Patent Grant
10412113
One or more of the inventions described herein generally relate to the computer security field, and more specifically to a new and useful system and method for intelligently configuring security of a network in the computer security field.
Computer network and data security continue as ongoing concerns of high importance to entities and organizations of all types and sizes. However, identifying optimal computer and network security configurations and computer security policy is highly challenging given the rapidly evolving nature of computer security threats and given the disparate and varying computer networks/system architectures implemented by many entities and organizations. Accordingly, computer security strategy must be varied and diverse to protect against exploitation of computer security vulnerabilities of an entity.
While many complicated security solutions may exist in the market that address some computer security concerns of some entities and organizations, these security solutions are often technically difficult to implement and may additionally require teams of professionals to dissect and implement into an existing computer network and system architecture.
Additionally, compounding the computer security issues facing many of these entities and organizations is a limited availability of computer security resources. Specifically, a shortage of skilled security professionals capable of interpreting and implementing existing but highly complicated security solutions further strains an ability of entities and organizations to deploy effective computer security strategy.
Thus, there is a need in the computer security field to create new and useful methods for determining and deploying effective computer security strategy and computer security policy. The inventions described herein provide such new and useful methods.
The following description of the preferred embodiments of the invention is not intended to limit the invention to these preferred embodiments, but rather to enable any person skilled in the art to make and use this invention.
As shown in
The centralized and intelligent computer security platform 105 (hereinafter “computer security platform”) is a platform for implementing and maintaining security for one or more entities. The computer security platform 105 may implement authentication services and other cyber security services. In some embodiments, the authentication services include multi-factor authentication services. In a preferred embodiment, one or more aspects of the computer security platform 105 may be enabled by a web-based software platform (e.g., the intelligent computer security platform) operable on a web server or distributed computing system. One or more entities may access the computer security platform to utilize the services of the platform. Entities can includes organizations such as companies, individuals, administrators, hosting or service providers, and any other entities in need of computer security services. In some embodiments, the computer security platform 105 provides a user interface for entities to access services, configure services and policies, take actions relating to security, receive alerts and notifications relating to security of systems, and more. A subject entity is an entity that the computer security platform 105 enables, implements, and/or enables computer security for according to the systems and methods described herein. Additional subject entities may include other entities whose global or aggregate data may be employed within the computer security platform 105 as part of a corpus of security data.
The multi-factor authentication system 100, of a preferred embodiment, functions to facilitate a second factor (or additional factor, two-factor authentication, etc.)) of authentication as a service to one or more service providers.
The computer security engine 120 of a preferred embodiment may be enabled by one or more computing servers programmed to ingest data from a security environment of a subject entity and generate an assessment of the security environment that preferably includes one or more recommendations for computer security policy and/or computer security configurations for the security environment. As shown in
The security environment datastore 130 of a preferred embodiment may include one or more databases in which security environment data collected from various entities may be stored. In one implementation, the security environment datastore 130 may include a security environment databank for storing security environment data during an assessment of a security environment of a subject entity.
The threat intelligence feeds 140 may include one or more external feeds of security threat data relating to one or more industries of one or more entities subscribed to a security service of the intelligent computer security platform 105. Additionally, the threat intelligence feeds 140 may include any type or kind computer security or digital security threat data or intelligence describing current and emerging threats to computer and/or digital security.
The platform interface 150 preferably includes a web interface enabled by one or more computing services of the intelligent computer security platform 105. In a preferred embodiment, the platform interface 150 enables an administrator of a remote entity to interact with and make requests of the intelligent computer security platform 105. Additionally, or alternatively, the platform interface 150 may function to deploy a security dashboard that may include a security assessment identifying a security posture of a subject entity together with curated recommendations for computer security policy and/or computer security configurations.
As shown in
The method 200 functions to simplify for network administrators the configuring of computer security features and determining of computer security policy. The method 200 provides a sophisticated and intelligent computer security platform that functions to ingest (automatically, in some embodiments) security data, including security environment data (or sometimes as referred herein as computer environment data) for a subject entity and uses the security data to generate entity-specific computer security configurations and computer security policy based on a determined current state of computer security for the subject entity.
In some embodiments, the method 200 is enabled by a web-based software platform (e.g., the intelligent computer security platform) operable on a web server or distributed computing system. Additionally, or alternatively, the method 200 may be performed by any suitable computer system capable of ingesting security data, performing a security assessment of a security environment, and generating proposed computer security configurations and computer security policy and optionally implementing the same.
S210 includes monitoring a security environment maintained by the subject entity. In some embodiments, a security environment is a computer environment maintained by the subject entity. In some embodiments, the security environment is a computer network maintained and deployed by the subject entity. In some embodiments, monitoring includes the monitoring of authentication activity within the security environment. In some embodiments, the computer security platform connects to a security environment of the subject entity, such as a network environment, and monitors various aspects of the security environment. In some embodiments, the computer security platform has permission and access rights to various elements of the security environment, and is authenticated in a secure fashion.
S220 includes collecting a corpus of security data, and functions to identify and/or collect security data of a subject entity. In some embodiments, S220 includes collecting security environment data relating to one or more security configurations of the network maintained by the subject entity. However, the security data can include any other suitable data (e.g., device information, work locations, operating systems used, applications or programs used, risk tolerance data, historic configurations, authentication data, historic security data, etc.). The security environment data preferably includes data relating to security configurations and uses of a security environment such as a network maintained and/or deployed by the entity, computers accessing and/or using the network (e.g., endpoints), digital resources (e.g., software applications and/or programs, databases, etc.), network servers, and the like. The subject entity may be any type of organization or business implementing any type or kind of network or computing environment. In a preferred embodiment, one or more steps of the method 200 may be implemented between a remote intelligent computer and/or cyber security platform (service) and the subject entity.
In a first implementation, S220 may function to collect security environment data of a subject entity. In a preferred embodiment, an administrator of the subject entity using a web interface or API may enable access to its security environment to a remote intelligent computer security platform. In such embodiment, the remote security platform may function to directly interface with components (e.g., devices and applications) of the security environment and acquire security environment data from the subject entity by establishing a remote communication links to a network of the subject entity. In this first implementation, S220 may function to actively and/or passively collect security environment data from the subject entity.
In a passive security environment data collection mode, S220 may function to monitor and record network and security environment activity over one or more set periods. Specifically, S220 may function to monitor activities relating to logins (e.g., authentications) to one or more networks or digital resources of the security environment, devices (e.g., computers, etc.) operating on or accessing (or attempting to access) the one or more networks or digital resources of the subject entity, general network traffic, and the like.
Additionally, or alternatively, S220 may function to set security environment data collection periods during high use of the security environment of the subject entity and/or at times at which the security environment may be most vulnerable to potential attacks. In some embodiments, the security environment data collection period is a single continuous period in which all activity data generated by the security environment of the subject entity during the period is collected or recorded by S220.
In an active security environment data collection, S220 may function to actively pursue and acquire security environment data by transmitting one or more probes and/or one or more queries to the one or more components and/or devices operating within the security environment of the subject entity. The one or more components may include software components (e.g., software applications, browsers, etc.), any endpoint devices (e.g., user computers, user mobile devices/phones, network routers, networked servers, etc.), and the like.
S220 may configure the one or more probes to automatically locate computing resources within the security environment and capture or make a request for security configuration data, historical activity or use data, endpoint health data, and the like from the one or more components and/or devices operating within the security environment. For instance, S220 make configure the one or more probes to capture data relating to any security features installed at a component, a current version of a component or a current version of software operating on a component, authentication requirements for each component, network configurations (e.g., permissible user locations for accessing the network, trusted devices policies or settings, group access policies or settings, trusted networks settings, etc.), and the like. It shall be noted that S220 may configure the probes to capture or acquire any suitable security environment data. Additionally, endpoint health and endpoint version data may be determined in accordance with the systems and methods described in U.S. patent application Ser. No. 15/139,545 and U.S. patent application Ser. No. 14/482,796, which are incorporated by reference herein in their entireties by this reference.
