System and method for policy management

• US 20070180490A1
• Filed: 07/01/2004
• Published: 08/02/2007
• Est. Priority Date: 05/20/2004
• Status: Abandoned Application

• Current Assignee: Allegent Technology Group, Inc. (Secured Services, Inc.)
• Original Assignee: Allegent Technology Group, Inc. (Secured Services, Inc.)
• Inventors: Prezioso, Adrian, Van Dusen, Dennis, Renzi, Silvio, Caro, Jeffrey, Renzi, Mauricio
• Application Number:
  US10/882,153
• Publication Number:
  US 20070180490A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The invention provides a system and method for providing policy-based protection services. As a new threat is understood, one or more protection techniques are considered for protecting the asset, the organization assigns responsibilities to carry out or protect the asset, and a policy is constructed. After the policy is developed a plan is put into action to protect the asset, and a policy implementer is developed and/or purchased, distributed, configured, and managed. Finally, the policy, its enforcement, and its effectiveness, are reviewed to determine any changes needed, and new requirements are discovered, closing the lifecycle.

Claims

1. A method for implementing policy objectives, comprising:

developing a policy implementer;

registering at least one system component; and

selling the policy implementer, the policy implementer enabling the policy objectives to be instantiated in the network.

2. The method of claim 1, wherein the developing includes:

registering a developer;

providing a developer with access to a software development kit;

receiving the policy implementer from the developer; and

certifying the policy implementer based on predetermined criteria.

3. The method of claim 2, further comprising warehousing the certified policy implementer prior to the selling.

4. The method of claim 1, wherein the registering includes:

deploying controller code to the at least one system component;

sending system component registration information from the controller code to a distribution engine;

preparing a configuration manifest in the distribution engine; and

providing the configuration manifest to the controller code.

5. The method of claim 1, wherein the selling includes:

presenting a policy implementer catalog to a user, the catalog organized by policy objectives;

receiving a policy implementer selection from the user based on the presented catalog;

presenting a list of named network portions to the user; and

receiving a selected set of named network portions from the user based on the presented list of named network portions.

6. The method of claim 5, further including calculating an applicability map to associate the policy implementer selection with corresponding ones of a plurality of framework components needed to protect the selected set of named network portions, the applicability map listing a set of policy implementer component/framework component pairs, the plurality of framework components residing on the at least one system component.

7. The method of claim 6, further including distributing each of a plurality of policy implementer components to corresponding ones of the plurality of framework components based on the applicability map.

8. The method of claim 7, the distributing having:

receiving a notification in a controller code, the controller code associated with one of the at least one of the system components;

requesting one of the plurality of policy implementer components from a distribution engine;

receiving the one of the plurality of policy implementer components using the controller code;

receiving a configuration for the one of the plurality of policy implementer components using the controller code; and

installing the one of the plurality of policy implementer components using the controller code.

9. The method of claim 8, the distributing further having sending a notification of installation from the controller code to the distribution engine.

10. The method of claim 8, wherein the receiving the notification includes receiving one of an installation notification, an update notification, and a notification of a change to the configuration for the one of the plurality of policy implementer components.

11. The method of claim 8, the distributing further having invoking the one of the plurality of policy implementer components.

12. The method of claim 1, wherein the policy implementer code includes at least one of an agent, a plug-in, a rule, a query, and a data item.

13. The method of claim 1, further comprising selling a framework component after the registering and before the selling of the policy component.

14. The method of claim 13, the selling of the framework component including:

presenting a framework component list to a user;

receiving a framework component selection from the user;

reading a selection of the at least one system component; and

customizing the framework component based on the receiving and the reading.

15. The method of claim 14, further including distributing the framework component to the at least one system component.

16. The method of claim 15, the distributing having:

receiving a framework component update notification in a controller code, the controller code associated with the at least one system component;

requesting framework component updates from the distribution engine;

receiving the framework component using the controller code;

receiving a configuration for the framework component using the controller code; and

installing the framework component using the controller code.

17. The method of claim 16, wherein the receiving the framework component notification includes receiving one of an installation notification, an update notification, and a notification of a change to the configuration of the framework component.

