# US 11,310,283 B1 · Scanning and remediating configuration settings of a device using a policy-driven approach > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,283 B1 - Document ID: US11310283B1 - Status: Granted - Kind: B1 - Application number: 16/125,543 - Filed: 2018-09-07 - Granted: 2022-04-19 - Earliest claimed: 2018-09-07 - Assignees: VMware, Inc. - Applicants: Salt Stack, Inc. - Inventors: Thomas S. Hatch - Web page: https://patentgrep.com/patent/US11310283B1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/0866: Checking the configuration - H04L 41/0894: Policy-based network configuration management - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present disclosure relates to systems, methods, and computer-readable media for implementing an efficient and flexible policy-driven approach to securing a computing device. For example, systems disclosed herein can identify any number of security policies including configuration states associated with configuration settings of a client device. The systems disclosed herein can further enforce the security policies by performing an enforcement operation including an idempotent operation that enables a computing device to both diagnose as well as remedy security issues identified by an agent on a computing device. The systems disclosed herein further include features and functionality that enable a computing device to be compliant with multiple security standards without performing redundant enforcement operations. ## Claims ### Claim 1 A system comprising: at least one processor; and a computer-readable medium storing instructions thereon that, when executed by the at least one processor, cause a computing device to: maintain a plurality of security policies, the plurality of security policies including: a plurality of configuration states associated with configuration settings of a client device, the configuration settings referring to one or more settings of an application or operating system on the client device that grant or restrict access to one or more intended functionalities of the application or operating system; and mapping information associating the plurality of security policies to a plurality of security standards; receive a request to enforce a first security standard from the plurality of security standards; identify a first subset of security policies from the plurality of security policies having mapping information associated with the first security standard for enforcement on the client device, wherein enforcing the first security standard includes causing the client device to perform an operation to enforce a configuration state for a corresponding configuration setting defined by a security policy from the identified subset of security policies regardless of a current state of the configuration setting prior to receiving the request to implement the plurality of security policies on the client device; determine whether an exemption applies to at least one of the first subset of security policies; in response to determining that the exemption applies to the at least one of the first subset of security policies, bypass enforcement of the at least one of the first subset of security policies; and identify a second subset of security policies from the plurality of security policies having mapping information associated with a second security standard for enforcement on the client device. ### Claim 2 (depends on 1) The system of claim 1, wherein the operation to enforce the configuration state includes an idempotent operation in which a check and a fix of the security policy are the same operation. ### Claim 3 (depends on 1) The system of claim 1, wherein the instructions cause the computing device to: receive a report including information associated with enforcing at least one of the first or second subset of security policies on the client device; and generate a compliance report indicating a measure of compliance with at least one of the first or second security standard. ### Claim 4 (depends on 3) The system of claim 3, wherein generating the compliance report further includes: based on overlap between mapping information for the first subset of security policies and the mapping information associated with the second security standard, providing, within the compliance report, an indication of a second measure of compliance with the second security standard. ### Claim 5 (depends on 1) The system of claim 1, wherein the instructions cause the computing device to provide an option to request enforcement of the second security standard. ### Claim 6 (depends on 1) The system of claim 1, wherein enforcing the second security standard includes causing the client device to perform one or more operations to enforce one or more configuration states for one or more corresponding configuration settings defined by the second subset of security policies. ### Claim 7 (depends on 1) The system of claim 1, wherein the plurality of security standards includes two or more of Center for Internet Security (CIS) standards, Standard Technical Implementation Guide (STIG) standards, Payment Card Industry (PCI) standards, and Health Insurance Portability and Accountability Act (HIPAA) standards, and wherein the instructions further cause the computing device to: generate the mapping information for the plurality of security policies by mapping the plurality of configuration states associated with configuration settings of the client device to respective security standards from the plurality of security standards. ### Claim 8 A computer-implemented method comprising: maintaining a plurality of security policies, the plurality of security policies including: a plurality of configuration states associated with configuration settings of a client device, the configuration settings referring to one or more settings of an application or operating system on the client device that grant or restrict access to one or more intended functionalities of the application or operating system; and mapping information associating the plurality of security policies to a plurality of security standards; receiving a request to enforce a first security standard from the plurality of security standards; identifying a first subset of security policies from the plurality of security policies having mapping information associated with the first security standard for enforcement on the client device, wherein enforcing the first security standard includes causing the client device to perform an operation to enforce a configuration state for a corresponding configuration setting defined by a security policy from the identified subset of security policies regardless of a current state of the configuration setting prior to receiving the request to implement the plurality of security policies on the client device; determining whether an exemption applies to at least one of the first subset of security policies; in response to determining that the exemption applies to the at least one of the first subset of security policies, bypassing enforcement of the at least one of the first subset of security policies; and identifying a second subset of security policies from the plurality of security policies having mapping information associated with a second security standard for enforcement on the client device. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, further including: receiving a report including information associated with enforcing at least one of the first or second subset of security policies on the client device; and generating a compliance report indicating a measure of compliance with at least one of the first or second security standard. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein generating the compliance report further includes: based on overlap between mapping information for the first subset of security policies and the mapping information associated with the second security standard, providing, within the compliance report, an indication of a second measure of compliance with the second security standard. ### Claim 11 (depends on 8) The computer-implemented method of claim 8, wherein enforcing the second security standard includes causing the client device to perform one or more operations to enforce one or more configuration states for one or more corresponding configuration settings defined by the second subset of security policies. ### Claim 12 A non-transitory computer-readable medium storing instructions thereon that, when executed by at least one processor, cause a computing device to: maintain a plurality of security policies, the plurality of security policies including: a plurality of configuration states associated with configuration settings of a client device, the configuration settings referring to one or more settings of an application or operating system on the client device that grant or restrict access to one or more intended functionalities of the application or operating system; and mapping information associating the plurality of security policies to a plurality of security standards; receive a request to enforce a first security standard from the plurality of security standards; identify a first subset of security policies from the plurality of security policies having mapping information associated with the first security standard for enforcement on the client device, wherein enforcing the first security standard includes causing the client device to perform an operation to enforce a configuration state for a corresponding configuration setting defined by a security policy from the identified subset of security policies regardless of a current state of the configuration setting prior to receiving the request to implement the plurality of security policies on the client device; determine whether an exemption applies to at least one of the first subset of security policies; in response to determining that the exemption applies to the at least one of the first subset of security policies, bypass enforcement of the at least one of the first subset of security policies; and identify a second subset of security policies from the plurality of security policies having mapping information associated with a second security standard for enforcement on the client device. ### Claim 13 (depends on 12) The non-transitory computer-readable medium of claim 12, further including instructions that, when executed by the at least one processor, cause the computing device to: receive a report including information associated with enforcing at least one of the first or second subset of security policies on the client device; and generate a compliance report indicating a measure of compliance with at least one of the first or second security standard. ### Claim 14 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein generating the compliance report further includes: based on overlap between mapping information for the first subset of security policies and the mapping information associated with the second security standard, providing, within the compliance report, an indication of a second measure of compliance with the second security standard. ### Claim 15 (depends on 12) The non-transitory computer-readable medium of claim 12, wherein enforcing the second security standard includes causing the client device to perform one or more operations to enforce one or more configuration states for one or more corresponding configuration settings defined by the second subset of security policies.