Additionally, or alternatively, S220 may configure and transmit queries to the one or more components and/or devices operating within the security environment of the subject entity. Additionally, or alternatively, S220 may present one or more security environment queries via a user interface or the like that is accessible to an administrator of the security environment of the subject entity. Preferably, once presented with the queries, the administrator may provide a response to the queries directly and/or redirect or point the query toward a digital resource that may include data for responding to one or more of the queries.
Some example queries may include, but are not limited to: “how mobile computing devices (e.g., mobile phones) are used in the environment?”; “what are permissible work locations?”; “what type and version of operating systems are implemented in the environment?”; “what are permissible plugins?”; “what are permissible web browsers?”; and the like.
Additionally, or alternatively, S220 may function to embed or install software agents within the one or more components of the security environment of the subject entity that are capable of collecting security data including security configurations, general operations data, and the like. The software agents may function to aggregate the security data and transmit the security data once sufficient security data has been collected back to a remote intelligent computer security platform or the like.
In a second implementation, S220 may function to identify security environment data of a subject entity based on historical authentication data or computer or security environment data acquired as a result of a use of a security service (e.g., multi-factor authentication services, etc.). In some embodiments, the subject entity may employ one or more security services or features provided by the intelligent computer security platform. Accordingly, the historical authentication data may be stored in an entity-specific repository or datastore that is maintained and/or operated by the intelligent computer security platform. The historical authentication data may include data relating to any or all authentications performed using the authentication services (e.g., multi-factor authentication services, etc.) of the intelligent computer security platform. For instance, the authentication data may include failed authentication attempts and/or successful authentication attempts to applications and networked devices of the subject entity, authentication times, authentication dates, user associated with the authentications, devices used for performing authentication, IP addresses and geographic location data of devices used for authentication, sensor data (e.g., fingerprint sensor, accelerometer, cameras, etc.) obtained from authenticating devices, endpoint health data of the devices or applications authenticating to the network and/or to applications of the subject entity, and the like. Additionally, or alternatively, the authentication data may include one or more inferences or data derived based on the collected authentication. As examples, one or more inferences from authentication may include an inference of a job of a user based on authentication data (e.g., based on a number of times a user authenticates to a job-specific application), an inference of a security risk posed by a user or device based on authentication data, and the like.
In some embodiments, S220 may include collecting security data in the form of user-submitted risk tolerance data. For example, an administrator for an entity may submit risk tolerance data that is specific to one or more applications or components in an associated security environment. The risk tolerance data can include information about which risks the subject entity considers acceptable within the security environment.
Optionally, S225, which includes augmenting the security environment data with additional security data, functions to identify additionally security data that may be related or otherwise, assistive in an assessment (as described in S230) of the security environment data of the subject entity.
In one instance, S225 may function to identify a repository of security data aggregated from a plurality of other entities. In a preferred embodiment, the repository may be a global security databank of security data collected from one or more entities implementing one or more of the security services provided by the intelligent computer security platform. Thus, over the course of using the one or more security services of the intelligent computer security platform, security environment data of these plurality of other entities may be aggregated and stored in a centralized global security databank.
Accordingly, S225 may function to identify peer entities that may be comparable in size, function (e.g., industry peers, etc.), and/or security environment to the subject entity and use the security data of the peer entities in the assessment of the security environment data of the subject entity.
Additionally, or alternatively, S225 may function to augment the security environment data of the subject entity by collecting additional security data from one or more threat intelligence feeds. The one or more threat intelligence feeds may be industry-specific feeds (e.g., within the industry of the subject entity) or global threat intelligence feeds that provide general threat intelligence data.
S230 includes analyzing the security data. In some embodiments, S230 includes analyzing the corpus of security data to determine one or more vulnerability factors and/or one or more security behaviors relating to the subject entity. In some embodiments, vulnerability factors can include potential attack vectors and predetermined risk thresholds. In some embodiments, security behaviors can include one or more current security policy configurations of the subject entity. In some embodiments, analyzing the corpus of security data can include filtering the corpus based on probative security value regarding a state of the network maintained by the subject entity. In some embodiments, probative security value can include the existence or probable existence of malicious software within the security environment. In some embodiments, analysis includes detecting one or more predetermined features of known malicious software within the security environment.
S240, which includes generating a security assessment of the corpus of security environment data of the subject entity, functions to identify a state of the security environment of the subject entity including an identification vulnerabilities and security enhancement opportunities. In a preferred embodiment, the security assessment analyzes the corpus of security environment data of the subject entity to identify potential attack vectors, risk thresholds, current security policy configurations, and security-relevant entity behaviors.
In one embodiment, S240 may function to implement a feature extractor. In one implementation, the feature extractor comprises an ensemble of specifically configured data filters that, respectively, function to extract features within the corpus of security environment data having some probative security value regarding a state of the security environment of the subject entity. For instance, a first data/feature filter may include a filter that is specifically configured to filter data that is probative of the existence of malicious software within the security environment. In such embodiments, the first data/feature filter may be configured or designed to detect features of a list of known malicious software. In another example, a second data/feature filter may include a filter that is specifically designed to filter data relating to IP addresses used by remote devices accessing the one or more networks of the security environment.
Accordingly, S240 may function to extract security feature data from the security environment data, classify the extracted security feature data according to a predetermined category (that may be defined by the type of filter used), and group together security feature data classified with a same category.
In a variant, S240 may function to implement a machine learning model or ensemble comprising one or more machine learning algorithms that are specifically trained to classify (e.g., output labels) and/or detect security features having (high) probative value from security environment data. In such variant, S220 may use the security environment data as input into the machine learning model and the machine learning model may output classification labels for or identify features of the security environment data having probative security value.
In some embodiments, the corpus of security data and resulting analysis of the security data may be used in conjunction with machine learning techniques, including trained machine learning algorithms, on one or more neural networks in order to generate the security assessment. In some embodiments, the machine learning techniques make inferences, including predictive suggestions or inferences about a state or condition of the security environment and/or characteristics or behaviors of the subject entity. In some embodiments, the trained machine learning algorithms may include deep learning or similar techniques. In some embodiments, the computer security platform may function to implement a distributed or federated machine learning model that may be deployed in different layers of the computer security platform.
The computer security platform may employ any suitable machine learning technique or algorithm, including one or more of: supervised learning (e.g, using logistic regression, back propagation neural networks, random forests, decision trees, etc.), unsupervised learning, semi-supervised learning, reinforcement learning, and any other suitable learning style. Any component of the computer security platform can implement any one or more of: a regression algorithm, an instance-based method, a regularization method, a decision tree learning method, a Bayesian method, a kernel method, a clustering method, an associated rule learning algorithm, an artificial neural network model, a deep learning algorithm, a dimensionality reduction method, and an ensemble method. The computer security platform may employ any type of one or more neural networks in any combination, including one or more of: feed forward neural networks. recurrent neural networks, deep convolutional networks, deconvolutional networks, deep belief networks, and autoencoders.
Additionally, or alternatively, S240 may function to implement a security metrics generator. Specifically, S240 may use the security metrics generator to evaluate the security environment data and generate one or more security metrics. The security metrics generator may be specifically programmed to identify measurable and/or probative security features from the security environment data and generate one or more security metrics from these identified security features. For instance, the security metrics generator may identify that the security environment data includes security relating to remote logins by various computing devices. S220, using the security metrics generator, may function to count (using counting circuitry or the like) a number of remote logins over a set period and generate a security metric relating to remote logins to the security environment (e.g., 4,777 remote logins to the security environment per 30 days). It shall be noted that the security metrics generator may be programmed to generate a metric for any type or kind of security feature.
