Method and systems for controlling access to computing resources based on known security vulnerabilities

A system for controlling the operation of a computing system in response to a security vulnerability, comprising:

• a processor;
• a memory connected to the processor and storing instructions for controlling the operation of the processor to perform the steps of
• identifying the computing system running software subject to at least one security vulnerability;
• storing a policy based on the status of the at least one security vulnerability including at least one rule and an analysis method for determining compliance with the rule;
• receiving information relating to the status of the at least one known security vulnerability of the software program;
• processing the information relating to the status using the analysis method;
• determining, based on the processing, the compliance of the at least one security vulnerability in relation to the rule;
• and
• controlling, based on the determining, the operation of the host computing system.

A method operable on a computer for controlling the access of an endpoint computing system to a host computing system in response to a security vulnerability, comprising:

• identifying within at least one of the endpoint and host systems a plurality of conditions, each condition having a state;
• operating on at least one of the host computing system and the endpoint computing system a software program subject to at least one security vulnerability;
• establishing a policy based on the status of the at least one security vulnerability and the state of each of the plurality of conditions, the policy including at least one rule and an analysis method for determining compliance with the rule;
• receiving information relating to the status of the at least one known security vulnerability of the software program;
• receiving information relating to the state of each of the plurality of conditions;
• processing the information relating to the status of the at least one known security vulnerability and the state of each of the plurality of conditions using the analysis method;
• determining, based on the processing, the compliance of the at least one security vulnerability and the plurality of conditions with the rule;
• and
• controlling, based on the determining, access of the endpoint system to a resource of the host computing system.

A system for controlling the access of an endpoint computing system to a host computing system in response to a security vulnerability, comprising:

• means for identifying within at least one of the endpoint and host systems a plurality of conditions, each condition having a state;
• means for operating on at least one of the host computing system and the endpoint computing system a software program subject to at least one security vulnerability;
• means for establishing a policy based on the status of the at least one security vulnerability and the state of each of the plurality of conditions, the policy including at least one rule and an analysis method for determining compliance with the rule;
• means for receiving information relating to the status of the at least one known security vulnerability of the software program;
• means for receiving information relating to the state of each of the plurality of conditions;
• means for processing the information relating to the status of the at least one known security vulnerability and the state of each of the plurality of conditions using the analysis method;
• means for determining, based on the processing, the compliance of the at least one security vulnerability and the plurality of conditions with the rule;
• and
• means for controlling, based on the determining, access of the endpoint system to a resource of the host computing system.

A method for generating signals to control the access of an endpoint computing system to a resource in a host computing system, comprising:

• collecting a state for each of a plurality of conditions in at least one of the endpoint computing system and the host computing system;
• collecting a status of a known security vulnerability for a software program operating on at least one of the host computing system and the endpoint computing system;
• identifying a policy for determining access of the endpoint computing system to the resource, the policy including at least one rule and an analysis method for determining compliance with the rule;
• processing, using the analysis method, the state of each of the plurality of conditions and the status of the known security vulnerability;
• determining, based upon the processing, if the conditions and the known security vulnerability are in compliance with the rule;
• and
• generating, based upon the determining, a signal usable to control the access of the endpoint computing system to the resource.

A program product containing instructions to control the operation of a computing system to control the access of an endpoint computing system to a resource in a host computing system, the instructions operable on the computing system to cause the computing system to perform a process comprising:

• collecting a state for each of a plurality of conditions in at least one of the endpoint computing system and the host computing system;
• collecting a status of a known security vulnerability for a software program operating on at least one of the host computing system and the endpoint computing system;
• identifying a policy for determining access of the endpoint computing system to the resource, the policy including at least one rule and an analysis method for determining compliance with the rule;
• processing, using the analysis method, the state of each of the plurality of conditions and the status of the known security vulnerability;
• determining, based upon the processing, if the conditions and the known security vulnerability are in compliance with the rule;
• and
• generating, based upon the determining, a signal usable to control the access of the endpoint computing system to the resource.