18. The method of claim 16, the distributing further having invoking the framework component.

19. The method of claim 1, wherein the policy implementer is associated with one of security administration policy, technical safeguards policy, asset management policy and connectivity requirements policy.

20. A method for rapid development of a policy implementer, comprising:

planning an implementation of a policy;

describing the implementation;

coding the implementation into the policy implementer; and

certifying the policy implementer.

21. The method of claim 20, wherein the planning, the describing, the coding, and the certifying are executed collaboratively.

22. A method for planning development of a policy implementer, comprising:

registering as a user on a developer Web site;

planning the development; and

accessing a plan submission tool from the developer Web site, the plan submission tool enabling the user to submit the plan to a repository.

23. A method for describing development of a policy implementer, comprising:

registering as a user on a developer Web site;

describing the development to produce a description; and

accessing a description submission tool from the developer Web site, the description submission tool enabling the user to submit the description to a repository.

24. A method for coding a policy implementer, comprising:

registering as a user on a developer Web site;

coding the policy implementer; and

accessing a code submission tool from the developer Web site, the code submission tool enabling the user to submit the code to a repository.

25. A method for policy-based accrediting of a system, comprising:

registering as a user on a Web site;

accrediting to produce an accreditation; and

accessing an accreditation submission tool from the Web site, the accreditation submission tool enabling the user to submit the accreditation to a repository.

26. A method for policy-based auditing of a system, comprising:

registering as a user on a Web site;

auditing to produce an audit; and

accessing an audit submission tool from the Web site, the audit submission tool enabling the user to submit the audit to a repository.

27. A system configured to instantiate policy objectives, the system comprising a framework, the framework configured to distribute a policy implementer and to collect data from the network.

28. The system of claim 27 wherein the framework includes:

an interface to at least one client subsystem; and

at least one distribution subsystem coupled to the interface, the at least one distribution subsystem configured to distribute controller code to the interface, the at least one distribution subsystem further configured to distribute at least one portion of the policy implementer to the controller code, the controller code configured to install the at least one portion of the policy implementer on the client subsystem.

29. The system of claim 27, wherein the policy implementer includes at least one of an agent, a plug-in, and a rule.

30. The system of claim 27, wherein the policy implementer is associated with one of security administration policy, technical safeguards policy, asset management policy and connectivity requirements policy.

31. The system of claim 28, wherein the at least one distribution subsystem includes:

a developer Web portal;

a code submission tool coupled to the developer Web portal; and

a code repository coupled to the developer Web portal;

wherein the developer Web portal is configured to provide access to the distribution subsystem by a developer, the code submission tool is configured to receive the policy implementer code from the developer, and the code repository is configured to store the policy implementer code.

32. The system of claim 31, wherein the at least one distribution subsystem further includes a policy implementer certification tool coupled to the Web portal, the policy implementer certification tool configured to certify the policy implementer code in response to a request from the developer.

33. The system of claim 31, wherein the at least one distribution subsystem further includes a developer e-commerce engine coupled to the Web portal, developer e-commerce engine configured to enable the sale of the policy implementer code by the developer.

34. The system of claim 28, wherein the at least one distribution subsystem includes:

a user Web portal;

a user-registration module coupled to the user Web portal; and

a user e-commerce engine coupled to the user Web portal, the user e-commerce engine configured to enable the sale of the policy implementer code to the user.

35. The system of claim 34, the user e-commerce engine configured to receive a policy implementer code selection from a user.

36. The system of claim 34, the user e-commerce engine configured to receive applicability information from the user, the applicability information indicating where portions of the policy implementer code will be placed within the client subsystem.

37. A method for managing a policy management lifecycle, comprising:

storing information content;

implementing a policy associated with the content; and

distributing the content.

38. The method of claim 37, wherein storing information content includes:

discovering a security requirement;

initiating a protection paradigm hypothesis;

organizing for protection and duty of care assignment; and

developing the policy.

39. The method of claim 37, wherein implementing a policy includes:

developing a policy implementer associated with the content; and

certifying the policy implementer.

40. The method of claim 37, wherein distributing the content includes:

selling a policy implementer;

distributing the policy implementer;

customizing the policy implementer;

configuring the policy implementer; and

operating the policy implementer.