Additionally, or alternatively, the security metrics generator may generate security metrics for each of the groups of security features identified by the security feature extractor and/or machine learning model.
In one implementation, S240 may function to generate a security risk score. A security risk score as referred to herein may generally relate to a level of risk or susceptibility of a security environment to one or more digital threats. The security risk score may additionally correspond to a likelihood or a probability that a given security environment may be subject to a cyber or digital attack due to one or more identified and/or unidentified vulnerabilities.
The security risk score may preferably be determined based on assigning weights and/or scoring algorithms to one or more security factors and/or one or more security features of a subject security environment under evaluation that contributes to the security risk score. For example, a security risk score algorithm may include software application health (e.g., whether applications are updated regularly with patches, etc.) as a first security factor and authentication requirements to software applications of a security environment as a second security factor. In this example security score algorithm, the first security factor may have a first weight and the second security factor may have a second weight that may be aggregated together (and possibly with other security factor weights) to generate a security risk score for a subject security environment.
In another implementation, S240 may generate an assessment of the subject entity's security posture based on user behavior data extracted from the security environment data and security service utilization data. The user behavior data may include data and metrics relating to how a user interacts with and uses one or more components and/or applications of the security environment. The security service utilization data may include security data collected by an intelligent computer security platform regarding a use by the subject entity of one or more security services provided by the platform. In addition to the security intelligence data collected and/or derived by the intelligent computer security platform, S240 may function to implement one or more intermediary services (e.g., external services and/or third-party services or data analysis applications integrated with the intelligent computer security platform, etc.) operating on or with the intelligent computer security platform. The one or more intermediary services may function to consume or ingest data from the security environment of the subject entity and in some embodiments, global security environment data from a collective of other entities, and produce resultant (security) analysis data (partially synthesized data) that may be used to augment the data collected and/or derived by the intelligent computer security platform. S240 may function to use the data collected from the intermediary services as input into the intelligent computer security platform for generating additional security environment data.
Additionally, or alternatively, S240 may function to identify security trends and behaviors based on an assessment of the security environment data. Specifically, S240 may function to use one or more of the identified security features and generated security metrics to develop or generate trend or behavioral graphs that illustrate a movement and/or development of specific security features, such as potential security issues or concerns, over time. Additionally, similar trends and behaviors may be generated using the security environment data of industry peers of the subject entity. In this way, S240 may include in the security environment assessment for the subject entity a comparison of the security environment of the subject entity to the security environments of other similarly-situated entities. In this way, a security performance of the subject entity relative to industry peers may be illustrated.
S240 may additionally aggregate the security assessments including one or more the generated security metrics, the generated security risk scores, the generated security trends and behaviors, and the like into a security environment assessment of the security environment of the subject entity that may be presented to an administrator of the security environment via a user interface (e.g., a security dashboard provided by the intelligent computer security platform).
S250, which includes generating computer security policy and computer security system configurations, functions to use one or more of the security environment data and the security environment assessment to generate computer security policy and computer security system configurations for a given entity.
In a preferred embodiment, S250 may function to implement a computer security engine that ingests the security environment data and other system-derived data (e.g., computer security assessments, security risk scores, etc.) and generates an output of optimal security policy and/or security configurations for a specific entity (e.g., a subject entity). In general, the generated or proposed security policy may indicate security requirements that, when implemented, govern a manner in which users of a security environment authenticate, geographic locations including acceptable IP addresses for authentication and/or access to resources of an environment, types or kinds of devices that may be used to authenticate and/or access computing and/or digital resources of the environment. The proposed security policies and security configurations may include requirements that may be applied system-wide, per application, per user, per groups of users, per device, per groups of devices, and the like.
For example, S250 may function to generate proposed computer security policy to restrict a class of devices from accessing a computing environment of the subject entity after determining from an assessment of the security environment data and/or learning over a period of evaluating the computing environment (e.g., from tracking device behavior and from inferences relating to the subject entity's risk thresholds) that the class of devices would be unexpected and potentially undesirable in the environment.
In a variant, S250 may function to crowdsource common or standard computer security configurations and integrate one or more of the crowd-sourced computer security configurations as a recommendation to the subject entity. In some embodiments, S250 may function to identify errors and/or discrepancies within crowd-sourced or common configurations to an administrator in order to better evaluate and differentiate platform-generated computer security policy and configuration proposals.
In yet another variant, S250 may function to generate computer security policy and/or computer security configurations based on collaborative filtering and/or clustering using computer security policy and configurations from disparate entities having satisfactory security health scores. In such embodiments, S250 may function to identify a plurality (group) of disparate entities having a satisfactory security health score (e.g., a security health score that satisfies a minimum-security health threshold, etc.) and further function to filter common or reoccurring computer security policy and/or computer security configurations from the group of disparate entities. Additionally, or alternatively, S250 may function to apply a clustering technique that clusters or aggregates together common or reoccurring computer security policy and/or computer security configurations from the group of disparate entities. Once S250 identifies a filtered set or clustered groups of computer security policy and/or configurations, S250 may function to generate one or more computer security policy and/or one or more computer security configurations based on the filtered set or clustered groups. In a specific example, the method can include: determining a cluster for the subject entity (e.g., based on security parameter values, the security environment, security data, security behavior, applications used, devices secured, industry, security assessment, etc.), identifying entities having satisfactory security scores within the cluster (e.g., scores above a threshold for one or more metrics), and generating a computer security policy and computer security system configurations based on the identified entities' security policies and/or computer security system configurations (e.g., recommending the identified entities' security policies and/or computer security system configurations to the user; synthesizing the identified entities' security policies and/or computer security system configurations to the user based on user needs; etc.). However, S250 can be otherwise performed.
S250 may additionally present the proposed security policy and proposed security configurations via a user interface. S250 may function to generate rationale that accompanies each of the security proposals indicating a research-based justification (e.g., industry best practices, etc.) for the security proposals.
Additionally, or alternatively, S250 identify comparable industry peers or the like and generate comparisons of a current security environment of the subject entity and the security environments of industry peers to illustrate security gaps and differences in security configurations and security policy. Additionally, or alternatively, the user interface may also illustrate a trend analysis over time of changes in one or more security factors or security features of the security environment that may additionally be compared to security trends of comparable entities or industry peers.
Additionally, or alternatively, S250 may function to provide via the user interface one or more selectable input features or input boxes that enables an administrator to accept or decline proposed security policy and proposed security configurations. In some embodiments, an acceptance by an administrator of a proposed security policy and/or a proposed security configuration may trigger an automatic implementation of the proposed security policy and/or proposed security configuration to the security environment of the subject entity without any additional intervention by the administrator. That is, an acceptance by the administrator preferably triggers the intelligent computer security platform to automatically modify security policy (if any) and/or modify security configurations of the security environment (e.g., networked devices, network applications, etc.) to be in alignment with the proposed security policy and proposed security configurations, as described in S270.
Additionally, or alternatively, an acceptance and preview request of a proposed security policy and proposed security configurations may function to trigger an automatic implementation of a security policy simulator. Specifically, S250 may function to use the security policy simulator to generate one or more simulations (e.g., computer models) of how the proposed security policy and/or the proposed security configurations would perform within the security environment of the subject entity. Accordingly, S250 may function to provide historical security environment data as simulator input into the simulator to determine how the proposed security policy and/or the proposed security configurations would have performed.
The resultant simulator data may include data that identifies a number of users and/or devices that may have been able to successfully authenticate into (or login) to the environment of a subject entity as well as a number of users and/or device that have been disallowed from accessing the environment (e.g., digital resources, devices, network(s), etc.) of the subject entity. Additionally, or alternatively, the simulator may function to simulate the effects of implementing the security policy and/or configurations with respect to the administrator of the security environment. In this way, the simulator may illustrate whether one or more of the security policies or configurations may inadvertently prevent access to the security environment by the administrator based on the historical activity data (e.g., authentication data, login data, etc.) of the administrator within the security environment.
