Method and System for Creating a Record for One or More Computer Security Incidents

• US 20080016569A1
• Filed: 07/13/2007
• Published: 01/17/2008
• Est. Priority Date: 10/10/2000
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: Internet Security Systems Incorporated (International Business Machines Corporation)
• Inventors: Ge, Rixin, Burke, Charles, Hammer, John, Hubbard, Charles
• Granted Patent: US 9,027,121 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action

Abstract

A security management system can log, investigate, respond, and track computer security incidents that can occur in a networked computer system. In other words, the security management system can produce a security record of information related to the tracking of suspicious computer activity or actual computer security threats, such as denial of service attacks or other similar compromises to computers or computer networks. The security record can include, but is not limited to, date and times of computer security incidents, a name for a particular security incident, a security management system user, and a potential source of the computer security incident. The security record can be designed as a running log that saves or records all activity of a computer incident source as well as the activity of the security team responding to the computer incident source. To produce the security record, all data that relates to a computer incident and all data that relates to a computer incident response can be sent to a separate protected database, where data is protected by digital signature algorithms (DSAs).

Claims

1-65. -65. (canceled)

66. A computer program product for creating a permanent record of one or more computer security incidents, said computer program product comprising:

a computer readable medium;

first program instructions to record computer security incident information and a respective date stamp or time stamp, the computer security incident information indicating one of suspicious computer activity comprising one or more attacks received from a network computer that occur prior to a computer security threat and an actual computer security threat;

second program instructions to automatically identify one or more computer security threat procedures corresponding to a classification of the computer security incident information, each of said computer security threat procedures comprising one or more steps for one of investigating and responding to the computer security incident information;

third program instructions to generate a display of said one or more computer security threat procedures;

fourth program instructions to receive a selection from a user of one of said computer security threat procedures and one or more steps of the selected computer security threat procedure; and

fifth program instructions to generate and output a permanent, unmodifiable record comprising the computer security incident information, results of execution of the selected one or more steps of the selected computer security threat procedure, an identity of the user who selected the computer security threat procedure, and the date stamp and time stamp for the computer security incident information; and

wherein said first, second, third, fourth and fifth program instructions are stored on said medium.

67. The computer program product of claim 66, further comprising program instructions to classify the computer security incident information.

68. The computer program product of claim 66, further comprising program instructions to execute the one or more steps of the selected computer security threat procedure and recording executed computer security threat procedure information in the permanent, unmodifiable record.

69. The computer program product of claim 66, further comprising program instructions to record the results of the executed computer security threat procedure with a digital signature to enable detection of any attempted modification of the permanent, unmodifiable record, whereby integrity of the record can be monitored.

70. The computer program product of claim 66, wherein the fourth program instructions comprise instructions to automatically select a computer security threat procedure.

71. The computer program product of claim 66, wherein the results of the selected executed computer security threat procedure comprise at least one of text, numbers, images, or formatted documents.

72. The computer program product of claim 66, further comprising program instructions to predict future actions of a source of a computer security incident.

73. The computer program product of claim 66, further comprising program instructions to identify an appropriate computer to execute a step in a computer security threat procedure.

74. A computer program product for creating a permanent record of one or more computer security incidents, said computer program product comprising:

a computer readable medium;

first program instructions to record computer security incident information and a respective date stamp or time stamp, the computer security incident information indicating one of suspicious computer activity comprising one or more attacks received from a network computer that occur prior to a computer security threat and an actual computer security threat;

second program instructions to automatically identify one or more computer security threat procedures corresponding to a classification of the computer security incident information, each of said computer security threat procedures comprising one or more steps for one of investigating and responding to the computer security incident information;

third program instructions to generate a display of said one or more computer security threat procedures;

fourth program instructions to receive a selection from a user of one of said computer security threat procedures and one or more steps of the selected computer security threat procedure;

fifth program instructions to identify an appropriate computer to execute a step in the selected computer security threat procedure; and

sixth program instructions to generate and output a permanent, unmodifiable record comprising the computer security incident information, results of execution of the selected one or more steps of the selected computer security threat procedure, an identity of the user who selected the computer security threat procedure, and the date stamp and time stamp for the computer security incident information; and

wherein said first, second, third, fourth, fifth, and sixth program instructions are stored on said medium.

75. The computer program product of claim 74, further comprising program instructions to access a table comprising computer locations and step information;

and compare a step to be executed in a computer security threat procedure with computer locations listed in the table.

76. The computer program product of claim 75, further comprising program instructions to determine if a match exists between the step to be executed and the computer locations;

and if one or more matches exist, displaying the matching information or automatically selecting an appropriate location.

77. The computer program product of claim 75, wherein the table further comprises Internet address ranges, the program product further comprising program instructions to compare an Internet address of a source of a computer security incident with the Internet address ranges of the table.

78. The computer program product of claim 76, further comprising program instructions to display an appropriate substitute computer location if a match does not exist.

79. The computer program product of claim 74, wherein the appropriate computer is strategically located relative to a source of a computer security incident.

80. The computer program product of claim 74, further comprising program instructions to record the results of the executed computer security threat procedure with a digital signature to enable detection of any attempted modification of the permanent, unmodifiable record, whereby integrity of the record can be monitored.

81. A computer program product for creating a permanent record of one or more computer security incidents, said computer program product comprising:

a computer readable medium;

first program instructions to record computer security incident information and a respective date stamp or time stamp, the computer security incident information indicating one of suspicious computer activity comprising one or more attacks received from a network computer that occur prior to a computer security threat and an actual computer security threat;

second program instructions to automatically identify one or more computer security threat procedures corresponding to a classification of the computer security incident information, each of said computer security threat procedures comprising one or more steps for one of investigating and responding to the computer security incident information;

third program instructions to generate a display of said one or more computer security threat procedures;

fourth program instructions to automatically select a computer security threat procedure and execute one or more steps of the selected computer security threat procedure;

fifth program instructions to generate and output a permanent, unmodifiable record comprising the computer security incident information, results of execution of the selected one or more steps of the selected computer security threat procedure, and the date stamp and time stamp for the computer security incident information; and

wherein said first, second, third, fourth and fifth program instructions are stored on said medium.

82. The computer program product of claim 81, further comprising program instructions to identify an appropriate computer to execute a step a computer security threat procedure, wherein the computer is strategically located relative to a source of a computer security incident.

83. The computer program product of claim 81, further comprising program instructions to record the results of the executed computer security threat procedure with a digital signature to enable detection of any attempted modification of the permanent, unmodifiable record, whereby integrity of the record can be monitored.

84. The computer program product of claim 81, further comprising program instructions to predict future actions of a source of a computer security incident.

85. The computer program product of claim 81, further comprising program instructions to classify the computer security incident information.