US 8,136,164 B2 · Manual operations in an enterprise security assessment sharing system

Abstract

An enterprise-wide sharing arrangement uses a semantic abstraction, called a security assessment, to share security-related information between different security products, called endpoints. A security assessment is defined as a tentative assignment by an endpoint of broader contextual meaning to information that is collected about an object of interest. Endpoints may publish security assessments onto a security assessment channel, as well as subscribe to a subset of security assessments published by other endpoints. A specialized endpoint is coupled to the channel that performs as a centralized audit point by subscribing to all security assessments, logging the security assessments, and also logging the local actions taken by endpoints in response to received security assessments. Manual operations are supported by the specialized endpoint including manual approval of actions, security assessment cancellation, and manual injection of security assessments into the security assessment channel.

Claims20

Dependent claims

A method for facilitating manual approval of a response prior to the response being taken by an endpoint in an enterprise network, the method comprising the steps of:

utilizing a security assessment schema in which security assessments of security incidents are generated by a plurality of endpoints in the enterprise network, the security assessments i) using a pre-defined taxonomy to provide contextual meaning to the security incidents, ii) being categorized by type, and iii) being published into a security assessment channel that is shared among the plurality of endpoints;
implementing response policies, the response policies describing the responses taken by the endpoint after receiving the security assessment from the channel and the response policies further identifying a subset of responses that are subject to manual approval before being performed by the endpoint;
and
providing a user interface for receiving input to the response policies from the user, the user interface being configured to enable designation of the subset of responses that are subject to manual approval.

1 more element

Dependencies are inferred from the claim text.

Manual operations in an enterprise security assessment sharing system

Life of this patent

Manual operations in an enterprise security assessment sharing system

Life of this patent

Abstract

Claims20