Additionally, or alternatively, S250 may function to use the resultant simulator data to extrapolate or predict results of implementing the proposed security policy and/or proposed security configurations within the security environment.
If an administrator declines a computer security proposal, S250 may function to generate additional computer security proposals that may include computer security proposals with more stringent security policy and security configurations and/or computer security proposals with more lenient security policy and security configurations relative to the original computer security proposals that may have been declined by the administrator.
In a variant, S250 may enable an administrator of a security environment to provide input of a security risk tolerance and generate one or more proposals for computer security policies and/or computer security configurations based on the security risk tolerance input and/or the security environment data (including global security data sources and intelligence threat feeds, etc.). In some embodiments, the risk tolerance input provided by the administrator may be specific to one or more applications or components in an associated security environment. Alternatively, the risk tolerance input by the administrator may broadly apply to the overall security environment.
In a further variant, S250 may function to implement a user interface presenting one or more predetermined security environment queries to an administrator (e.g., a non-expert) of a security environment. S250 may function to collect the response data and convert the response data to input for an expert system, such as an artificially intelligent security system, that functions to generate (or infer) one or more security policy and/or security configurations based on the response data. The expert system may be any suitable artificially intelligent computer system that may function to implement one or more machine learning algorithms or knowledge base (e.g., facts and/or predetermined rules) for policy decisioning.
Optionally, S260 includes providing a security policy recommendation. In some embodiments, the security policy recommendation is provided to the subject entity and incorporates at least a subset of the generated computer security policy. In some embodiments, the security policy recommendation includes the computer security platform sending a prompt requesting a user, administrator, or other entity or representative of an entity to approve and/or accept the security policy recommendation. The entity may, in various embodiments, approve and/or accept the security policy recommendation, decline to accept, or adjust one or more components of the recommendation or generated computer security policy. In some embodiments, in response to an approval response, the computer security platform implements the recommendation. In some embodiments, in response to the subject entity declining to accept, one or more alternative recommendations are provided to the subject entity.
S270 optionally includes implementing the computer security policy and configuring the computer security system, in response to an acceptance of a computer security proposal. In some embodiments, at least a subset of the generated computer security policy is implemented, including one or more computer security configurations. In some embodiments, S270 may function to automatically implement the computer security policy changes and the computer security configuration changes to the security environment of the subject entity. In some embodiments, S270 may function to deploy one or more security applications that may be automatically installed on the relevant endpoint devices and/or components of a security environment. In some embodiments, S240 may function to deploy new and/or security authentication measures, such as two-factor authentication, that requires users and/or devices accessing network resources (e.g., networked devices or network applications) of the environment of the subject entity to successfully authenticate for gaining access. In some embodiments, S270 may designate trusted and untrusted devices and restrict access to the resources of the computing environment of the subject entity based on the designations (e.g., restrict untrusted devices).
The method of the preferred embodiment and variations thereof can be embodied and/or implemented at least in part as a machine configured to receive a computer-readable medium storing computer-readable instructions. The instructions are preferably executed by computer-executable components preferably integrated with a system for identifying phishing websites and hindering associated activity. The computer-readable medium can be stored on any suitable computer-readable media such as RAMs, ROMs, flash memory, EEPROMs, optical devices (CD or DVD), hard drives, floppy drives, or any suitable device. The computer-executable component is preferably a general or application specific processor, but any suitable dedicated hardware or hardware/firmware combination device can alternatively or additionally execute the instructions.
As a person skilled in the art will recognize from the previous detailed description and from the figures and claims, modifications and changes can be made to the preferred embodiments of the invention without departing from the scope of this invention defined in the following claims.
This application claims priority to U.S. Provisional Application Ser. No. 62/596,368, filed 8 Dec. 2017, which is incorporated in its entirety by this reference. Systems and methods disclosed herein can, in variants, incorporate or use the systems and/or methods disclosed in U.S. application Ser. No. 14/271,258 filed 6 May 2014, U.S. application Ser. No. 15/975,968 filed 10 May 2018, and U.S. application Ser. No. 15/896,382 filed 14 Feb. 2018, each of which are incorporated in their entirety by this reference.
