Tightly integrated cooperative telecommunications firewall and scanner with distributed capabilities

A method of implementing an integrated telephony firewall and scanner system for controlling and logging access between an enterprise's end-user stations and their respective circuits into a public switched telephone network (“PSTN”) via a plurality of extensions, the method comprising:

• defining a security policy comprising a security rule base, a results response policy, and groups of extensions, wherein the security rule base includes security rules specifying actions to be taken based upon at least one attribute of a call on an extension, the results response policy includes results response rules specifying actions to be taken based on results of a vulnerability assessment (“VA”) performed on an extension, and the groups of extensions each include a set of extensions having at least one feature in common;
• detecting a call on an extension to determine attributes associated with the call wherein the detecting the call is accomplished between the extension and the PSTN;
• performing actions based upon the call attributes in accordance with the security rules defined for the extension;
• requesting a VA on the extension;
• performing a VA on the extension and generating VA results responsive to the VA request;
• and
• updating the security policy based on the VA results in accordance with the results response policy.

An integrated telephony firewall and scanner system for controlling and logging access between an enterprise's end-user stations and their respective circuits into a public switched telephone network (“PSTN”) via a plurality of extensions, the system comprising:

• a firewall/scanner client for defining a security policy comprising a security rule base, a results response policy, and groups of extensions, wherein the security rule base includes security rules specifying actions to be taken based upon at least one attribute of a call on an extension, the results response policy includes results response rules specifying actions to be taked based on results of a vulnerability assessment (“VA”) performed on an extension, and the groups of extensions each include a set of extensions having at least one feature in common;
• a line sensor connected to said firewall/scanner client via a firewall management server for detecting a call on an extension to determine attributes associated with the call, performing actions based upon the call attributes in accordance with the security rules defined for the extension, and notifying the firewall management server that the actions have been performed, responsive to which notification the firewall management server requests a VA on the extension and wherein the line sensor is located between the extension and the PSTN;
• a scanner management server for receiving the VA request and, responsive to the VA request, building a profile and pushing the profile to a dialer for performing a VA on the extension and generating VA results to the firewall management server;
• wherein the firewall management server updates the security policy based on the VA results in accordance with the results response policy.

An integrated telephony firewall and scanner system for controlling and tracking access between an enterprise's end-user stations and their respective circuits into a public switched telephone network (“PSTN”) via a plurality of extensions, the system comprising:

• means for defining a security policy comprising a security rule base, a results response policy, and groups of extensions, wherein the security rule base includes security rules specifying actions to be taken based upon at least one attribute of a call on an extension, the results response policy includes results response rules specifying actions to be taken based on results of a vulnerability assessment (“VA”) performed on an extension, and the groups of extensions each include a set of extensions having at least one feature in common;
• means for detecting a call on an extension to determine attributes associated with the call;
• means for performing actions based upon the call attributes in accordance with the security rules defined for the extension;
• means for requesting a VA on the extension;
• means responsive to the VA request for performing a VA on the extension and generating VA results;
• and
• means for performing actions based upon the VA results in accordance with the results response rules defined for the extension.

A method of implementing an integrated telephony firewall and scanner system for controlling and logging access between an enterprise's end-user stations and their respective circuits into a public switched telephone network (“PSTN”) via a plurality of extensions, the method comprising:

• defining a security policy comprising a security rule base, a results response policy, and groups of extensions, wherein the security rule base includes security rules specifying actions to be taken based upon at least one attribute of a call on an extension, the results response policy includes results response rules specifying actions to be taken based on results of a vulnerability assessment (“VA”) performed on an extension, and the groups of extensions each include a set of extensions having at least one feature in common;
• detecting a call on an extension to determine attributes associated with the call;
• performing actions based upon the call attributes in accordance with the security rules defined for the extension;
• requesting a VA on the extension;
• performing a VA on the extension and generating VA results responsive to the VA request;
• and
• performing actions based upon the VA results in accordance with the results response rules defined for the extension.

An integrated telephony firewall and scanner system for controlling and logging access between an enterprise's end-user stations and their respective circuits into a public switched telephone network (“PSTN”) via a plurality of extensions, the system comprising:

• a firewall/scanner client for defining a security policy comprising a security rule base, a results response policy, and groups of extensions, wherein the security rule base includes security rules specifying actions to be taken based upon at least one attribute of a call on an extension, the results response policy includes results response rules specifying actions to be taken based on results of a vulnerability assessment (“VA”) performed on an extension, and the groups of extensions each include a set of extensions having at least one feature in common;
• a line sensor connected to said firewall/scanner client via a firewall management server for detecting a call on an extension to determine attributes associated with the call, performing actions based upon the call attributes in accordance with the security rules defined for the extension, and notifying the firewall management server that the actions have been performed, responsive to which notification the firewall management server requests a VA on the extension;
• a scanner management server for receiving the VA request and, responsive to the VA request, building a profile and pushing the profile to a dialer for performing a VA on the extension and generating VA results to the firewall management server;
• wherein the firewall management server initiates actions based upon the VA results in accordance with the results response rules defined for the extension.

