Mitigating actions
AssigneeHewlett-Packard Development Company, L.P.
InventorsRonny Chevalier, David Plaquin, Guillaume Hiet, Adrian Baldwin
Life of this patent
Estimating the term…
Abstract
In an example there is provided a method of applying a mitigation action to a computing system. The method comprises receiving notification of an intrusion event on a computing system. The notification identifies one or more of data, and a process affected by the intrusion event. The method comprises accessing state data corresponding to a state of the computing system prior to the intrusion event, accessing a policy specifying one or more mitigation actions to be applied to the one or more of data, and a process in response to an intrusion event, restoring the one or more of data, and the process on the basis of the state data, and applying a mitigation action according to the policy.
Claims20
A method performed by a computing system comprising a hardware processor, comprising:
- receiving a notification of an intrusion event at the computing system, the notification identifying a service affected by the intrusion event;
- accessing state data corresponding to a state of the computing system prior to the intrusion event;
- determining a context of the computing system;
- selecting, based on the determined context, a first policy from a plurality of policies, the first policy specifying a first mitigation action to apply in the computing system in response to the intrusion event, wherein the plurality of policies correspond to respective different contexts and specify application of different mitigation actions for the intrusion event;
- applying the first mitigation action according to the first policy, wherein the first mitigation action comprises maintaining a first function of the service while disabling a second function of the service, wherein the maintaining and the disabling cause the service to operate in a degraded mode where the first function is available and the second function is not available;
- and
- restoring the computing system based on the state data.
A recovery system for a computing device, comprising:
- a storage medium to store state data of the computing device;
- and
- a processor to execute instructions to:
- receive a notification of an intrusion event on the computing device;
- access the state data from the storage medium, wherein the accessed state data corresponds to a state of the computing device prior to the intrusion event;
- determine a context of the computing device;
- select, based on the determined context, a first policy from a plurality of policies, the first policy specifying a first mitigation action to apply in the computing device in response to the intrusion event, wherein the plurality of policies correspond to respective different contexts and specify application of different mitigation actions for the intrusion event;
- apply the first mitigation action in response to the intrusion event, wherein the first mitigation action comprises maintaining a first function of a service affected by the intrusion event while disabling a second function of the service, wherein the maintaining and the disabling are to cause the service to operate, in the computing device, in a degraded mode where the first function is available and the second function is not available;
- and
- restore the computing device based on the state data.
A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to:
- receive a notification of an intrusion event in a computing device, the notification identifying a service affected by the intrusion event;
- access state data corresponding to a state of the computing device prior to the intrusion event;
- determine a context of the computing device;
- select, based on the determined context, a first policy from a plurality of policies, the first policy specifying a first mitigation action to apply to the service in response to the intrusion event, wherein the plurality of policies correspond to respective different contexts and specify application of different mitigation actions for the intrusion event;
- apply the first mitigation action according to the first policy, wherein the first mitigation action comprises maintaining a first function of the service while disabling a second function of the service, wherein the maintaining and the disabling cause the service to operate in a degraded mode where the first function is available and the second function is not available;
- and
- restore the computing device based on the state data.
Dependencies are inferred from the claim text.