| Number | Name | Date | Kind |
|---|---|---|---|
| 2639997 | Francis | May 1953 | A |
| 5754763 | Bereiter | May 1998 | A |
| 5838792 | Ganesan | Nov 1998 | A |
| 5870723 | Pare et al. | Feb 1999 | A |
| 6119096 | Mann et al. | Sep 2000 | A |
| 6209091 | Sudia et al. | Mar 2001 | B1 |
| 6311272 | Gressel | Oct 2001 | B1 |
| 6662205 | Bereiter | Dec 2003 | B1 |
| 6694025 | Epstein et al. | Feb 2004 | B1 |
| 6758394 | Maskatiya et al. | Jul 2004 | B2 |
| 6823359 | Heidingsfeld et al. | Nov 2004 | B1 |
| 6934858 | Woodhill | Aug 2005 | B2 |
| 6956950 | Kausik | Oct 2005 | B2 |
| 6990591 | Pearson | Jan 2006 | B1 |
| 6996716 | Hsu | Feb 2006 | B1 |
| 7000247 | Banzhof | Feb 2006 | B2 |
| 7093133 | Hopkins et al. | Aug 2006 | B2 |
| 7096354 | Wheeler et al. | Aug 2006 | B2 |
| 7107246 | Wang | Sep 2006 | B2 |
| 7146009 | Andivahis et al. | Dec 2006 | B2 |
| 7172115 | Lauden | Feb 2007 | B2 |
| 7213260 | Judge | May 2007 | B2 |
| 7331518 | Rable | Feb 2008 | B2 |
| 7334255 | Lin et al. | Feb 2008 | B2 |
| 7340600 | Corella | Mar 2008 | B1 |
| 7386720 | Sandhu et al. | Jun 2008 | B2 |
| 7447784 | Eun | Nov 2008 | B2 |
| 7463637 | Bou-Diab et al. | Dec 2008 | B2 |
| 7483384 | Bryant et al. | Jan 2009 | B2 |
| 7496662 | Roesch et al. | Feb 2009 | B1 |
| 7526792 | Ross | Apr 2009 | B2 |
| 7562382 | Hinton et al. | Jul 2009 | B2 |
| 7562385 | Thione et al. | Jul 2009 | B2 |
| 7571471 | Sandhu et al. | Aug 2009 | B2 |
| 7574733 | Woodhill | Aug 2009 | B2 |
| 7599493 | Sandhu et al. | Oct 2009 | B2 |
| 7630493 | Sandhu et al. | Dec 2009 | B2 |
| 7711122 | Allen et al. | May 2010 | B2 |
| 7712137 | Meier | May 2010 | B2 |
| 7716240 | Lim | May 2010 | B2 |
| 7733803 | Vogel et al. | Jun 2010 | B2 |
| 7764970 | Neil et al. | Jul 2010 | B2 |
| 7793110 | Durfee et al. | Sep 2010 | B2 |
| 7836501 | Sobel et al. | Nov 2010 | B2 |
| 7904608 | Price | Mar 2011 | B2 |
| 7953979 | Borneman et al. | May 2011 | B2 |
| 7958362 | Hwang | Jun 2011 | B2 |
| 7961645 | Gudipudi et al. | Jun 2011 | B2 |
| 7982595 | Hanna et al. | Jul 2011 | B2 |
| 7983987 | Kranzley et al. | Jul 2011 | B2 |
| 8001610 | Chickering et al. | Aug 2011 | B1 |
| 8010779 | Sermersheim et al. | Aug 2011 | B2 |
| 8028329 | Whitcomb | Sep 2011 | B2 |
| 8099368 | Coulter et al. | Jan 2012 | B2 |
| 8108933 | Mahaffey | Jan 2012 | B2 |
| 8136148 | Chayanam et al. | Mar 2012 | B1 |
| 8141146 | Ozeki | Mar 2012 | B2 |
| 8151333 | Zhu et al. | Apr 2012 | B2 |
| 8161527 | Curren | Apr 2012 | B2 |
| 8181253 | Zaitsev et al. | May 2012 | B1 |
| 8185740 | Choe et al. | May 2012 | B2 |
| 8185744 | Brown et al. | May 2012 | B2 |
| 8185962 | Moore | May 2012 | B2 |
| 8200980 | Robinson et al. | Jun 2012 | B1 |
| 8225392 | Dubrovsky et al. | Jul 2012 | B2 |
| 8245044 | Kang | Aug 2012 | B2 |
| 8250478 | Dharmarajan et al. | Aug 2012 | B2 |
| 8259947 | Gantman et al. | Sep 2012 | B2 |
| 8281401 | Pennington et al. | Oct 2012 | B2 |
| 8281403 | Asheghian et al. | Oct 2012 | B1 |
| 8321437 | Lim | Nov 2012 | B2 |
| 8332627 | Matthews et al. | Dec 2012 | B1 |
| 8335933 | Humphrey et al. | Dec 2012 | B2 |
| 8340287 | Sandhu et al. | Dec 2012 | B2 |
| 8340635 | Herz et al. | Dec 2012 | B2 |
| 8380192 | Kim et al. | Feb 2013 | B2 |
| 8381297 | Touboul | Feb 2013 | B2 |
| 8397212 | Chijiiwa | Mar 2013 | B2 |
| 8397301 | Hering et al. | Mar 2013 | B2 |
| 8397302 | Mont et al. | Mar 2013 | B2 |
| 8402526 | Ahn | Mar 2013 | B2 |
| 8418168 | Tyhurst et al. | Apr 2013 | B2 |
| 8458308 | Steves | Jun 2013 | B1 |
| 8458798 | Williams et al. | Jun 2013 | B2 |
| 8484708 | Chern | Jul 2013 | B2 |
| 8495720 | Counterman | Jul 2013 | B2 |
| 8499149 | Chen | Jul 2013 | B2 |
| 8499339 | Chao et al. | Jul 2013 | B2 |
| 8510820 | Oberheide et al. | Aug 2013 | B2 |
| 8522010 | Ozzie et al. | Aug 2013 | B2 |
| 8528039 | Chakarapani | Sep 2013 | B2 |
| 8533844 | Mahaffey et al. | Sep 2013 | B2 |
| 8538028 | Goeller et al. | Sep 2013 | B2 |
| 8539544 | Srinivasan et al. | Sep 2013 | B2 |
| 8539567 | Luxemberg et al. | Sep 2013 | B1 |
| 8548426 | Smith | Oct 2013 | B2 |
| 8549601 | Ganesan | Oct 2013 | B2 |
| 8571220 | Ollikainen et al. | Oct 2013 | B2 |
| 8578162 | Jentzsch et al. | Nov 2013 | B2 |
| 8588422 | Beachem et al. | Nov 2013 | B2 |
| 8595809 | Chayanam et al. | Nov 2013 | B2 |
| 8595822 | Schrecker et al. | Nov 2013 | B2 |
| 8601554 | Gordon et al. | Dec 2013 | B2 |
| 8612305 | Dominguez et al. | Dec 2013 | B2 |
| 8627438 | Bhimanaik | Jan 2014 | B1 |
| 8646060 | Ben Ayed | Feb 2014 | B1 |
| 8646086 | Chakra et al. | Feb 2014 | B2 |
| 8667288 | Yavuz | Mar 2014 | B2 |
| 8689287 | Bohmer et al. | Apr 2014 | B2 |
| 8700729 | Dua | Apr 2014 | B2 |
| 8707365 | Corl | Apr 2014 | B2 |
| 8707384 | Jain et al. | Apr 2014 | B2 |
| 8713329 | Schneider | Apr 2014 | B2 |
| 8713639 | Cheeniyil et al. | Apr 2014 | B2 |
| 8719930 | Lapsley et al. | May 2014 | B2 |
| 8732475 | Fahrny et al. | May 2014 | B2 |
| 8732839 | Hohl | May 2014 | B2 |
| 8737623 | Hart | May 2014 | B2 |
| 8745703 | Lambert et al. | Jun 2014 | B2 |
| 8751801 | Harris et al. | Jun 2014 | B2 |
| 8756651 | Baer et al. | Jun 2014 | B2 |
| 8756698 | Sidagni | Jun 2014 | B2 |
| 8763077 | Oberheide et al. | Jun 2014 | B2 |
| 8789178 | Kejriwal et al. | Jul 2014 | B2 |
| 8806609 | Gladstone et al. | Aug 2014 | B2 |
| 8806638 | Mani | Aug 2014 | B1 |
| 8813228 | Magee et al. | Aug 2014 | B2 |
| 8838759 | Eatough et al. | Sep 2014 | B1 |
| 8850017 | Ebrahimi et al. | Sep 2014 | B2 |
| 8850516 | Hrebicek et al. | Sep 2014 | B1 |
| 8850530 | Shahbazi | Sep 2014 | B2 |
