Social sharing of security information in a group

Patent metadata

Field	Value
Publication number	US-9292881-B2
Application number	US-201213538439-A
Country	US
Kind code	B2
Filing date	Jun 29, 2012
Priority date	Jun 29, 2012
Publication date	Mar 22, 2016
Grant date	Mar 22, 2016

Abstract

Techniques for social sharing security information between client entities forming a group are described herein. The group of client entities is formed as a result of a security server providing one or more secure mechanisms for forming a group among client entities, the client entities each belonging to a different organization. The security service then automatically shares security information of a client entity in the group with one or more other client entities in the group.

First claim

What is claimed is:

1. A computer-implemented method comprising:
forming, by a group formation module of security service computing device(s), a group including multiple client entities, each client entity being associated with a different security organization and each client entity having one or more computing devices, each computing device configured with an executable security agent; and
automatically sharing, by a sharing module of the security service computing device(s), security information generated by the executable security agent(s) of a client entity in the group with the executable security agent(s) of computing device(s) of one or more other client entities in the group,
wherein the security information is generated by the executable security agent(s) of the client entity based on monitoring of execution activities of the computing device(s) of the client entity,
wherein the security information is indicative of whether the client entity is experiencing a security threat, and
wherein each client entity is able to impose a security scheme or policy on its computing device(s) but is unable to impose the security scheme or policy on computing device(s) of other client entities.

2. The method of claim 1 , further comprising enabling a client entity of the multiple client entities to invite another client entity to join the group by providing a unique identifier of the other client entity to the security service.

3. The method of claim 1 , further comprising:
providing a blind search mechanism that enables a client entity of the multiple client entities to provide identifying information for an entity to the security service;
determining based at least in part on the identifying information whether the entity is a client entity; and
in response to determining that the entity is a client entity, inviting the entity to join the group.

4. The method of claim 3 , wherein the inviting is performed conditionally based on whether the entity has performed a blind search for the searching client entity.

5. The method of claim 1 , further comprising:
enabling a client entity of the multiple client entities to search for other client entities and to receive, in return, a list of client entities matching a search query; and
enabling the searching client entity to invite one or more of the client entities included in the list of client entities to join or form a group with the searching client entity.

6. The method of claim 1 , further comprising inviting client entities associated with a security threat to join the group.

7. The method of claim 1 , wherein the forming further comprises creating the group and inviting the client entities to join the group based at least in part on preferences specified by the client entities.

8. The method of claim 1 , wherein the forming further comprises creating the group and associating the group with at least one of an industry sector of the client entities, a geographic location of the client entities, a size range of the client entities, or interests of the client entities.

9. The method of claim 8 , further comprising inviting the client entities to join the group or opening the group to the public.

10. The method of claim 8 , further comprising assigning the client entities to the group and providing the client entities with an option to opt out of the group.

11. The method of claim 1 , wherein the forming further comprises creating the group based at least in part on complementary behaviors of the client entities.

12. The method of claim 1 , wherein the forming further comprises creating the group based at least in part on one or more social network groups.

13. The method of claim 1 , wherein the group is associated with a setting that allows the client entities to be anonymous with respect to each other.

14. The method of claim 1 , wherein the group is associated with a trusted moderator or group of moderators who controls admission to the group.

15. The method of claim 1 , further comprising enabling one or more of the client entities of the group to specify sharing parameters and policy parameters for the group.

16. The method of claim 1 , wherein the automatic sharing involves utilizing one or more of keys, hashing, certificates from a certificate authority, an identity verification mechanism, or other security features to prevent identity spoofing and secure the shared security information.

17. The method of claim 1 , wherein the shared security information is viewable by the client entity sharing the security information and the client entities receiving the security information and is not viewable by the security service or other parties.

18. The method of claim 1 , further comprising enabling a client entity to set system-wide or group-based sharing parameters for the client entity.

19. The method of claim 1 , further comprising enabling a client entity to advertise security information for sharing in exchange for security information from another client entity.

20. The method of claim 1 , wherein the automatic sharing includes sharing security information from third party sources with the client entities of the group.

21. The method of claim 1 , further comprising sharing the security information with a third party security product or service.

22. The method of claim 1 , further comprising associating one or more of the client entities with merit indicia based at least in part on contributions of the one or more client entities to a security ecosystem of the security service or to the group.

23. The method of claim 1 , further comprising providing the client entities with client entity profiles and enabling the client entities to modify their corresponding client entity profiles and to set access restrictions to their corresponding client entity profiles.

24. The method of claim 1 , wherein the security information includes at least one of threat information, remediation information, policies, attack data, vulnerability information, reverse engineering information, packet data, network flow data, protocol descriptions, victim information, threat attribution information, incident information, proliferation data, user feedback, or information on software or systems.

25. The method of claim 1 , wherein the security service is a public service open to interested client entities or a private service open to specific client entities.

26. The method of claim 1 , further comprising enabling manual sharing of security information between the client entities in the group.

27. The method of claim 1 , further comprising providing, to a client entity, an indication of available security information through a user interface and providing the available security information to the client entity responsive to that client entity electing to share security information of the client entity with another client entity that is associated with the available security information.

28. The method of claim 27 , wherein the available security information indicated through the user interface is selected for the client entity based on security information possessed or provided by the client entity.

29. The method of claim 1 , wherein the group belongs to one or more hierarchies of groups, each hierarchy of groups being associated with access controls to security information or with policies pushed to member client ent

Assignees

• Alperovitch Dmitri
• Kurtz George Robert
• Diehl David F
• Krasser Sven
• Meyers Adam S
• Crowdstrike Inc

Inventors

• Alperovitch Dmitri
• Kurtz George Robert
• Diehl David F
• Krasser Sven
• Meyers Adam S

Classifications

• G06Q10/40 Primary

  Business processes related to social networking or social networking services · CPC title

• H04L63/104 Primary

  Grouping of entities · CPC title

• G06Q10/00

  Administration; Management · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06Q50/01 Primary

  Physics · mapped topic