged roll-out comprises increasing distribution of the security-feature-enablement rule by increments in multiple stages until the distribution encompasses the plurality of client systems.

20. The system of claim 15, wherein the security-feature-enablement rule comprises a particular combination of security-feature-enablement rules.