| 8862097 | Brand et al. | Oct 2014 | B2 |
| 8891772 | D'Souza et al. | Nov 2014 | B2 |
| 8893230 | Oberheide et al. | Nov 2014 | B2 |
| 8898762 | Kang | Nov 2014 | B2 |
| 8903365 | Stricklen et al. | Dec 2014 | B2 |
| 8910268 | Hudis et al. | Dec 2014 | B2 |
| 8935769 | Hessler | Jan 2015 | B2 |
| 8938531 | Cotton et al. | Jan 2015 | B1 |
| 8938799 | Kuo | Jan 2015 | B2 |
| 8949596 | Yin et al. | Feb 2015 | B2 |
| 8949927 | Arnott et al. | Feb 2015 | B2 |
| 8955038 | Nicodemus et al. | Feb 2015 | B2 |
| 8955075 | Von Bokern et al. | Feb 2015 | B2 |
| 8959568 | Hudis et al. | Feb 2015 | B2 |
| 8966587 | Nair et al. | Feb 2015 | B2 |
| 8984276 | Benson et al. | Mar 2015 | B2 |
| 9037127 | Raleigh | May 2015 | B2 |
| 9043886 | Srinivasan et al. | May 2015 | B2 |
| 9049011 | Agrawal | Jun 2015 | B1 |
| 9049594 | Chen et al. | Jun 2015 | B2 |
| 9071611 | Yadav et al. | Jun 2015 | B2 |
| 9076343 | Chaar et al. | Jul 2015 | B2 |
| 9077758 | McGovern et al. | Jul 2015 | B1 |
| 9110754 | Poonamalli et al. | Aug 2015 | B2 |
| 9118656 | Ting et al. | Aug 2015 | B2 |
| 9122888 | Devi | Sep 2015 | B2 |
| 9124582 | Kalinichenko et al. | Sep 2015 | B2 |
| 9135458 | Hankins et al. | Sep 2015 | B1 |
| 9154387 | Maki et al. | Oct 2015 | B2 |
| 9172545 | Edstrom et al. | Oct 2015 | B2 |
| 9189491 | Fushman et al. | Nov 2015 | B2 |
| 9201644 | Klein et al. | Dec 2015 | B2 |
| 9203841 | Neuman et al. | Dec 2015 | B2 |
| 9210044 | Kacin et al. | Dec 2015 | B2 |
| 9215234 | Black | Dec 2015 | B2 |
| 9223961 | Sokolov | Dec 2015 | B1 |
| 9225840 | Malatack et al. | Dec 2015 | B2 |
| 9253185 | Alaranta et al. | Feb 2016 | B2 |
| 9258296 | Juthani | Feb 2016 | B2 |
| 9264443 | Weisman | Feb 2016 | B2 |
| 9270674 | Lang et al. | Feb 2016 | B2 |
| 9282085 | Oberheide et al. | Mar 2016 | B2 |
| 9338156 | Oberheide et al. | May 2016 | B2 |
| 9338163 | Wendling et al. | May 2016 | B2 |
| 9338176 | Trumbull et al. | May 2016 | B2 |
| 9344275 | Bar-El et al. | May 2016 | B2 |
| 9349000 | Du et al. | May 2016 | B2 |
| 9374654 | Lindeman et al. | Jun 2016 | B2 |
| 9386003 | Kumar | Jul 2016 | B2 |
| 9391980 | Krahn et al. | Jul 2016 | B1 |
| 9397892 | Kirner et al. | Jul 2016 | B2 |
| 9411963 | Robke et al. | Aug 2016 | B2 |
| 9430938 | Proud | Aug 2016 | B2 |
| 9443073 | Oberheide et al. | Sep 2016 | B2 |
| 9443084 | Nice et al. | Sep 2016 | B2 |
| 9454365 | Oberheide et al. | Sep 2016 | B2 |
| 9467463 | Oberheide et al. | Oct 2016 | B2 |
| 9479509 | Zeuthen | Oct 2016 | B2 |
| 9491189 | Zeitlin et al. | Nov 2016 | B2 |
| 9501315 | Desai et al. | Nov 2016 | B2 |
| 9544143 | Oberheide et al. | Jan 2017 | B2 |
| 9607155 | Beresnevichiene et al. | Mar 2017 | B2 |
| 9619307 | Maltese et al. | Apr 2017 | B2 |
| 9635041 | Warman et al. | Apr 2017 | B1 |
| 9659160 | Ligatti et al. | May 2017 | B2 |
| 9668137 | Sigurdson et al. | May 2017 | B2 |
| 9680864 | Khesin | Jun 2017 | B2 |
| 9706410 | Sreenivas et al. | Jul 2017 | B2 |
| 9723019 | Rathor | Aug 2017 | B1 |
| 9754097 | Hessler | Sep 2017 | B2 |
| 9762429 | Elmaliah | Sep 2017 | B2 |
| 9769538 | Killick | Sep 2017 | B2 |
| 9832221 | Newstadt et al. | Nov 2017 | B1 |
| 9918226 | Khan | Mar 2018 | B2 |
| 9940119 | Brownell et al. | Apr 2018 | B2 |
| 9996343 | Oberheide et al. | Jun 2018 | B2 |
| 20020013898 | Sudia et al. | Jan 2002 | A1 |
| 20020091745 | Ramamurthy et al. | Jul 2002 | A1 |
| 20020123967 | Wang | Sep 2002 | A1 |
| 20020131404 | Mehta et al. | Sep 2002 | A1 |
| 20020136410 | Hanna | Sep 2002 | A1 |
| 20030011545 | Sagano et al. | Jan 2003 | A1 |
| 20030012093 | Tada et al. | Jan 2003 | A1 |
| 20030061506 | Cooper et al. | Mar 2003 | A1 |
| 20030115452 | Sandhu et al. | Jun 2003 | A1 |
| 20030120931 | Hopkins et al. | Jun 2003 | A1 |
| 20030126472 | Banzhof | Jul 2003 | A1 |
| 20030147536 | Andivahis et al. | Aug 2003 | A1 |
| 20030149781 | Yared et al. | Aug 2003 | A1 |
| 20030172291 | Judge et al. | Sep 2003 | A1 |
| 20040064706 | Lin et al. | Apr 2004 | A1 |
| 20040139318 | Fiala et al. | Jul 2004 | A1 |
| 20040187018 | Owen et al. | Sep 2004 | A1 |
| 20040215672 | Pfitzner | Oct 2004 | A1 |
| 20040218763 | Gantman et al. | Nov 2004 | A1 |
| 20050024052 | Bendall et al. | Feb 2005 | A1 |
| 20050097350 | Patrick et al. | May 2005 | A1 |
| 20050097352 | Patrick et al. | May 2005 | A1 |
| 20050218215 | Lauden | Oct 2005 | A1 |
| 20050221268 | Chaar et al. | Oct 2005 | A1 |
| 20050240522 | Kranzley et al. | Oct 2005 | A1 |
| 20050268107 | Harris et al. | Dec 2005 | A1 |
| 20050268326 | Bhargavan | Dec 2005 | A1 |
| 20050278777 | Loza | Dec 2005 | A1 |
| 20060021018 | Hinton et al. | Jan 2006 | A1 |
| 20060024269 | Doyle et al. | Feb 2006 | A1 |
| 20060026304 | Price | Feb 2006 | A1 |
| 20060031938 | Choi | Feb 2006 | A1 |
| 20060059569 | Dasgupta et al. | Mar 2006 | A1 |
| 20060075475 | Boulos et al. | Apr 2006 | A1 |
| 20060101519 | Lasswell et al. | May 2006 | A1 |
| 20060130139 | Sobel et al. | Jun 2006 | A1 |
| 20060165060 | Dua | Jul 2006 | A1 |
| 20060182276 | Sandhu et al. | Aug 2006 | A1 |
| 20060184787 | Sandhu et al. | Aug 2006 | A1 |
| 20060184788 | Sandhu et al. | Aug 2006 | A1 |
| 20060195588 | Pennington et al. | Aug 2006 | A1 |
| 20060242692 | Thione et al. | Oct 2006 | A1 |
| 20070016948 | Dubrovsky et al. | Jan 2007 | A1 |
| 20070027961 | Holzer | Feb 2007 | A1 |
| 20070033148 | Cahill | Feb 2007 | A1 |
| 20070081667 | Hwang | Apr 2007 | A1 |
| 20070101145 | Sachdeva et al. | May 2007 | A1 |
| 20070143860 | Hardt | Jun 2007 | A1 |
| 20070156592 | Henderson | Jul 2007 | A1 |
| 20070156659 | Lim | Jul 2007 | A1 |
| 20070180490 | Renzi et al. | Aug 2007 | A1 |
| 20070185978 | Montulli | Aug 2007 | A1 |
| 20070186106 | Ting et al. | Aug 2007 | A1 |
| 20070199060 | Touboul | Aug 2007 | A1 |
| 20070204016 | Kunz et al. | Aug 2007 | A1 |
