Granted Patent B1

US 8,271,642 · App. 11/847,185 · Granted Sep 18, 2012

Abstract

Claims (26)

1. A computer-implemented method, comprising:

identifying at least potential data leakage activity associated with a device;

notifying over a network, in response to the act of identifying, a computer server of the detected potential data leakage activity;

receiving, from the computer server, instructions on how to respond to the potential data leakage activity, said instructions obtained by a user selection upon a user interface displaying two or more choices regarding potential responses, said choices comprising at least the functions of disabling a node, disabling an account and a locking device; and

performing a first action in accordance with the instructions, wherein performance of a second action is contingent on both the failure of performing the first action and an indication by the user to perform the second action.

2. The method of claim 1 , wherein the act of performing the first action includes restricting access of the device to a physical area.

3. The method of claim 1 , wherein the choice of disabling an account includes restricting access to a directory on the device.

4. The method of claim 1 , wherein the act of performing the first action includes quarantining the device.

5. The method of claim 1 , wherein the act of receiving instructions is performed subsequent to the act of identifying the at least potential data leakage activity.

6. The method of claim 1 , wherein

an indication by the user to perform the second action is the user selection upon said user interface.

7. The method of claim 1 , wherein the act of receiving instructions comprises receiving at least one instruction, wherein the at least one instruction is divided into subparts based on a threat level of the potential data leakage activity.

8. The method of claim 1 , further comprising performing at least a third action in accordance with the instructions.

9. The method of claim 1 , wherein the act of performing a first action comprises performing the at least one action based on a severity of the potential data leakage activity.

10. The method of claim 1 , further comprising the steps of:

monitoring network activity of the device;

determining an intent for the potential data leakage activity; and

identifying one or more possible responses to the potential data leakage activity based on the determined intent.

11. The method of claim 10 , wherein the act of monitoring comprises monitoring one or more of the following of the device: data transfers, communication, file accesses and directory accesses.

12. The method of claim 10 , further comprising restricting network access of at least one other device in response to the potential data leakage activity.

13. The method of claim 1 , further comprising, restricting network access of at least one other device in response to the potential data leakage activity.

14. A computer program product embodied on a non-transitory computer readable medium, comprising:

computer code for identifying at least potential data leakage activity associated with a device;

computer code for notifying, in response the identifying, a computer server of the detected potential data leakage activity;

computer code for receiving, from the computer server, instructions on how to respond to the potential data leakage activity, said instructions obtained through an interface for accepting user selections, said interface comprising two or more choices regarding potential responses, said choices indicating at least the functions of disabling a node, disabling an account and locking a device; and

computer code for performing a first action in accordance with the instructions, wherein execution of computer code for performing a second action is contingent on the failure of performing the first action.

Assignments (10)