Method and system for enforcing a communication security policy

A system for selectively preventing individual workstations connected to a network from transmitting data to other networks, the system comprising:

• an analyzer associated with a gateway and configured to analyze at a gateway data packets transmitted by a workstation that are intended for another network;
• a detector associated with the analyzer and capable of determining whether at least one of the data packets transmitted by the workstation and analyzed by the analyzer includes a marker, the marker indicating that a security agent resides in the workstation;
• and
• a selector associated with the gateway and capable of allowing data packets to be transmitted via the gateway to the other network when at least one of the data packets includes the marker and preventing data packets from being transmitted via the gateway to the other network when at least one of the data packets does not include the marker.

A system for selectively preventing individual workstations connected to a network from transmitting data to other networks, the system comprising:

• means for analyzing at a gateway data packets transmitted by a workstation that are intended for another network;
• means for determining whether at least one of the data packets transmitted by the workstation includes a marker, the marker indicating that a security agent resides in the workstation;
• and
• means for allowing data packets to be transmitted via the gateway to the other network when at least one of the data packets includes the marker, and for preventing data packets from being transmitted via the gateway to the other network when at least one of the data packets does not include the marker.

A method for enforcing a security policy for selectively preventing the downloading and execution of undesired executable objects in an individual workstation, comprising the steps of:

• adding at least one marker to one or more data packet(s) of a set of data packets transmitted to a workstation through a gateway, said at least one marker indicating that the data packets have been generated by a workstation or server provided with a security agent;
• providing means in or coupled to the gateway for analyzing the first one or more data packet(s) addressed to a workstation, to determine whether said first one or more data packet(s) comprise at least one such marker;
• if at least one such marker is detected in said first one or more data packet(s), allowing said data packet(s) to be transmitted to their destination;
• and
• if no such marker is detected in said first one or more data packet(s), preventing any data packet(s) in said set of data packets from being transmitted to the workstation.

A system for enforcing a security policy for selectively preventing the downloading and execution of undesired executable objects in an individual workstation, comprising:

• gateway means for controlling the communication traffic of a plurality of workstations connected via the Internet or an intranet;
• detection means provided in, or coupled to said gateway for analyzing the first one or more data packet(s) of a set of data packets transmitted to a workstation initiating communication with a remote server, to determine whether said first one or more data packet(s) comprise at least one marker indicating that the data packets have been generated by a workstation or server provided with a security agent;
• and
• means for preventing any data packet(s) received from a server or workstation from being transmitted to the workstation to which they are addressed if no marker indicating that a security agent is installed in the transmitting workstation or server is detected by said detection means in said first one or more data packet(s).