| 20070204346 | Meier | Aug 2007 | A1 |
| 20070228148 | Rable | Oct 2007 | A1 |
| 20070250914 | Fazal et al. | Oct 2007 | A1 |
| 20070254631 | Spooner | Nov 2007 | A1 |
| 20070258594 | Sandhu et al. | Nov 2007 | A1 |
| 20070284429 | Beeman | Dec 2007 | A1 |
| 20070297607 | Ogura et al. | Dec 2007 | A1 |
| 20080004964 | Messa et al. | Jan 2008 | A1 |
| 20080010665 | Hinton et al. | Jan 2008 | A1 |
| 20080012041 | Kesler | Jan 2008 | A1 |
| 20080034413 | He et al. | Feb 2008 | A1 |
| 20080049642 | Gudipudi et al. | Feb 2008 | A1 |
| 20080059804 | Shah et al. | Mar 2008 | A1 |
| 20080069347 | Brown et al. | Mar 2008 | A1 |
| 20080120411 | Eberle | May 2008 | A1 |
| 20080134311 | Medvinsky et al. | Jun 2008 | A1 |
| 20080198856 | Vogel et al. | Aug 2008 | A1 |
| 20080201186 | Poon et al. | Aug 2008 | A1 |
| 20080215675 | Kaminitz et al. | Sep 2008 | A1 |
| 20080229104 | Ju et al. | Sep 2008 | A1 |
| 20080301669 | Rao et al. | Dec 2008 | A1 |
| 20090055906 | Von | Feb 2009 | A1 |
| 20090077060 | Sermersheim et al. | Mar 2009 | A1 |
| 20090083225 | Jacobs et al. | Mar 2009 | A1 |
| 20090167489 | Nan et al. | Jul 2009 | A1 |
| 20090177675 | Trumbull et al. | Jul 2009 | A1 |
| 20090187986 | Ozeki | Jul 2009 | A1 |
| 20090198997 | Yeap et al. | Aug 2009 | A1 |
| 20090210705 | Chen | Aug 2009 | A1 |
| 20090254978 | Rouskov et al. | Oct 2009 | A1 |
| 20090259848 | Williams et al. | Oct 2009 | A1 |
| 20090271863 | Govindavajhala et al. | Oct 2009 | A1 |
| 20090300596 | Tyhurst et al. | Dec 2009 | A1 |
| 20090300707 | Garimella et al. | Dec 2009 | A1 |
| 20090328178 | McDaniel et al. | Dec 2009 | A1 |
| 20100002378 | Chen et al. | Jan 2010 | A1 |
| 20100011433 | Harrison | Jan 2010 | A1 |
| 20100018000 | Hsu | Jan 2010 | A1 |
| 20100023781 | Nakamoto | Jan 2010 | A1 |
| 20100026302 | Doty et al. | Feb 2010 | A1 |
| 20100036931 | Certain et al. | Feb 2010 | A1 |
| 20100042954 | Rosenblatt et al. | Feb 2010 | A1 |
| 20100050263 | Weisman | Feb 2010 | A1 |
| 20100069104 | Neil et al. | Mar 2010 | A1 |
| 20100100725 | Ozzie et al. | Apr 2010 | A1 |
| 20100100924 | Hinton | Apr 2010 | A1 |
| 20100100963 | Mahaffey | Apr 2010 | A1 |
| 20100107225 | Spencer et al. | Apr 2010 | A1 |
| 20100114740 | Dominguez et al. | May 2010 | A1 |
| 20100115578 | Nice et al. | May 2010 | A1 |
| 20100121767 | Coulter et al. | May 2010 | A1 |
| 20100125737 | Kang | May 2010 | A1 |
| 20100131755 | Zhu et al. | May 2010 | A1 |
| 20100180001 | Hardt | Jul 2010 | A1 |
| 20100186082 | Ladki et al. | Jul 2010 | A1 |
| 20100202609 | Sandhu et al. | Aug 2010 | A1 |
| 20100216425 | Smith | Aug 2010 | A1 |
| 20100217986 | Schneider | Aug 2010 | A1 |
| 20100233996 | Herz et al. | Sep 2010 | A1 |
| 20100257610 | Hohl | Oct 2010 | A1 |
| 20100263021 | Arnott et al. | Oct 2010 | A1 |
| 20100263046 | Polavarapu | Oct 2010 | A1 |
| 20100274859 | Bucuk | Oct 2010 | A1 |
| 20100319068 | Abbadessa et al. | Dec 2010 | A1 |
| 20100330969 | Kim et al. | Dec 2010 | A1 |
| 20110026716 | Tang et al. | Feb 2011 | A1 |
| 20110047597 | Barton et al. | Feb 2011 | A1 |
| 20110055903 | Leggette | Mar 2011 | A1 |
| 20110086616 | Brand et al. | Apr 2011 | A1 |
| 20110107389 | Chakarapani | May 2011 | A1 |
| 20110113484 | Zeuthen | May 2011 | A1 |
| 20110119765 | Hering et al. | May 2011 | A1 |
| 20110138469 | Ye et al. | Jun 2011 | A1 |
| 20110145900 | Chern | Jun 2011 | A1 |
| 20110179472 | Ganesan | Jul 2011 | A1 |
| 20110185287 | Dharmarajan et al. | Jul 2011 | A1 |
| 20110185431 | Deraison | Jul 2011 | A1 |
| 20110197266 | Chu et al. | Aug 2011 | A1 |
| 20110197267 | Gravel et al. | Aug 2011 | A1 |
| 20110219449 | St et al. | Sep 2011 | A1 |
| 20110225637 | Counterman | Sep 2011 | A1 |
| 20110231265 | Brown et al. | Sep 2011 | A1 |
| 20110277025 | Counterman | Nov 2011 | A1 |
| 20110277034 | Hanson | Nov 2011 | A1 |
| 20110282908 | Fly et al. | Nov 2011 | A1 |
| 20110289582 | Kejriwal et al. | Nov 2011 | A1 |
| 20110302410 | Clarke et al. | Dec 2011 | A1 |
| 20110302630 | Nair et al. | Dec 2011 | A1 |
| 20120029084 | Wong | Feb 2012 | A1 |
| 20120030093 | Farias | Feb 2012 | A1 |
| 20120060360 | Liu | Mar 2012 | A1 |
| 20120063601 | Hart | Mar 2012 | A1 |
| 20120090028 | Lapsley et al. | Apr 2012 | A1 |
| 20120096274 | Campagna et al. | Apr 2012 | A1 |
| 20120110671 | Beresnevichiene et al. | May 2012 | A1 |
| 20120117229 | Van et al. | May 2012 | A1 |
| 20120117626 | Yates et al. | May 2012 | A1 |
| 20120151567 | Chayanam et al. | Jun 2012 | A1 |
| 20120159600 | Takagi | Jun 2012 | A1 |
| 20120198050 | Maki et al. | Aug 2012 | A1 |
| 20120198228 | Oberheide et al. | Aug 2012 | A1 |
| 20120216239 | Yadav et al. | Aug 2012 | A1 |
| 20120227098 | Obasanjo et al. | Sep 2012 | A1 |
| 20120254957 | Fork et al. | Oct 2012 | A1 |
| 20120278454 | Stewart et al. | Nov 2012 | A1 |
| 20120290841 | Jentzsch | Nov 2012 | A1 |
| 20120300931 | Ollikainen et al. | Nov 2012 | A1 |
| 20120317287 | Amitai et al. | Dec 2012 | A1 |
| 20120321086 | D'Souza et al. | Dec 2012 | A1 |
| 20120323950 | Wilson et al. | Dec 2012 | A1 |
| 20130004200 | Okabe | Jan 2013 | A1 |
| 20130007848 | Chaskar et al. | Jan 2013 | A1 |
| 20130008110 | Rothwell | Jan 2013 | A1 |
| 20130012429 | Eddowes et al. | Jan 2013 | A1 |
| 20130017968 | Gurtner et al. | Jan 2013 | A1 |
| 20130024628 | Benhase et al. | Jan 2013 | A1 |
| 20130042002 | Cheeniyil et al. | Feb 2013 | A1 |
| 20130055233 | Hatton et al. | Feb 2013 | A1 |
| 20130055247 | Hiltgen et al. | Feb 2013 | A1 |
| 20130055289 | Maltese et al. | Feb 2013 | A1 |
| 20130060708 | Oskolkov et al. | Mar 2013 | A1 |
| 20130067538 | Dharmarajan et al. | Mar 2013 | A1 |
| 20130074601 | Jackson | Mar 2013 | A1 |
| 20130081101 | Baer et al. | Mar 2013 | A1 |
| 20130086210 | Yiu et al. | Apr 2013 | A1 |
