A system and method for maintaining security in a distributed computing environment comprises a policy manager located on a server for managing and distributing a security policy, and an application guard located on a client for managing access to securable components as specified by the security policy. In the preferred embodiment, a global policy specifies access privileges of the user to securable components. The policy manager may then preferably distribute a local client policy based on the global policy to the client. An application guard located on the client then manages access to the securable components as specified by the local policy.

System and method for maintaining security in a distributed computer network

In an information management system, relevant policies are deployed to targets while policies which are not relevant are not. By deploying relevant policies, this reduces the amount of space requirements at the target to store the policies and the amount of data that needs to be sent to the target. Also, execution speed at the target may increase since the target does not need to evaluate policies that are not relevant.

Techniques and system to deploy policies intelligently

Systems and methods of securing a computing network are described Communication from unauthorized devices is prevented by defining one or more dynamic policy enforcement points (DPEPs) on a network segment and specifying one of these DPEPs as an active policy enforcement point (APEP) The APEP prevents communication from unauthorized devices by spoofing an ARP response If an APEP becomes unavailable, another of the one or more DPEPs is automatically selected as a new APEP Members of the one or more DPEPs may be non-dedicated devices configured as DPEPs by the addition of security software The number of DPEPs and APEPs can automatically scale with the number of devices on the computing network

Network access control including dynamic policy enforcement point

Utilizing a server-based rules-based action framework, methods and systems gather status and configuration information about each of a plurality of mobile devices, which include devices from different mobile platforms At the server, software processes monitor status information and respond automatically to changes, causing administrator-selected rules to be evaluated to determine if an action should automatically be initiated

Rules based actions for mobile device management

A computer-based system provides secure, configurable access to computer network resources. A human-readable language is provided for defining access policy rules. Rules in this language are converted in an automated fashion into filters applied within the various subsystems and components in a multi-layer security system. Network users are authenticated by an access control security system that obtains basic information about that user. Based on the user ID, a set of abstract policies can be retrieved. The retrieved policies are associated with the user and the groups associated with that user. Based on the retrieved rules, a set of rules for multiple layers of the network are generated and applied to those subsystems. Two or more of the subsystems may be placed in series with different types of processing occurring in each of the subsystems, reducing the workload of subsequent subsystems.

Multilayer access control security system

A system and method for generating an updated version of, or reconstructing a previously enforced version of, a local client security policy stored in an application guard. To update a local security policy, a policy manager distributes a change (or an accumulation of changes) to the currently enforced version of the security policy through a network to the application guard. The application guard uses the distributed change to update the currently enforced version of the local client security policy. To reconstruct a previously enforced version of a local security policy, the policy manager generates a reversing delta equal to the reverse of the change (or accumulation of changes) from the previously enforced version to the currently enforced version of the security policy, and distributes the reversing delta through the network to the application guard. The application guard applies the distributed reversing delta to the currently enforced version of the local client security policy to reconstruct the previously enforced version of the security policy.

System and method for incrementally distributing a security policy in a computer network

A system and method for analyzing a global security policy in a distributed computing environment. In one embodiment the security policy is a global security policy which is stored in, and managed by, a policy manager located on a server. In another embodiment the security policy is a local client security policy stored in an application guard located on a client server which manages access to various securable components of the distributed computing environment.

System and method for analyzing security policies in a distributed computer network

A system and method for analyzing application security policies is provided. One or more application security policies are retrieved. An optimized policy is then generated utilizing the one or more application security policies. One or more queries related to the one or more application security policies are received. The one or more queries are decomposed. The one or more decomposed queries are then processed utilizing the optimized policy.

Mark S. Moriconi

Papers

System and method for incrementally distributing a security policy in a computer network

System and method for analyzing security policies in a distributed computer network

Systems and methods for analyzing application security policies