41. A system for providing protection services, the system comprising a framework, wherein the framework is configured to perform at least one of analysis of data, collection of data, distribution, administration, and display of data based on a policy implementer construct.

42. The system of claim 41 wherein the framework is configured to perform analysis using pre-correlation, the pre-correlation having a focused filed-of-view to reduce the processing of data during a correlation.

43. The system of claim 41, the framework including a distribution system, the distribution system including at least one of a policy implementer component, license information, and data.

44. The system of claim 41, the framework including a distribution system, the distribution system including:

a parent distribution component; and

a child distribution component coupled to the parent distribution component, the child distribution component configured to receive one of a policy implementer component, license information, and data from the parent distribution component.

45. A method for developing policy-based protection services, comprising:

describing a policy requirement;

defining a generic policy implementer to address the policy requirement;

representing at least one of an asset, network, system, procedure, and a component with a named abstraction;

defining a required scope of protection for the named abstraction target; and

developing a specific policy implementer to collect a metric regarding the named abstraction.

46. The method of claim 45, further comprising:

naming a specific real element of at least one of a real asset, network, system, procedure, and component;

associating a named specific real element of at least one of a real asset, network, system, procedure, and component with the named abstraction; and

protecting the specific real element of at least one of a real asset, network, system, procedure, and component using the specific policy implementer.

47. The method of claim 46 further comprising:

initiating the protecting the specific real element of at least one of a real asset, network, system, procedure, and component by selecting the generic policy implementer for use; and

protecting the specific real element of at least one of a real asset, network, system, procedure, and component using the specific policy implementer.

48. The method of claim 46 further comprising:

developing a specific policy implementer to detect a policy breach for a named abstraction; and

protecting the specific real element of at least one of a real asset, network, system, procedure, and component using the specific policy implementer.

49. The method of claim 46 further comprising:

developing a specific policy implementer to configure a named abstraction; and

protecting the specific real element of at least one of a real asset, network, system, procedure, and component using the specific policy implementer.

50. The method of claim 46 further comprising:

developing a specific policy implementer to manage a named abstraction; and

protecting the specific real element of at least one of a real asset, network, system, procedure, and component using the specific policy implementer.

51. The method of claim 46 further comprising:

developing a specific policy implementer to detect a vulnerability of a named abstraction; and

protecting the specific real element of at least one of a real asset, network, system, procedure, and component using the specific policy implementer.

52. A method for providing policy-based protection services to a customer, comprising:

providing a framework; and

providing at least one policy implementer, the at least one policy implementer associated with security policy, the framework configured to distribute and manage the at least one policy implementer.

53. The method of claim 52, the providing the framework including providing a license to the customer to use a framework component external to a customer network.

54. The method of claim 52, the providing the framework including providing remote management of a customer network.

55. The method of claim 52, the providing the framework including providing a framework component to the customer for use under a license on a customer network.

56. The method of claim 52, the providing the framework including providing an automatic update to the framework based on a term of a license for a component of the framework.

57. The method of claim 52, the providing the at least one policy implementer including providing a plurality of the least one policy implementer in a group to the customer, the group being associated with a predetermined price.

58. The method of claim 52, the providing the at least one policy implementer including providing an automatic update to the at least one policy implementer based on a term of a license for the at least one policy implementer.

59. The method of claim 52, the providing the at least one policy implementer including providing the at least one policy implementer to the customer, each of the at least one policy implementer being individually priced.

60. The method of claim 52, wherein providing the at least one policy implementer is based on a customer-selected set of policy elements and a customer-selected resource, the resource to be protected according to the customer-selected set of policy elements.

61. The method of claim 60, further comprising providing an insurance component to the customer.

62. A method for sharing policy-based analysis, comprising:

identifying at least one of a threat, a vulnerability, and a deficiency in a policy to produce a policy requirement;

analyzing the policy requirement to produce at least one of a new policy element and revised policy element; and

sharing the at least one of a new policy element and revised policy element.

