In-context security advisor in a computing environment

• US 20040250107A1
• Filed: 06/05/2003
• Published: 12/09/2004
• Est. Priority Date: 06/05/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Guo, Bei-Jing
• Granted Patent: US 7,437,763 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

Provided is an in-context security advisor that unifies computer system security, and generally improves computer system security by proactively and reactively monitoring for changes to security settings made by users and programs. By operating in real time, advice comprising meaningful feedback is given for any intrusion, thus giving a user the proper context about the consequences of changes to security settings that negatively affect the level of protection on computer systems, and allowing automated correction. Files can also be monitored, e.g., to prevent certain files from being remotely accessed or transmitted. The security advisor may adjust its operation based on user preferences, policy information, and via a connection to a remote source such as a backend server. The security advisor can also output security-related information, such as to a log and/or to components that evaluate the overall health of the machine.

Claims

1. In a computing environment, a system comprising:

a plurality of sources of security-related information; and

a security service, the security service configured to monitor in real time the security-related information of the plurality of sources, and to perform actions to protect the computer system based on the security-related information.

2. The system of claim 1 further comprising a user interface, wherein one of the actions performed by the security system is to provide advice to a user of the computer system via the user interface.

3. The method of claim 2 wherein one of the actions performed by the security system is to receive an instruction from the user of the computer system via the user interface in conjunction with the advice.

4. The system of claim 1 wherein one of the actions is automatically performed by the security system.

5. The system of claim 1 further comprising a reactive processor component coupled to the security advisor that obtains information about a change to a security setting after the security setting has been changed.

6. The system of claim 5 wherein at least one of the sources comprises a log file filter that watches a log file for security setting changes, and when the log file indicates that a security setting has been changed, provides information about the change to the reactive processor component.

7. The system of claim 6 wherein the log file is written to by an antivirus engine.

8. The system of claim 6 wherein the log file is written to by a firewall engine.

9. The system of claim 6 wherein the log file is written to by an intrusion detection engine.

10. The system of claim 5 wherein at least one of the sources comprises a registry filter and monitor that watches a registry for security-related changes, and when a security-related setting in the registry has been changed, provides information about the change to the reactive processor component.

11. The system of claim 10 wherein the security-related setting in the registry is changed by a user-initiated event.

12. The system of claim 10 wherein the security-related setting in the registry is changed by a program-initiated event.

13. The system of claim 5 further comprising a unified interface, wherein the reactive processor component is coupled to the security advisor via the unified interface.

14. The system of claim 1 wherein at least one of the sources comprises a file monitor that detects an access-related request to a specified file and prevents access to that specified file.

15. The method of claim 14 wherein the file monitor detects the access-related request access based on a file identifier.

16. The method of claim 14 wherein the file monitor detects the access-related request access based on a file name.

17. The method of claim 14 wherein the file monitor detects the access-related request access based on a file signature.

18. The method of claim 14 wherein the file monitor detects the access-related request access based on a file attribute.

19. The method of claim 14 wherein the file monitor comprises a filter driver.

20. The system of claim 1 further comprising a proactive processor component coupled to the security advisor that detects a requested change to a security setting before a change to the security setting has occurred.

21. The system of claim 20 wherein the proactive processor component watches for requested changes to an operating system setting.

22. The system of claim 20 wherein the proactive processor component watches for requested changes to an internet security setting.

23. The system of claim 20 wherein at least one of the sources comprises a file filter and monitor that watches for file-related request to at least one protected file, and a file-related request to a protected file is detected, provides information about the request to the reactive processor component.

24. The system of claim 20 wherein the proactive processor component watches for requested changes by hooking a windows message.

25. The system of claim 20 wherein the proactive processor component watches for requested changes by subscribing for events.

26. The system of claim 20 wherein the requested change is requested by a user-initiated event.

27. The system of claim 20 wherein the requested change is requested by a program-initiated event.

28. The system of claim 20 further comprising a unified interface, wherein the proactive processor component is coupled to the security advisor via the unified interface.

