Protected access control method for shared computer resources
View Patent ↗In embodiments of the present invention improved capabilities are described for providing protected computer communications. The present invention may provide for computer communications where in response to a receipt of a communication at a first computing facility from a second computing facility, the first computing facility may be caused to send a request to a compliance center for security compliance information relating to the second computing facility. In response to the request for security compliance information, the first computing facility may receive compliance information related to the second computing facility, which may cause the first computing facility to perform an action regulating further communications from the second computing facility if the second computing facility security compliance information indicates that the second client computing facility is not compliant with a current security policy.
1. A computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of:
joining a first computing facility to an enterprise network managed by a security management facility;
in response to a receipt of a communication at the first computing facility from a second computing facility within the enterprise network, causing the first computing facility to send a request to a compliance center for security compliance information relating to the second computing facility;
in response to the request for security compliance information, receiving at the first computing facility the second computing facility security compliance information; and
causing the first computing facility to perform an action regulating further communications from the second computing facility if the second computing facility security compliance information indicates that the second computing facility is not compliant with a current security policy.
2. The computer program product of claim 1 , wherein the communication is an access request to a shared computer resource.
3. The computer program product of claim 1 , wherein the compliance center is centrally located on the enterprise network.
4. The computer program product of claim 1 , wherein the compliance center is distributed across at least two of a plurality of endpoint computing facilities.
5. The computer program product of claim 1 , wherein the compliance center is updated automatically.
6. The computer program product of claim 1 , wherein the security compliance information is the detection of security software on the second computing facility.
7. The computer program product of claim 1 , wherein the security compliance information is related to updates of security software.
8. The computer program product of claim 1 , wherein the security compliance information is related to the version of security software.
9. The computer program product of claim 1 , wherein the security compliance information is related to malware detection software.
10. The computer program product of claim 1 , wherein the security compliance information is an enabled firewall in the second computing facility.
11. The computer program product of claim 1 , wherein the action is to block further communications from the second computer facility.
12. The computer program product of claim 1 , wherein the action is to block access to shared resources in the first computing facility.
13. The computer program product of claim 1 , wherein the action is to block transfers of data to the first computing facility.
14. The computer program product of claim 1 , wherein further communications relates only to writing of data to the first computing facility.
15. The computer program product of claim 1 , wherein the current security policy is maintained in a central policy management facility.
16. A computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of:
joining a first computing facility to an enterprise network managed by a security management facility;
receiving at the first computing facility security compliance information indicating that the first computing facility is currently in compliance and indicating a period of time for which the first computing facility is to be considered in compliance;
sending a communication from the first computing facility to a second computing facility within the enterprise network, wherein the communication includes the security compliance information; and
causing the second computing facility to check the security compliance information for an in-security-compliance indication before accepting further communications from the first computing facility.
17. The computer program product of claim 16 , wherein the security compliance information is received from a compliance center.
18. The computer program product of claim 16 , wherein the second computing facility checks the security compliance information with a local database of compliance information.
19. The computer program product of claim 16 , wherein the second computing facility checks the security compliance information with a networked database of compliance information.
20. A computer program product embodied in a computer readable medium that, when executing on one or more computers, performs the steps of:
joining a first computing facility to an enterprise network managed by a security management facility;
in response to a receipt of a communication at the first computing facility from a second computing facility, causing the first computing facility to send a compliance information request to the second computing facility, wherein the compliance information request checks the second computing facility's operating system's ability to communicate security compliance information to a compliance center; and
in response to receiving an indication that the second computing facility does not send compliance information to the compliance center, allowing further communications from the second computing facility to be received and processed by the first computing facility.