Policy-based selection of remediation

• US 8,984,586 B2
• Filed: 01/11/2014
• Issued: 03/17/2015
• Est. Priority Date: 09/03/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Bezilla, Daniel B., Immordino, John L., Ogura, James Le
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US14/153,017
• Publication Number:
  US 20140130120A1
• Time in Patent Office: 430 Days
• Field of Search: None
• US Class Current: 726/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for remediating a security policy violation on a computer system are provided. According to one embodiment, an agent running on an endpoint system collects information regarding a program-code-based operational state of the endpoint system. The agent transmits the information to a remote computer system via a network coupling the endpoint system and the remote computer system in communication. The remote computer system enforces one or more security policies with respect to the endpoint system based on the received information.

Claims

1. A method comprising:

collecting, by an agent running on an endpoint system, information regarding a program-code-based operational state of the endpoint system;

transmitting, by the agent, the information to a remote computer system via a network coupling the endpoint system and the remote computer system in communication;

determining whether the program-code-based operational state of the endpoint system represents a violation of the one or more security policies by evaluating, by the remote computer system, the received information with respect to the one or more security policies, wherein each security policy of the one or more security policies defines at least one parameter condition violation of which is potentially indicative of unauthorized activity on the endpoint system or manipulation of the endpoint system; and

enforcing one or more security policies, by the remote computer system, with respect to the endpoint system based on the received information.

2. The method of claim 1, further comprising when a result of the determining is affirmative, then causing, by the remote computer system, the endpoint system to perform one or more remediation actions.

3. The method of claim 1, further comprising when a result of the determining is affirmative, then causing, by the remote computer system, one or more selected remediations to be deployed to the endpoint system based on the violation.

4. The method of claim 1, further comprising when a result of the determining is affirmative, then causing, by the remote computer system, one or more actions or operations to be carried out on the endpoint system.

5. The method of claim 3, wherein the one or more actions or operations at least in part implement a precautionary measure to improve reliability, availability or survivability of the endpoint system.

6. The method of claim 3, wherein the one or more actions or operations are suited to remediating circumstances of the violation.

7. The method of claim 2, further comprising maintaining, by the remote computer system, a policy database having stored therein a plurality of security policies, including the one or more security policies.

8. The method of claim 7, further comprising maintaining, by the remote computer system, a remediation database having stored therein information regarding a plurality of remediation actions including the one or more remediation actions.

9. The method of claim 1, wherein the violation relates to existence or non-existence of a particular application on the endpoint system.

10. The method of claim 1, wherein the violation is based at least in part on a version of a particular application on the endpoint system.

11. The method of claim 1, wherein the violation is based at least in part on whether a patch associated with a particular application has been installed on the endpoint system.

12. The method of claim 1, wherein the violation is based at least in part on a version of an operating system or a type of the operating system running on the endpoint system.

13. The method of claim 1, wherein the violation relates to whether a particular process is running on the endpoint system.