Dynamic risk management

• US 7,908,660 B2
• Filed: 02/06/2007
• Issued: 03/15/2011
• Est. Priority Date: 02/06/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bahl, Pradeep
• Primary Examiner(s): Dinh; Minh
• Assistant Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US11/702,974
• Publication Number:
  US 20080189788A1
• Time in Patent Office: 1,498 Days
• Field of Search: 717/118, 713/164, 713/151, 713166-167, 726 25- 26, 726/22
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A dynamic risk management system for operating systems that provides monitoring, detection, assessment, and follow-up action to reduce the risk whenever it rises. The system enables an operating system to protect itself automatically in dynamic environments. The risk management system monitors a diverse set of attributes of the system which determines the security state of the system and is indicative of the risk the system is under. Based on a specification of risk levels for the various attributes and for their combinations, the risk management system determines whether one or more actions are required to alleviate the overall risk to the system.

Claims

1. A method of dynamic risk management for an operating system of a computing device, the method comprising:

automatically assessing a security state of the operating system of the computing device independent of security state changes;

determining, based on the assessing, a risk level R_New, wherein R_New=R_Current+Σ

rf_New−

Σ

rf_Old+ri_New−

ri_Old where R_Current is a current risk level, and where Σ

rf_New is a sum of scores assigned to new risk factors discovered by the assessing, and where Σ

rf_Old is a sum of scores assigned to old risk factors of R_current that are no longer discovered by the assessing, and where ri_New is a new risk increment based on a combination of the new risk factors, and where ri_Old is an old risk increment based on a combination of the old risk factors;

causing an action related to the operating system of the computing device to be performed based on the risk level.

2. The method according to claim 1, further comprising detecting a change in the state of the operating system.

3. The method according to claim 1, wherein the action is caused to be performed in response to the risk level exceeding a predetermined threshold.

4. The method according to claim 1, wherein automatically assessing the security state includes monitoring a risk factor of the operating system.

5. The method according to claim 1, wherein automatically assessing the security state includes pushing a data inquiry to at least one component or includes pulling data from the at least one component.

6. The method according to claim 1, wherein the security state is automatically assessed periodically over a predefined time interval.

7. The method according to claim 1, wherein the operating system is coupled to a network.

8. The method according to claim 1, wherein the action caused to be performed includes an action of a type that is risk mitigation or that is risk remediation.

9. The method according to claim 1, wherein the action includes at least one of:

generating an alert;

activating a security measure;

restoring to an earlier state of the operating system;

terminating a network connection;

disabling a component;

disabling operation of at least a portion of software code;

initiating a software protection program.

10. The method according to claim 1, wherein the risk level is determined based on at least one risk factor identified in relation to the security state.

11. The method according to claim 10, wherein the risk level is determined based on a combination of at least two risk factors identified in relation to the security state.

12. A system having at least one processor that is configured to perform the method recited in claim 1.

13. A method of dynamic risk management for an operating system of a computing device, the method comprising:

assessing a security state of the operating system of the computing device;

automatically causing, in response to the assessing, a tiered set of actions related to the security state of the operating system of the computing device to be performed, wherein the tiered set of actions includes;

(i) determining a risk level R_New, wherein R_New=R_Current+Σ

rf_New−

Σ

rf_Old+ri_New−

ri_Old where R_Current is a current risk level, and where Σ

rf_New is a sum of scores assigned to new risk factors discovered by the assessing, and where Σ

rf_Old is a sum of scores assigned to old risk factors of R_Current that are no longer discovered by the assessing, and where ri_New is a new risk increment based on a combination of the new risk factors, and where ri_Old is an old risk increment based on a combination of the old risk factors, and

(ii) causing a risk alleviation action related to the operating system of the computing device to be performed based on the risk level.

14. The method according to claim 13, wherein the security state of the operating system is assessed synchronously with a change of state of the operating system.

15. The method according to claim 13, wherein the security state of the operating system is assessed asynchronously with a change of state of the operating system.

16. The method according to claim 13, wherein the risk level is determined based on a combination of at least two risk factors.

17. The method according to claim 13, wherein the risk alleviation action includes a risk mitigation action or includes a risk remediation action.

18. A system having at least one processor that is configured to perform the method recited in claim 13.