# US 8,782,770 B1 · Systems and methods for managing security during a divestiture > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,782,770 B1 - Document ID: US8782770B1 - Status: Granted - Kind: B1 - Application number: 14/102,274 - Filed: 2013-12-10 - Granted: 2014-07-15 - Earliest claimed: 2013-12-10 - Assignees: Citigroup Technology, Inc. - Applicants: Citigroup Technology, Inc. - Inventors: Bromin Menezes - Web page: https://patentgrep.com/patent/US8782770B1 ## CPC - H04L 63/0281: {Proxies} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06Q 30/0204: Market segmentation - G06Q 40/00: Finance; Insurance; Tax strategies; Processing of corporate or income taxes - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/104: {Grouping of entities} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Methods and systems for managing security during a divestiture may involve, for example, differentiating divested assets and employees from non-divested assets and employees and identifying non-divested assets which divested employees are permitted to access. In addition, divested employee access to the non-divested assets which divested employees are not permitted to access is locked down, and a separation firewall is deployed between divested networks and non-divested networks. ## Claims ### Claim 1 A method for managing security during divestiture of assets and employees by a divesting entity, comprising: differentiating divested assets of which ownership is transferred from the divesting entity to a buying entity during divestiture and divested employees whose employment is transferred from the divesting entity to the buying entity during divestiture from non-divested assets and employees, wherein differentiating the divested employees further comprises grouping divested employees into an active directory group of divested employees on a human resources database of the divesting entity; identifying non-divested assets which divested employees are permitted to access; locking down divested employee access to the non-divested assets which divested employees are not permitted to access, wherein locking down divested employee access to the non-divested assets further comprises deploying a divestiture proxy server between divested employees and non-divested assets; and deploying a separation firewall between divested networks of which ownership is transferred to a buying entity during divestiture and non-divested networks and between buying entity networks and the non-divested networks. ### Claim 2 (depends on 1) The method of claim 1, wherein differentiating the divested employees further comprises changing status of divested employees from employees of the divesting entity to non-employees of the divesting entity. ### Claim 3 (depends on 2) The method of claim 2, wherein changing the status of divested employees further comprises entering the change on a human resources database of the divesting entity. ### Claim 4 (depends on 1) The method of claim 1, wherein differentiating the divested employees further comprises tagging emails of divested employees. ### Claim 5 (depends on 4) The method of claim 4, wherein tagging the emails of divested employees further comprises entering email tagging logic on a global address database of the divesting entity. ### Claim 6 (depends on 1) The method of claim 1, wherein differentiating the divested employees further comprises providing email disclaimers for divested employees. ### Claim 7 (depends on 6) The method of claim 6, wherein providing the email disclaimers for divested employees further comprises entering email disclaimer logic on a global address database of the divesting entity. ### Claim 8 (depends on 1) The method of claim 1, wherein identifying the non-divested assets which divested employees are permitted to access further comprises generating a whitelist of non-divested assets which the divested employees are permitted to access. ### Claim 9 (depends on 8) The method of claim 8, wherein generating the whitelist of non-divested assets further comprises generating a whitelist of intranet sites of the divesting entity which the divested employees are permitted to access. ### Claim 10 (depends on 1) The method of claim 1, wherein locking down the divested employee access to the non-divested assets further comprises logging divested employee access via the divestiture proxy server to non-divested assets. ### Claim 11 (depends on 1) The method of claim 1, wherein locking down the divested employee access to the non-divested assets further comprises deploying a whitelist filter on the divestiture proxy of non-divested assets which the divested employees are permitted to access. ### Claim 12 (depends on 1) The method of claim 1, wherein locking down divested employee access to the non-divested assets further comprises grouping divested employees into a remote access service group separate from a non-divested employees remote access service group. ### Claim 13 (depends on 1) The method of claim 1, wherein deploying the separation firewall further comprises providing temporary connectivity during a first predetermined period between the divested networks and the non-divested networks via the separation firewall and terminating connectivity between the divested networks and the non-divested networks via the separation firewall upon expiration of the first predetermined period. ### Claim 14 (depends on 13) The method of claim 13, wherein providing temporary connectivity during the first predetermined period further comprises logging traffic between the divested networks and the non-divested networks during the first predetermined period via a separation firewall access logger. ### Claim 15 (depends on 1) The method of claim 1, wherein deploying the separation firewall further comprises providing temporary connectivity during a first predetermined period between buying entity networks and the non-divested networks via the separation firewall and terminating a connectivity between the divested entity networks and the non-divested networks via the separation firewall upon expiration of the first predetermined period. ### Claim 16 (depends on 15) The method of claim 15, wherein providing temporary connectivity during the first predetermined period further comprises logging traffic between the buying entity networks and the non-divested networks during the first predetermined period via the separation firewall access logger. ### Claim 17 (depends on 15) The method of claim 15, wherein deploying the separation firewall further comprises providing temporary connectivity during a second predetermined period between the buying entity networks and the non-divested networks via the separation firewall and terminating the connectivity between the divested networks and the non-divested networks via the separation firewall upon expiration of the first predetermined period. ### Claim 18 A system for managing asset security during divestiture of assets and employees by a divesting entity, comprising: a microprocessor coupled to memory, the microprocessor being programmed for: differentiating divested assets of which ownership is transferred from the divesting entity to a buying entity during divestiture and divested employees whose employment is transferred from the divesting entity to the buying entity during divestiture from non-divested assets and employees, wherein differentiating the divested employees further comprises grouping divested employees into an active directory group of divested employees on a human resources database of the divesting entity; identifying non-divested assets which divested employees are permitted to access; locking down divested employee access to the non-divested assets which divested employees are not permitted to access, wherein locking down divested employee access to the non-divested assets further comprises deploying a divestiture proxy server between divested employees and non-divested assets; and deploying a separation firewall between divested networks of which ownership is transferred to a buying entity during divestiture and non-divested networks and between buying entity networks and the non-divested networks. ### Claim 19 A method for managing security during divestiture of assets and employees by a divesting entity, comprising: differentiating divested assets and employees from non-divested assets and employees; identifying non-divested assets which divested employees are permitted to access; locking down divested employee access to the non-divested assets which divested employees are not permitted to access; deploying a separation firewall between divested networks and non-divested networks and between buying entity networks and the non-divested networks; and providing temporary connectivity between the divested networks and the non-divested networks via the separation firewall during a first predetermined period and between the buying entity networks and the non-divested networks via the separation firewall during a second predetermined period, logging traffic between the divested networks and the non-divested networks via a separation firewall access logger during the first predetermined period and between the buying entity networks and the non-divested networks via the separation firewall access logger during the second predetermined period, and terminating connectivity between the divested networks and the non-divested networks via the separation firewall upon expiration of the first predetermined period and between the buying entity networks and the non-divested networks via the separation firewall upon expiration of the second predetermined period.