An integrated telephony firewall and scanner system for controlling and tracking access between an enterprise's end-user stations and their respective circuits into a public switched telephone network (“PSTN”) via a plurality of extensions, the system comprising:

• means for defining a security policy comprising a security rule base, a results response policy, and groups of extensions, wherein the security rule base includes security rules specifying actions to be taken based upon at least one attribute of a call on an extension, the results response policy includes results response rules specifying actions to be taken based on results of a vulnerability assessment (“VA”) performed on an extension, and the groups of extensions each include a set of extensions having at least one feature in common;
• means for detecting a call on an extension to determine attributes associated with the call;
• means for performing a VA on the extension and generating VA results;
• and
• means for performing actions based upon the VA results in accordance with the results response rules defined for the extension.

A method of implementing an integrated telephony firewall and scanner system for controlling and logging access between an enterprise's end-user stations and their respective Circuits into a public switched telephone network (“PSTN”) via a plurality of extensions, the method comprising:

• defining a security policy comprising a security rule base, a results response policy, and groups of extensions, wherein the security rule base includes security rules specifying actions to be taken based upon at least one attribute of a call on an extension, the results response policy includes results response rules specifying actions to be taken based on results of a vulnerability assessment (“VA”) performed on an extension, and the groups of extensions each include a set of extensions having at least one feature in common;
• detecting a call on an extension to determine attributes associated with the call;
• performing a VA on the extension and generating VA results responsive to the VA request;
• performing actions based upon the VA results in accordance with the results response rules defined for the extension.

An integrated telephony firewall and scanner system for controlling and logging access between an enterprise's end-user stations and their respective circuits into a public switched telephone network (“PSTN”) via a plurality of extensions, the system comprising:

• a firewall/scanner client for defining a security policy comprising a security rule base, a results response policy, and groups of extensions, wherein the security rule base includes security rules specifying actions to be taken based upon at least one attribute of a call on an extension, the results response policy includes results response rules specifying actions to be taken based on results of a vulnerability assessment (“VA”) performed on an extension, and the groups of extensions each include a set of extensions having at least one feature in common;
• a line sensor connected to said firewall/scanner client via a firewall management server for detecting a call on an extension to determine attributes associated with the call;
• a scanner management server for pushing a profile including the extension to a dialer for performing a VA on the extension and generating VA results to the firewall management server;
• wherein the firewall management server initiates actions based upon the VA results in accordance with the results response rules defined for the extension.

A multi-tier telephony security system for controlling and logging access between an enterprise's end-user stations at a plurality of customer sites and their respective circuits into a public switched telephone network (PSTN) via a plurality of extensions, the system comprising:

• a first tier firewall management server (“FMS”), the first tier FMS including a database containing a first tier security policy comprising security rules specifying actions to be taken based upon at least one attribute of a call on an extension;
• a line sensor within a customer site connected to the first tier FMS for performing actions on a selected call based upon at least one attribute thereof, in accordance with the security rules of the first tier security policy;
• a second tier FMS connected to the first tier FMS, the second tier FMS including a database containing a second tier security policy comprising security rules specifying actions to be taken based upon at least one attribute of a call on an extension;
• a line sensor within the customer sites connected to the second tier FMS for performing actions on a selected call based upon at least one attribute thereof, in accordance with the security rules of the second tier security policy;
• wherein each of the security rules of the first tier security policy are designated as being either required or optional;
• and
• wherein the second tier security policy includes all of the rules of the first tier security policy designated as being required and a subset of the rules of the first tier security policy designated as being optional.

A method of implementing multi-tier telephony security system for controlling and logging access between an enterprise's end-user stations at a plurality of customer sites and their respective circuits into a public switched telephone network (PSTN) via a plurality of extensions, the method comprising:

• defining in connection with a first tier firewall management server (“FMS”) a first tier security policy comprising security rules specifying actions to be taken based upon at least one attribute of a call on an extension connected to said first tier FMS via a line sensor;
• performing actions on a selected call on the extension connected to the first tier FMS based upon at least one attribute thereof, in accordance with the security rules of the first tier security policy;
• defining in connection with a second tier FMS connected to the first tier FMS a second tier security policy comprising security rules specifying actions to be taken based upon at least one attribute of a call on an extension connected to said second tier FMS via a line sensor;
• performing actions on a selected call on the extension connected to the second tier FMS based upon at least one attribute thereof, in accordance with the security rules of the second tier security policy;
• and
• designating each of the security rules of the first tier security policy as being either required or optional;
• wherein the second tier security policy includes all of the rules of the first tier security policy designated as being required and a subset of the rules of the first tier security policy designated as being optional.