63. The method of claim 62, further comprising sharing the analysis of the policy requirement.

64. The method of claim 62, further comprising sharing the policy requirement.

65. The method of claim 62, wherein at least one of the identifying, the analyzing, and the sharing are motivated by an incentive plan.

66. A system configured to share policy-based analysis, comprising:

a policy library configured to contain policy descriptions and policy element descriptions; and

a policy implementer catalog linked to the policy library, the policy implementer catalog containing protections for the policy elements described in the policy library.

67. The system of claim 66, further comprising a user interface, the user interface coupled to the policy library and the policy implementer, the user-interface being configured to provide role-based access control.

68. A method for managing a collaborative development process, comprising:

providing a developer exchange Website;

registering a developer on the exchange Website; and

providing a policy implementer submission tool via the exchange Website.

69. The method of claim 68 wherein providing the policy implementer submission tool includes providing a workflow manager.

70. The method of claim 68 further comprising providing a user account for compensating a developer of a policy implementer.

71. A developer exchange Website, comprising:

a registration module configured to register at least one of a policy implementer planner, a policy implementer describer, a policy implementer developer, and a policy implementer certifier;

a policy implementer submission module; and

a workflow module configured to manage the development of a policy implementer.

72. The Website of claim 71, further comprising an accounting module configured to manage a compensation account for the at least one of the policy implementer planner, the policy implementer describer, the policy implementer developer, and the policy implementer certifier.

73. The Website of claim 71, further comprising a tool download utility, the tool download utility configured to download at least one of an agent developer kit, a plug-in developer kit, and a policy implementer developer kit.

74. The Website of claim 71, further comprising a requirement module configured to inform the at least one of the policy implementer planner, the policy implementer describer, the policy implementer developer, and the policy implementer certifier regarding requirements for a new policy implementer.

75. The Website of claim 71, further comprising a feedback module configured to inform the at least one of the policy implementer planner, the policy implementer describer, the policy implementer developer, and the policy implementer certifier regarding changes that are needed to an existing policy implementer.

76. A method for protection procurement, comprising:

viewing a list of policy implementers for a selected policy element; and

selecting for purchase at least one policy implementer from the list of policy implementers.

77. The method of claim 76, further comprising:

prior to viewing the list of policy implementers, viewing a list of policies;

selecting a policy from the list of policies;

viewing a list of policy elements associated with the selected policy; and

selecting the policy element from the list of policy elements.

78. The method of claim 76, further comprising distributing the at least one policy implementer automatically to initiate protection.

79. A system configured to manage a procurement process, comprising:

a procurement module configured to present a list of policy implementers to a buyer, the procurement module further configured to receive from a buyer a selection of a policy implementer from the list of policy implementers;

a distribution module coupled to the procurement module, the distribution module configured to install the selected policy implementer.

80. The system of claim 79, the distribution module configured to distribute at least one of a policy implementer component, a license information, and configuration data.

81. The system of claim 80, the distribution module configured to distribute at least one of a policy implementer component, a license information, and configuration data to a selected portion of a framework.

82. The system of claim 79, wherein the distribution is configured to customize the selected policy implementer, configure the selected policy implementer, and initiate the operation of the selected policy implementer.

83. A method for maintaining protection components, comprising:

providing an incentive program for developing a new policy implementer;

providing a rapid development process to produce the new policy implementer; and

distributing the new policy implementer to a target system.

84. The method of claim 83, further comprising communicating feedback associated with the new policy implementer to a developer.

85. The method of claim 83, further comprising communicating a list of functional requirements to a developer.

86. The method of claim 83, wherein the new policy implementer is a revision of an old policy implementer.

87. A method for managing an assurance process, comprising:

for each component of a target system, automatically preparing a report of status, a level of protection, and a currency metric by policy element and by policy in response to a user request.

88. An assurance system, comprising:

a database configured to store at least one policy implementer association for each protected component of a protected system, the database further configured to store a description of each of the at least one policy implementer, the database further configured to associate each of the at least one policy implementer with a policy element; and

a report generation module coupled to the database, the report generation module configured to report a status, level of protection and currency in a format acceptable for at least one of policy management, enforcement, auditing and accreditation.

