Systems and methods for implementing computer security

A security server, comprising:

• one or more processing units;
• memory;
• a token generation module, wherein the token generation module is stored in the memory and executed by one or more of the processing units, the token generation module including instructions for:
• receiving a request from a security control module running within a first operating system on a remote computing device distinct from the security server, wherein the request includes a policy identifier that identifies a security policy;
• generating a unique agent identity token, which includes a cryptographic key;
• and
• transmitting the agent identity token to the security control module;
• and
• an integrity validation module, wherein the integrity validation module is stored in the memory and executed by one or more of the processing units, the integrity validation module including instructions for:
• securely receiving from the security control module data collected about the security control module according to a set of self-verification factors;
• using the data collected about the security control module to evaluate integrity of the security control module;
• and
• when the evaluation identifies an integrity failure, placing one or more corrective commands in a command queue for retrieval and execution by the security control module on the remote computing device;
• transmitting to the security control module a specification of a first set of files and directories at the remote computing device that are being monitored according to the security policy, wherein each of the files or directories in the first set is associated with the first operating system or associated with one or more applications running in the first operating system;
• securely receiving from the security control module data collected at the remote computing device, wherein the received data includes metadata for the first set of files and directories and content signatures computed for each file in the first set;
• comparing the received metadata and content signatures for each file or directory in the first set against corresponding baseline metadata and baseline content signatures for the first set of files and directories, wherein the baseline metadata and baseline content signatures are stored at the security server;
• and
• when there is a mismatch between the received metadata and corresponding baseline metadata or a mismatch between a received content signature and a corresponding baseline content signature, performing a remedial action.

A non-transitory computer readable storage medium storing one or more programs configured for execution by a server system having one or more processors and memory, the one or more programs comprising a token generation module and an integrity validation module, wherein:

• the token generation module includes instructions for:
• receiving a request from a security control module running within a first operating system on a remote computing device distinct from the security server, wherein the request includes a policy identifier that identifies a security policy;
• generating a unique agent identity token, which includes a cryptographic key;
• and
• transmitting the agent identity token to the security control module;
• and
• the integrity validation module includes instructions for:
• securely receiving from the security control module data collected about the security control module according to a set of self-verification factors;
• using the data collected about the security control module to evaluate integrity of the security control module;
• and
• when the evaluation identifies an integrity failure, placing one or more corrective commands in a command queue for retrieval and execution by the security control module on the remote computing device;
• transmitting to the security control module a specification of a first set of files and directories at the remote computing device that are being monitored according to the security policy, wherein each of the files or directories in the first set is associated with the first operating system or associated with one or more applications running in the first operating system;
• securely receiving from the security control module data collected at the remote computing device, wherein the received data includes metadata for the first set of files and directories and content signatures computed for each file in the first set;
• comparing the received metadata and content signatures for each file or directory in the first set against corresponding baseline metadata and baseline content signatures for the first set of files and directories, wherein the baseline metadata and baseline content signatures are stored at the security server;
• and
• when there is a mismatch between the received metadata and corresponding baseline metadata or a mismatch between a received content signature and a corresponding baseline content signature, performing a remedial action.