Policy management
In embodiments of the present invention improved capabilities are described for the operation of a threat management facility, wherein the threat management facility may provide for a plurality of computer asset protection services to a corporate computer network. The threat management facility may provide a policy management service as one of the plurality of protection services, wherein the policy management service may be adapted to provide corporate policy updates to a plurality of computer facilities associated with the corporate computer network. In addition, the corporate policy updates, and a related corporate policy, may relate to the acceptability of an operation of a computer application.
1. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on a client device, performs the steps of:
receiving a policy at the client device for use by the client device, the policy including a plurality of rules, the plurality of rules including a different rule for each corresponding application category of a plurality of application categories, the application categories including at least e-mail and browser, wherein each application category in the plurality of application categories is associated with a class of applications, with each application in the class of applications having one or more common application characteristics;
storing the policy on the client device;
monitoring activity on the client device for a request to execute a requested application;
when the request is detected, performing the steps of:
interrupting a processing of the request by the client device;
determining a combination of genes for the requested application, wherein the genes identify functional blocks of the requested application, wherein the functional blocks are selected for behavioral analysis and are representative of at least one function and at least one execution flow of the requested application; and
categorizing the requested application into one of the classes of applications based upon behavior indicated by the at least one function and at least one execution flow represented in the combination of genes; and
conditionally authorizing or prohibiting execution of the requested application on the client device according to one or more of the rules of the policy applicable to the one of the classes of the requested application.
2. The computer program product of claim 1 further comprising code that, when executing on the client device, performs the step of receiving an update to the policy from a threat management facility that provides protection services to a plurality of computing devices associated with a corporate network.
3. The computer program product of claim 1 wherein the policy includes at least one of a white list of acceptable applications, a white list of a group of application types, a black list of unacceptable applications, and a black list of unacceptable application types.
4. The computer program product of claim 1 wherein the client device includes at least one of a desktop computer, a laptop computer, a tablet computer, a handheld computer, PDA, mobile phone, a server, a web server, and a file server that operates a local version of a policy manager that is updated by a policy management service.
5. The computer program product of claim 4 wherein the policy manager contains a white list of acceptable applications, white list of acceptable application types, black list of unacceptable applications, and a black list of unacceptable application types for which the computer facility can execute.
6. The computer program product of claim 1 further comprising code that, when executing on the client device, performs the step of updating the policy from a server-based threat management facility.
7. The computer program product of claim 1 further comprising code that, when executing on the client device, performs the step of updating the policy from a third party service external to a corporate network associated with the client device.
8. The computer program product of claim 1 further comprising code that, when executing on the client device, performs the step of providing internal policy management tools to a corporation associated with a corporate network of the client device, the internal policy management tools facilitating modifications to the policy and updating of the policy on the client device through the corporate network.
9. The computer program product of claim 1 further comprising code that, when executing on the client device, performs the step of updating the policy with a list provided by a corporation associated with a corporate network of the client device, the list identifying at least one of acceptable and unacceptable applications or group of application types.
10. The computer program product of claim 1 further comprising code that, when executing on the client device, performs the steps of:
updating the policy with a policy management service; and
providing a malicious code protection update service from the policy management service.
11. The computer program product of claim 1 wherein the requested application executes locally on the client device.
12. The computer program product of claim 1 wherein the requested application includes at least one of a network application and a web application.
13. The computer program product of claim 1 further comprising code that, when executing on the client device, performs the steps of:
updating the policy with a policy management service; and
providing a firewall service to the client device from a threat management facility.
14. The computer program product of claim 1 further comprising code that, when executing on the client device, performs the step of transmitting a user-requested policy modification for the policy to a user feedback module of a policy management service.
15. The computer program product of claim 1 wherein the policy identifies one or more user types, and wherein conditionally authorizing execution of the application includes conditionally authorizing execution according to a user type for a user of the client device.
16. The computer program product of claim 1 further comprising code that, when executing on the client device, performs the step of updating the policy in accordance with a corporate policy.
17. The computer program product of claim 1 wherein conditionally authorizing use of the application includes modifying an execution behavior of the requested application by restricting access by the requested application to one or more resources of the client device.
18. The computer program product of claim 17 wherein the one or more resources includes network access.
19. The computer program product of claim 1 wherein the policy authorizes use of different categories of applications for different user types.