Methods and systems for network-based management of application security
To control privileges and access to resources on a per-process basis, an administrator creates a rule that may be applied to modify a process's token. The rule includes an application-criterion set and changes to be made to the groups and/or privileges of a token. The rule is set as a policy within a group policy object (GPO), where a GPO is associated with one or more groups of computers. When a GPO containing a rule is applied to a computer, a driver installed on the computer accesses the rule(s) anytime a logged-on user executes a process. If the executed process satisfies the criterion set of a rule the changes contained within the rule are made to the process token, and the user has expanded and/or contracted access and/or privileges for only that process.
1. A computer program product for modifying access to securable objects, the computer program product comprising program instructions stored on a non-transitory computer readable medium, the program instructions to be executed by a processor to perform a method, the method comprising:
providing a rule that includes an application-criterion set including at least one criterion for modifying a token of a process during execution of the process in accordance with the rule, wherein the rule specifies at least one group to be added to the token of the process if the process satisfies the application-criterion set, wherein access to securable objects by the process is controlled by an operating system in accordance with the token, and wherein at least one said specified group is a group other than an Administrators group; and
before the operating system employs the process's token to determine the process's access to securable objects:
making a determination of whether the process satisfies the application-criterion set; and
if and only if the determination is affirmative, adding to or removing from the process's token in response to the rule each group or user that the rule specifies.
2. The computer program product according to claim 1 , wherein:
the rule is one of a plurality of rules;
the method further comprises assigning relative priorities to the plurality of rules; and
adding a group to the process's token in response to a given rule occurs only if the process satisfies the application-criterion set of no other rule whose priority is higher than a priority of the given rule.
3. The computer program product according to claim 1 , wherein:
the process executes an executable entity; and
the at least one criterion is that the executable entity matches an executable-entity identifier specified by the at least one criterion.
4. The computer program product according to claim 3 , wherein the executable entity is an executable file.
5. The computer program product according to claim 4 , wherein the executable-entity identifier is a hash on the executable file's contents.
6. The computer program product according to claim 4 , wherein the executable-entity identifier represents the executable file's path.
7. The computer program product according to claim 1 , wherein:
the rule further specifies at least one privilege to be added to or removed from the token of the process that satisfies the application-criterion set; and
the method further comprises adding or removing each privilege that the rule specifies to a process's token if the process satisfies the application-criterion set.
8. The computer program product according to claim 1 , wherein the at least one criterion is that a user match a user identifier specified by the at least one criterion.
9. A computer program product that modifies a user's privileges to perform system-related operations, the computer program product comprising program instructions stored on a non-transitory computer readable medium, the program instructions to be executed by a processor to perform a method, the method comprising:
providing a rule that includes an application-criterion set including at least one criterion for token modification in accordance with the rule, wherein the rule specifies at least one privilege to be added to a token of a process if the process satisfies the application-criterion set, and wherein performance of system operations by the process is controlled by an operating system in accordance with the token; and
before the operating system employs a process's token to determine the process's privileges:
making a determination of whether the process satisfies the application-criterion set; and
if and only if the determination is affirmative, adding to the process's token in response to the rule each privilege that the rule specifies.
10. The computer program product according to claim 9 , wherein:
the rule is one of a plurality of rules;
the method further comprises assigning relative priorities to the plurality of rules; and
the method further comprises adding a privilege to the process's token in response to a given rule only if the process satisfies the application-criterion set of no other rule whose priority is higher than a priority of the given rule.
11. The computer program product according to claim 9 , wherein:
the process executes an executable entity; and
the at least one application-criterion is that the executable entity match an executable-entity identifier specified by the at least one criterion.
12. The computer program product according to claim 9 , wherein:
the rule further specifies at least one group to be added to or removed from the token of a process that satisfies the application-criterion set; and
the method further comprises adding each group that the rule specifies to a process's token if the process satisfies the application-criterion set.
13. The computer program product according to claim 9 , wherein the at least one criterion is that the user match a user identifier specified by the at least one criterion.
14. A computer program product that limits changes made to a token of a process, the computer program product comprising program instructions stored on a non-transitory computer readable medium, the program instructions to be executed by a processor to perform a method, the method comprising:
providing a rule that includes an application-criterion set including at least one criterion for token modification in accordance with the rule, wherein the at least one criterion is that a user match a user identifier specified by the at least one criterion, wherein the rule specifies at least one change to be made to a token of a process if the process satisfies the application-criterion set, and wherein access to securable objects and privileges by the process is controlled by an operating system in accordance with the token; and
before the operating system employs a process's token to determine the process's access to securable objects and privileges:
making a determination of whether the process satisfies the application-criterion set; and
if and only if the determination is affirmative, changing the process's token in response to the rule according to each change that the rule specifies.
15. The computer program product according to claim 14 , where the at least one change is one of adding a group, removing a group, adding a privilege, and removing a privilege.
16. The computer program product according to claim 14 , wherein:
the rule is one of a plurality of rules;
the method further comprises assigning relative priorities to the plurality of rules; and
the method further comprises changing the process's token in response to a given rule only if the process satisfies the application-criterion set of no rule whose priority is higher than a priority of the given rule.
17. The computer program product according to claim 14 , wherein:
the process executes an executable entity; and
the at least one criterion further includes that the executable entity match an executable-entity identifier specified by the at least one criterion.
18. A computer program product that manages, over a network, changes to process tokens created in computers operatively coupled to the network, the computer program product comprising program instructions stored on a non-transitory computer readable medium, the program instructions to be executed by a processor to perform a method, the method comprising:
creating a rule that includes an application-criterion set including at least one criterion for token modification in accordance with the rule, wherein the rule specifies at least one change to be made to a token of a process if the process satisfies the application-criterion set, and wherein access to securable objects and privileges by the process is controlled by an operating system in accordance with the token;
associating each created rule to respective selected ones of group policy objects, where at least one selected group policy object applies to at least one of a plurality of groups of computers or users;
applying each group policy object to its group of computers or users; and
for each computer or user in each group, before the operating system of the each computer or user employs a process's token to determine the process's access to securable objects and privileges:
making a determination of whether the process satisfies the application-criterion set; and
if and only if the determination is affirmative, changing the process's token in response to the rule according to each change that the rule specifies.
19. The computer program product according to claim 18 , where the at least one change is one of adding a group, removing a group, adding a privilege, and removing a privilege.
20. The computer program product according to claim 18 , wherein:
a plurality of rules are created;
the method further comprises assigning relative priorities to the plurality of rules; and
the method further comprises changing the process's token in response to a given rule only if the process satisfies the application-criterion set of no other rule whose priority is higher than a priority of the given rule.
21. The computer program product according to claim 18 , wherein:
the process executes an executable entity; and
the at least one criterion further includes that the executable entity matches an executable-entity identifier specified by the at least one criterion.
22. The computer program product according to claim 18 , wherein the at least one criterion is that a user match a user identifier specified by the at least one criterion.
23. The computer program product according to claim 18 , further comprising:
adding, in response to user input, at least one user-defined filter criterion to a selected group policy object.
24. The computer program product according to claim 23 , wherein applying each group policy object to its group of computers or users further comprises applying each group policy object to each computer or user in its associated group of computers or users if the computer or user satisfies the user-defined filter criterion.
25. The computer program product according to claim 24 , wherein the at least one user-defined filter criterion includes at least one user identifier.