29. The system of claim 20 wherein the proactive processor component watches for requested changes to an application program setting.

30. The system of claim 1 wherein the security advisor is further configured to receive updates from a remote source.

31. The system of claim 1 wherein the security advisor is further configured to access policy information that alters at least one operation of the security advisor.

32. The system of claim 1 wherein the security advisor is further configured to access preference data to determine how to operate based on the security-related information.

33. The system of claim 32 wherein the preference data comprises user preference data.

34. The system of claim 32 wherein the preference data comprises action preference data.

35. The system of claim 34 wherein the action preference data indicates that a change that was made should be undone.

36. The system of claim 34 wherein the action preference data indicates that a change that is requested should be prevented.

37. The system of claim 34 wherein the action preference data indicates that data should be output to a user.

38. The system of claim 37 wherein the data output to the user comprises a prompt via which an instruction from the user may be received.

39. The system of claim 1 wherein the security advisor is further configured to output data to a log.

40. The system of claim 1 wherein the security advisor is further configured to output data corresponding to a security risk score.

41. In a computing environment, a method comprising:

obtaining information from one of a plurality of sources, the information related to a change to a security setting;

accessing user preference information to determine whether the information should be acted upon; and

if the user preference information indicates that the change should be acted upon, accessing action preference data to determine an action to take with respect to the information.

42. The method of claim 41 wherein the information indicates that a change to a security setting is being requested, wherein the action preference data indicates that the change should be prevented, and further comprising, blocking the change.

43. The method of claim 41 wherein the information indicates that a change to a security setting has been made, wherein the action preference data indicates that the change should be undone, and further comprising, undoing the change.

44. The method of claim 41 wherein the information indicates that a change to a security setting is being requested, and wherein the action preference data indicates that the user should be notified about the requested change.

45. The method of claim 44 further comprising, notifying the user about the change.

46. The method of claim 41 further comprising, logging data corresponding to the information related to the change.

47. The method of claim 41 further comprising monitoring a log to obtain the information related to the change.

48. The method of claim 41 further comprising monitoring settings to obtain the information related to the change.

49. The method of claim 41 further comprising monitoring messages to obtain the information related to the change.

50. The method of claim 41 further comprising subscribing for an event to obtain the information related to the change.

51. The method of claim 41 further comprising accessing policy data.

52. The method of claim 41 further comprising communicating with a remote source to obtain updates.

53. The method of claim 41 further comprising outputting risk information corresponding to at least one level of security in the computing environment.

54. The method of claim 41 wherein the preference information indicates that the information should be acted upon, wherein accessing action preference data indicates that the user wants a notification, and further comprising, providing a notification to the user.

55. The method of claim 54 further comprising receiving an instruction from the user and acting upon the instruction.

56. A computer-readable medium having computer-executable instructions for performing the method of claim 41.

57. In a computing environment, a method comprising:

detecting information from one of a plurality of sources, the information related to a change to a security setting;

outputting data to a user interface corresponding to a notification of the change to the security setting;

receiving an instruction via the user interface; and

taking an action with respect to the security setting based on the instruction.

58. The method of claim 57 wherein the information related to a change to a security setting indicates that a change has been requested, wherein outputting data comprises making a recommendation with respect to preventing the change, and wherein taking an action comprises preventing the change.

59. The method of claim 57 wherein the information related to a change to a security setting indicates that a change has been made, wherein outputting data comprises making a recommendation with respect to undoing the change, and wherein taking an action comprises undoing the change.

60. A computer-readable medium having computer-executable instructions for performing the method of claim 57.

61. In a computing system, a system comprising:

means for obtaining information from one of a plurality of sources, the information related to a change to a security setting;

means for accessing user preference information to determine whether the information should be acted upon; and

means for accessing action preference data to determine an action to take with respect to the information.