89. The assurance system of claim 88, further comprising a Website, the Website configured to provide roles-based access to the assurance system to at least one of a auditor, an accreditor, and a user executive.

90. A method for improving a policy, comprising:

providing a community-based incentive program for improving the policy;

providing a policy description system

providing a policy element description system;

providing a policy implementer requirement description system; and

providing community access to the policy description system and the policy element description system, and the policy implementer requirement description system.

91. The method of claim 90, wherein the policy is one of an asset management policy, a configuration management policy, a network management policy, a security policy, a service level policy, and a quality policy.

92. A system configured to provide policy-based protection services to a customer, comprising:

a distribution engine;

an event manager coupled to the distribution engine;

and an interface to a customer system, the interface coupled to the distribution engine and the event manager, the distribution engine configured to distribute a framework component and a policy implementer component, the interface configured to collect data from the customer system, the event manager configured to store and aggregate the collected data.

93. The system of claim 92, the system configured to analyze the collected data.

94. The system of claim 92, the system configured to identify breaches of a policy element.

95. The system of claim 92, the system configured to issue a command to a controller based on the need for an update of at least one of the framework component and the policy implementer component.

96. The system of claim 92, the system configured to issue a command to a controller to, the command indicating what type of data to collect.

97. The system of claim 92, the system configured to issue a command to a controller to, the command indicating what data to report.

98. The system of claim 92, the system configured to issue a command to a controller to, the command indicating how to analyze the collected data.

99. The system of claim 92, the system configured to issue a command to a controller to, the command indicating when to collect data.

100. The system of claim 92, the system configured to issue a command to a controller to, the command indicating how to adjust a topology of the framework.

101. A method for implementing policy-based objectives in a target system, comprising:

distributing a first policy implementer in the target system; and

later distributing a second policy implementer in the target system.

102. The method of claim 101, wherein the first policy implementer is associated with a first policy element and the second policy implementer is associated with a second policy element.

103. The method of claim 101, wherein the first policy implementer is associated with a first policy element and the second policy implementer is associated with the first policy element, the second policy implementer being an improved version of the first policy implementer, the second policy implementer based on at least one of a new requirement in the first policy element, additional policy implementer development resources, protecting component of the protection system, and target component of the target system.

104. The method of claim 103, further comprising developing the second policy implementer before the distributing of the second policy implementer, the developing including:

constraining the developing such that the second policy implementer is marginally different from the first policy implementer;

reusing the first policy implementer to develop the second policy implementer to limit at least one of development cost, cost of sales, a buyer'"'"'s procurement cost, and a buyer'"'"'s adoption cost; and

utilizing a disciplined development methodology; and

exploiting a billet associated with the first policy implementer to reduce distribution cost.

105. The method of claim 104, wherein the distributing the second policy implementer includes utilizing a billet associated with the first policy implementer to reduce a configuration and an administration cost.

106. A method for alerting in a protection system, comprising:

receiving data indicating a breach of policy from at least one of a first target system, a first protection system, and a third-party; and

reporting the breach of policy according to a predetermined role-based responsibility associated with at least one of the first target system, a second target system, the first protection system, and a second protection system.

107. A method for alerting in a protection system, comprising:

receiving results from one of a certification review, an audit review, and an accreditation review; and

assigning the results according to a predetermined role-based responsibility associated with at least one of the target system, the protection system, and a developer community.

108. The method of claim 107, further comprising storing the results in a library after the receiving of the results.

109. A method for policy-based certification of a system, comprising:

registering a certifier as a user on a Web site;

certifying a policy implementer to produce a certification report; and

accessing a certification submission tool from the Web site, the certification submission tool enabling the user to submit the certification report to a repository.

110. A method for providing policy-based protection, comprising:

receiving data;

categorizing the data to associate the data with one of a predetermined plurality of categories;

responding to the data based on the one of the predetermined plurality of categories, the data including at least one of event data and policy breach data; and

reporting based on the categorizing.

111. The method of claim 110, the categorizing according to at least one of policy, policy element, policy implementer, event source, event reporter, framework part, framework tier, event manager, breach type, vulnerability, organization, responsibility, timeframe, asset, asset group, response status, and criticality.