| 20130086658 | Kottahachchi et al. | Apr 2013 | A1 |
| 20130091544 | Oberheide | Apr 2013 | A1 |
| 20130097585 | Jentsch et al. | Apr 2013 | A1 |
| 20130110676 | Kobres | May 2013 | A1 |
| 20130117826 | Gordon et al. | May 2013 | A1 |
| 20130124292 | Juthani | May 2013 | A1 |
| 20130125226 | Shah et al. | May 2013 | A1 |
| 20130174246 | Schrecker et al. | Jul 2013 | A1 |
| 20130179681 | Benson et al. | Jul 2013 | A1 |
| 20130239167 | Sreenivas et al. | Sep 2013 | A1 |
| 20130239168 | Sreenivas et al. | Sep 2013 | A1 |
| 20130239177 | Sigurdson et al. | Sep 2013 | A1 |
| 20130246281 | Yamada et al. | Sep 2013 | A1 |
| 20130263211 | Neuman et al. | Oct 2013 | A1 |
| 20130276142 | Peddada | Oct 2013 | A1 |
| 20130310006 | Chen et al. | Nov 2013 | A1 |
| 20130311776 | Besehanic | Nov 2013 | A1 |
| 20130326224 | Yavuz | Dec 2013 | A1 |
| 20130326493 | Poonamalli et al. | Dec 2013 | A1 |
| 20140001975 | Lee et al. | Jan 2014 | A1 |
| 20140007238 | Magee et al. | Jan 2014 | A1 |
| 20140019752 | Yin et al. | Jan 2014 | A1 |
| 20140020051 | Lu et al. | Jan 2014 | A1 |
| 20140020184 | Loth | Jan 2014 | A1 |
| 20140047546 | Sidagni | Feb 2014 | A1 |
| 20140181517 | Alaranta et al. | Jun 2014 | A1 |
| 20140181520 | Wendling et al. | Jun 2014 | A1 |
| 20140188796 | Fushman et al. | Jul 2014 | A1 |
| 20140189863 | Rorabaugh et al. | Jul 2014 | A1 |
| 20140201841 | Deshpande et al. | Jul 2014 | A1 |
| 20140208405 | Hashai | Jul 2014 | A1 |
| 20140235230 | Raleigh | Aug 2014 | A1 |
| 20140237236 | Kalinichenko et al. | Aug 2014 | A1 |
| 20140244993 | Chew | Aug 2014 | A1 |
| 20140245278 | Zellen | Aug 2014 | A1 |
| 20140245396 | Oberheide et al. | Aug 2014 | A1 |
| 20140247140 | Proud | Sep 2014 | A1 |
| 20140297840 | Qureshi | Oct 2014 | A1 |
| 20140310415 | Kirner et al. | Oct 2014 | A1 |
| 20140351954 | Brownell et al. | Nov 2014 | A1 |
| 20140376543 | Malatack et al. | Dec 2014 | A1 |
| 20150002646 | Namii | Jan 2015 | A1 |
| 20150012914 | Klein et al. | Jan 2015 | A1 |
| 20150026461 | Devi | Jan 2015 | A1 |
| 20150040194 | Chaskar et al. | Feb 2015 | A1 |
| 20150058983 | Zeitlin et al. | Feb 2015 | A1 |
| 20150163121 | Mahaffey et al. | Jun 2015 | A1 |
| 20150172321 | Kirti | Jun 2015 | A1 |
| 20150213259 | Du et al. | Jul 2015 | A1 |
| 20150213268 | Nance et al. | Jul 2015 | A1 |
| 20150237026 | Kumar | Aug 2015 | A1 |
| 20150242643 | Hankins et al. | Aug 2015 | A1 |
| 20150261955 | Huang et al. | Sep 2015 | A1 |
| 20150281318 | Warner et al. | Oct 2015 | A1 |
| 20150304351 | Oberheide et al. | Oct 2015 | A1 |
| 20150312233 | Graham et al. | Oct 2015 | A1 |
| 20150381662 | Nair | Dec 2015 | A1 |
| 20160005696 | Tomohiro | Jan 2016 | A1 |
| 20160018007 | Eckholz | Jan 2016 | A1 |
| 20160021117 | Harmon et al. | Jan 2016 | A1 |
| 20160028639 | Wong et al. | Jan 2016 | A1 |
| 20160030023 | Hayakawa et al. | Feb 2016 | A1 |
| 20160056962 | Mehtälä | Feb 2016 | A1 |
| 20160080366 | Agarwal | Mar 2016 | A1 |
| 20160099963 | Mahaffey | Apr 2016 | A1 |
| 20160164866 | Oberheide et al. | Jun 2016 | A1 |
| 20160180072 | Ligatti et al. | Jun 2016 | A1 |
| 20160180343 | Poon et al. | Jun 2016 | A1 |
| 20160212129 | Johnston et al. | Jul 2016 | A1 |
| 20160286391 | Khan | Sep 2016 | A1 |
| 20160300231 | Shavell et al. | Oct 2016 | A1 |
| 20160314301 | Johns et al. | Oct 2016 | A1 |
| 20160366589 | Jean | Dec 2016 | A1 |
| 20170039242 | Milton et al. | Feb 2017 | A1 |
| 20170046519 | Cam | Feb 2017 | A1 |
| 20170169066 | Mantri et al. | Jun 2017 | A1 |
| 20170214701 | Hasan | Jul 2017 | A1 |
| 20180027006 | Zimmermann | Jan 2018 | A1 |
| 20180205726 | Chari | Jul 2018 | A1 |
| Number | Date | Country |
|---|---|---|
| 2007075850 | Jul 2007 | WO |
| 2014150073 | Sep 2014 | WO |
| Entry |
|---|
| “Neuenhofen, Kay, and Mathew Thompson. ““A secure marketplace for mobile java agents.”” Proceeding of the second international Conference on Autonomous agents. ACM, 1998. {pp. 212-218).” |
| “Symantec, Administration guide for symantec Endpoint protection and symantec network access control, 2009, version 11.00.05.00.00”. |
| “Symantec, Administration Guide for Symantec TM Endpoint Protection and Symantec Network Access Control, Aug. 1, 2007”. |
| Stone-Gross, Brett, et al., “Peering Through the iFrame”, INFOCOM Proceeding, IEEE, Apr. 10-15, 2011, pp. 111-415. |
| Yao, Qiong, et al.,“Effective Iframe-based Strategy for Processing Dynamic Data in Embedded Browser”, International Conference on Advanced Computer Theory and Engineering (ICACTE), IEEE, Dec. 20-22, 2008, pp. 538-542. |
| “Simske et al., “APEX: Automated Policy Enforcement eXchange”, Sep. 21-24, 2010, ACM, pp. 139-142.” |
| “Kher Vishal; et al. “Securing distributed storage: challenges, techniques and systems.” Proceedings of the 2005 ACM workshop on Storage security and survivability. ACM, 2005, pp. 9-25.”, Feb. 6, 2018 00:00:00.0. |
| “Goldfeder et al., Securing Bitcoin wallets via a new DSA/ECDSA threshold signature scheme, http://www.cs.princeton.edu/˜stevenag/threshold_sigs.pdf”. |
| “Edge, Kenneth, et al. “The use of attack and protection trees to analyze security for an online banking system.” System Sciences, 2007. HICSS 2007. 40th Annual Hawaii International Conference on. IEEE, 2007.” |
| “Aloul S Zahidi; et al. “Two factor authentication using mobile phones,” 2009 IEEE/ACS International Conference on Computer Systems and Applications, Rabat, 2009, pp. 641-644.”, Feb. 6, 2018 00:00:00.0. |
| “Bonneau Joseph; et al. “Passwords and the evolution of imperfect authentication.” Communications of the ACM 58.7 (2015): 78-87.”, Feb. 6, 2018 00:00:00.0. |
| Number | Date | Country | |
|---|---|---|---|
| 20190182287 A1 | Jun 2019 | US |
| Number | Date | Country | |
|---|---|---|---|
| 62596368 | Dec 2017 | US |
