System, method, and computer program product for isolating a device associated with at least potential data leakage activity, based on user support

• US 9,262,630 B2
• Filed: 09/14/2012
• Issued: 02/16/2016
• Est. Priority Date: 08/29/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sankararaman, Srinivasan, Kolingivadi, Deepakeswaran
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): SHIU, HO T
• Application Number:
  US13/618,312
• Publication Number:
  US 20140090072A1
• Time in Patent Office: 1,250 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system, method, and computer program product are provided for isolating a device associated with at least potential data leakage activity, based on user input. In operation, at least potential data leakage activity associated with a device is identified. Furthermore, at least one action is performed to isolate the device, based on user input received utilizing a user interface.

Claims

1. A non-transitory machine readable medium, on which are stored instructions, comprising instructions that when executed cause one or more programmable devices to:

receive by a first computer system a first notification from a third computer, the first notification received over a network and indicating that a potential data leakage activity on a second computer has been detected by the third computer;

generate a user prompt on the first computer system in response to receiving the first notification from the third computer, wherein the user prompt comprises a plurality of choices for responding to the potential data leakage activity by isolating the second computer, wherein at least one of the plurality of choices is received from the third computer in the first notification, and wherein the plurality of choices includes a least two of the plurality of choices of disabling the second computer, disabling an account associated with the second computer, quarantining the second computer, and locking the second computer;

receive a user input after generating the user prompt, the user input indicating a response to the potential data leakage activity intended to isolate the second computer; and

attempt to isolate the second computer based on the user input,

wherein the first computer system, the second computer, and the third computer are separate devices.

2. The machine readable medium of claim 1, wherein the first computer system comprises a plurality of physical computers.

3. The machine readable medium of claim 1, wherein the first computer system is a mobile computing device.

4. A computer-implemented method, comprising:

receiving by a first computer system a first notification from a third computer regarding a second computer, the first notification received over a network and indicating that the second computer is vulnerable to data leakage;

generating a user prompt on the first computer system after receiving the first notification from the third computer, wherein the user prompt comprises a plurality of choices for responding to the indication that the second computer is vulnerable to data leakage, at least one choice involving isolating the second computer, wherein at least one of the plurality of choices is received from the third computer in the first notification, and wherein the plurality of choices includes a least two of the plurality of choices of disabling the second computer, disabling an account associated with the second computer, quarantining the second computer, and locking the second computer;

receiving a user input after generating the user prompt, the user input received upon a user interface comprising the user prompt, wherein the user input indicates a response to the indication that the second computer is vulnerable to data leakage intended to isolate the second computer; and

attempting to isolate the second computer based on the user input,

wherein the first computer system, the second computer, and the third computer are separate devices.

5. The method of claim 4, wherein the first computer system comprises a mobile device.

6. The method of claim 5, wherein the mobile device is mobile phone.

7. The method of claim 5, wherein the mobile device is a personal digital assistant.

8. A system comprising:

a mobile portable computing device adapted to receive network communication;

a display integral with the mobile portable computing device and adapted to provide a user interface upon the display;

a user prompt generated within the user interface of the mobile portable computing device, the user prompt generated in response to a first notification from a third computer by network communication;

the first notification from the third computer comprising an indication that a second computer is vulnerable to data leakage;

the user prompt comprising a plurality of options for responding to the indication that the second computer is vulnerable to data leakage, at least one option associated with an action intended to isolate the second computer, wherein at least one of the plurality of options is received from the third computer in the first notification, and wherein the plurality of options includes a least two of the plurality of options of disabling the second computer, disabling an account associated with the second computer, quarantining the second computer, and locking the second computer; and

the user interface having the capability to receive a user selection indicating an action intended to isolate the second computer.

9. The system of claim 8, wherein the mobile portable computing device is a mobile phone.

10. The system of claim 8, wherein the mobile portable computing device is a personal digital assistant.