Practical and dynamic approach to enterprise hardening

Patent metadata

Field	Value
Publication number	US-10025937-B1
Application number	US-201514752619-A
Country	US
Kind code	B1
Filing date	Jun 26, 2015
Priority date	Jun 26, 2015
Publication date	Jul 17, 2018
Grant date	Jul 17, 2018

Abstract

Techniques are disclosed for dynamically managing hardening policies in a client computer (e.g., of an enterprise network). A hardening management application monitors activity on the client computer that is associated with a first hardening policy. The monitored activity is evaluated based on one or more metrics. Upon determining that at least one of the metrics is outside of a tolerance specified in the first hardening policy, the client computer is associated with a second hardening policy. The client computer is reconfigured based on the second hardening policy.

First claim

What is claimed is:

1. A method comprising:
monitoring activity on a client computer by an agent executing on the client computer, wherein the client computer is associated with a first hardening policy;
evaluating the monitored activity based on one or more metrics, wherein each of the metrics is within a tolerance specified in the first hardening policy, and wherein the one or more metrics include a stability metric indicating a level of stability of the client computer, the stability metric being associated with the monitored activity which indicates a rate at which one or more applications are installed on the client computer;
determining that at least one of the metrics is outside of the tolerance specified in the first hardening policy;
associating the client computer with a second hardening policy based on the determination; and

reconfiguring the client computer based on the second hardening policy, wherein reconfiguring the client computer based on the second hardening policy comprises:
allowing installation of applications that are not included in a whitelist associated with the second hardening policy.

2. The method of claim 1 , wherein the monitored activity is further evaluated based on a context associated with the client computer.

3. The method of claim 1 , wherein the one or more metrics further include a risk metric indicating a likelihood that the client computer is susceptible to an attack.

4. The method of claim 1 , wherein the monitored activity includes at least one of activity of a user logged into the client computer, activity of one or more applications executing on the client computer, activity of network resources of the client computer, and system activity of the client computer.

5. The method of claim 1 , wherein reconfiguring the client computer based on the second hardening policy comprises:
restricting access to network resources that are not included in a whitelist associated with the second hardening policy.

6. The method of claim 1 , wherein reconfiguring the client computer based on the second hardening policy comprises:
restricting access to applications that are not included in a whitelist associated with the second hardening policy.

7. A non-transitory computer-readable storage medium storing instructions, which, when executed on a processor, perform an operation, the operation comprising:
monitoring activity on a client computer by an agent executing on the client computer, wherein the client computer is associated with a first hardening policy;
evaluating the monitored activity based on one or more metrics, wherein each of the metrics is within a tolerance specified in the first hardening policy, and wherein the one or more metrics include a stability metric indicating a level of stability of the client computer, the stability metric being associated with the monitored

activity which indicates a rate at which one or more applications are installed on the client computer;
determining that at least one of the metrics is outside of the tolerance specified in the first hardening policy;
associating the client computer with a second hardening policy based on the determination; and

reconfiguring the client computer based on the second hardening policy, wherein reconfiguring the client computer based on the second hardening policy comprises:
allowing installation of applications that are not included in a whitelist associated with the second hardening policy.

8. The computer-readable storage medium of claim 7 , wherein the monitored activity is further evaluated based on a context associated with the client computer.

9. The computer-readable storage medium of claim 7 , wherein the one or more metrics further include a risk metric indicating a likelihood that the client computer is susceptible to an attack.

10. The computer-readable storage medium of claim 7 , wherein the monitored activity includes at least one of activity of a user logged into the client computer, activity of one or more applications executing on the client computer, activity of network resources of the client computer, and system activity of the client computer.

11. The computer-readable storage medium of claim 7 , wherein reconfiguring the client computer based on the second hardening policy comprises:
restricting access to network resources that are not included in a whitelist associated with the second hardening policy.

12. The computer-readable storage medium of claim 7 , wherein reconfiguring the client computer based on the second hardening policy comprises:
restricting access to applications that are not included in a whitelist associated with the second hardening policy.

13. A client computer comprising:
a processor; and
a memory storing program code, which, when executed on the processor, performs an operation, the operation comprising:
monitoring activity on the client computer by an agent executing on the client computer, wherein the client computer is associated with a first hardening policy,
evaluating the monitored activity based on one or more metrics, wherein each of the metrics is within a tolerance specified in the first hardening policy, and wherein the one or more metrics include a stability metric indicating a level of stability of the client computer, the stability metric being associated with the monitored activity which indicates a rate at which one or more applications are installed on the client computer,
determining that at least one of the metrics is outside of the tolerance specified in the first hardening policy,
associating the client computer with a second hardening policy based on the determination, and

reconfiguring the client computer based on the second hardening policy, wherein reconfiguring the client computer based on the second hardening policy comprises:
allowing installation of applications that are not included in a whitelist associated with the second hardening policy.

14. The client computer of claim 13 , wherein the monitored activity is further evaluated based on a context associated with the client computer.

15. The client computer of claim 13 , wherein the one or more metrics further include a risk metric indicating a likelihood that the client computer is susceptible to an attack.

16. The client computer of claim 13 , wherein the monitored activity includes at least one of activity of a user logged into the client computer, activity of one or more applications executing on the client computer, activity of network resources of the client computer, and system activity of the client computer.

17. The system client computer of claim 13 , wherein reconfiguring the client computer based on the second hardening policy comprises:
restricting access to applications that are not included in a whitelist associated with the second hardening policy.

Assignees

• Symantec Corp

Inventors

• Kashyap Anand
• Roundy Kevin A
• Bhatkar Sandeep
• Parker-Wood Aleatha
• Gates Christopher
• Liu Yin
• Yumer Leylya

Classifications

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06Q20/405

  Establishing or using transaction specific rules · CPC title

• G06Q20/4016

  involving fraud or risk level assessment in transaction processing · CPC title