Back to results
US 12,192,214 B2Granted
Mitigating threats associated with tampering attempts
AssigneeSophos Limited
InventorRichard Paul Cosgrove
Life of this patent
Estimating the term…
Abstract
An enterprise security system is improved by taking remedial actions responsive to detecting attempts at tampering with computing resources. When a tamper detection instrument detects an attempt at tampering, information about the attempt at tampering may be used to identify one or more candidate types of threats and/or candidate threats. One or more remedial actions associated with the threat or type of threat can be identified and applied in ten enterprise network environment.
Claims20
A computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on one or more computing devices, performs the steps of:
- storing a cache in a kernel space of an endpoint of an enterprise network, the cache including one or more entries identifying one or more tamper-protected computing objects, each of the one or more entries in the cache cryptographically signed by an external trust authority;
- instrumenting the endpoint to detect an attempted modification to one of the tamper-protected computing objects based on an interaction with the cache corresponding to the one of the tamper-protected computing objects;
- and
- in response to detecting the attempted modification to the one of the tamper-protected computing objects:
- determining a process associated with the attempted modification to the one of the tamper-protected computing objects;
- determining that the process associated with the attempted modification is not one of the tamper-protected computing objects identified in an entry in the cache and cryptographically signed by the external trust authority;
- determining a remediation action for mitigating at least one threat associated with the attempted modification;
- and
- applying the remediation action to mitigate the at least one threat in the enterprise network, wherein the remediation action references the process associated with the attempted modification.
6 more elements
A method comprising:
- instrumenting an endpoint of an enterprise network to detect an attempted modification to a tamper-protected computing object of the endpoint identified in a tamper-protection cache;
- detecting an attempt at modification to the tamper-protected computing object by a non-protected computing object based on an interaction with the tamper-protection cache;
- and
- in response to detecting the attempted modification to the tamper-protected computing object identified in the tamper-protection cache:
- determining attempted modification event information including at least one of a source of the attempted modification, a form of the attempted modification, and information descriptive of the tamper-protected computing object;
- determining that the source of the attempted modification is not one of the tamper-protected computing objects identified in the cache;
- determining a remediation action for mitigating at least one threat associated with the attempted modification event information;
- and
- applying the remediation action to mitigate the at least one threat in the enterprise network.
6 more elements
A system comprising:
- a tamper detection facility for monitoring tamper-protected computing resources of an enterprise network identified in a tamper-protection cache for tampering attempts and, in response to detecting a tampering attempt by a computing object other than the tamper-protected computing resources based on determining the computing object other than the tamper-protected computing resource is not identified in the tamper-protection cache, generating an indication of tampering of the tamper-protected computing resource based on an interaction with the tamper-protection cache;
- and
- a threat management facility constructed to determine at least one type of threat associated with the tampering attempts, to select a remediation action for mitigating at least one threat associated with the at least one type of threat, and to apply the remediation action to mitigate the at least one threat in the enterprise network.
Dependencies are inferred from the claim text.