Methods and systems for network-based management of application security
To control privileges and access to resources on a per-process basis, an administrator creates a rule that may be applied to modify a process's token. The rule includes an application-criterion set and changes to be made to the groups and/or privileges of a token. The rule is set as a policy within a group policy object (GPO), where a GPO is associated with one or more groups of computers. When a GPO containing a rule is applied to a computer, a driver installed on the computer accesses the rule(s) anytime a logged-on user executes a process. If the executed process satisfies the criterion set of a rule the changes contained within the rule are made to the process token, and the user has expanded and/or contracted access and/or privileges for only that process.
1. A method comprising:
providing, by a computer system, a rule including an application-criterion set, the application-criterion set comprising at least one criterion for modifying a token of a process during execution of the process in accordance with the rule, the rule specifying at least one group to be added to the token if the process satisfies the application-criterion set, the at least one group being a group other than an administrators group of users having administrative privileges, and wherein access to a securable object by the process is controlled by an operating system in accordance with the token; and
before the operating system uses the token to determine access to the securable object by the process:
determining during the execution of the process whether the process satisfies the application-criterion set; and
in response to determining that the process satisfies the application-criterion set,
adding to or removing from the token each group or user that the rule specifies.
2. The method of claim 1 , wherein:
the rule is one of a plurality of rules;
the method further comprises assigning relative priorities to the plurality of rules; and
adding a group to the token in response to a given rule occurs if the process satisfies the application-criterion set of no other rule whose priority is higher than a priority of the given rule.
3. The method of claim 1 , wherein:
the process executes an executable entity; and
the at least one criterion is that the executable entity match an executable-entity identifier specified by the at least one criterion.
4. The method of claim 3 , wherein the executable entity is an executable file.
5. The method of claim 4 , wherein the executable-entity identifier is a hash on content of the executable file.
6. The method of claim 4 , wherein the executable-entity identifier represents a path of the executable file.
7. The method of claim 1 , wherein:
the rule further specifies at least one privilege to be added to or removed from the token if the process satisfies the application-criterion set; and
the method further comprises adding or removing each privilege that the rule specifies to a given token of a given process if the given process satisfies the application-criterion set.
8. The method of claim 1 , wherein the at least one criterion is that a user match a user identifier specified by the at least one criterion.
9. A method comprising:
providing, by a computer system, a rule including an application-criterion set, the application-criterion set comprising at least one criterion for token modification in accordance with the rule, the rule specifying at least one privilege to be added to a token of a process during execution of the process if the process satisfies the application-criterion set, and wherein performance of a system operation by the process is controlled by an operating system in accordance with the token; and
before the operating system uses the token to determine the at least one privilege of the process:
determining during the execution of the process whether the process satisfies the application-criterion set; and
in response to determining that the process satisfies the application-criterion set,
adding to the token each privilege that the rule specifies.
10. The method of claim 9 , wherein:
the rule is one of a plurality of rules;
the method further comprises assigning relative priorities to the plurality of rules; and
the method further comprises adding the privilege to the token in response to a given rule if the process satisfies the application-criterion set of no other rule whose priority is higher than a priority of the given rule.
11. The method of claim 9 , wherein:
the process executes an executable entity; and
the at least one application-criterion is that the executable entity match an executable-entity identifier specified by the at least one criterion.
12. The method of claim 9 , wherein:
the rule further specifies at least one group to be added to or removed from the token if the process satisfies the application-criterion set; and
the method further comprises adding or removing each group that the rule specifies to the token if the process satisfies the application-criterion set.
13. The method of claim 9 , wherein the at least one criterion is that the user match a user identifier specified by the at least one criterion.
14. A method comprising:
providing, by a computer system, a rule including an application-criterion set, the application-criterion set comprising at least one criterion for token modification in accordance with the rule, the at least one criterion being that a user match a user identifier specified by the at least one criterion, the rule specifying at least one modification to be made to a token of a process during execution of the process if the process satisfies the application-criterion set, and wherein both access to a securable object by the process and a privilege of the process are controlled by an operating system in accordance with the token; and
before the operating system uses the token to determine access to the securable object by the process or uses the token to determine the privilege of the process:
determining during the execution of the process whether the process satisfies the application-criterion set; and
in response to determining that the process satisfies the application-criterion set, modifying the process's token according to each modification that the rule specifies.
15. The method of claim 14 , wherein the at least one modification is one of adding a group, removing a group, adding a privilege, and removing a privilege.
16. The method of claim 14 , wherein:
the rule is one of a plurality of rules;
the method further comprises assigning relative priorities to the plurality of rules; and
the method further comprises modifying the token in response to a given rule if the process satisfies the application-criterion set of no rule whose priority is higher than a priority of the given rule.
17. The method of claim 14 , wherein:
the process executes an executable entity; and
the at least one criterion further includes that the executable entity match an executable-entity identifier specified by the at least one criterion.
18. A method comprising:
creating, by a computer system, a rule including an application-criterion set, the application-criterion set comprising at least one criterion for token modification in accordance with the rule, the rule specifying at least one modification to be made to a token of a process during execution of the process if the process satisfies the application-criterion set, and wherein both access to a securable object by the process and a privilege of the process are controlled by an operating system in accordance with the token;
associating each created rule to respective ones of group policy objects, each one of the group policy objects applying to at least one of a plurality of groups of computers or users;
applying each one of the group policy objects to at least one group of the plurality of groups of computers or users; and
for each computer or user in each group of the plurality of groups of computers or users, before the operating system of each computer or user uses the token to determine the access to the securable object by the process or uses the token to determine the privilege of the process:
determining during the execution of the process whether the process satisfies the application-criterion set; and
in response to determining that the process satisfies the application-criterion set, modifying the process's token according to each modification that the rule specifies.
19. The method of claim 18 , wherein the at least one modification is one of adding a group, removing a group, adding a privilege, and removing a privilege.
20. The method of claim 18 , wherein:
a plurality of rules are created;
the method further comprises assigning relative priorities to the plurality of rules; and
the method further comprises modifying the token in response to a given rule only if the process satisfies the application-criterion set of no other rule whose priority is higher than a priority of the given rule.
21. The method of claim 18 , wherein:
the process executes an executable entity; and
the at least one criterion includes that the executable entity match an executable-entity identifier specified by the at least one criterion.
22. The method of claim 18 , wherein the at least one criterion is that a user match a user identifier specified by the at least one criterion.
23. The method of 18 , further comprising:
adding, in response to user input, at least one user-defined filter criterion to a selected group policy object.
24. The method of claim 23 , wherein the applying each one of the group policy objects to the at least one group of the plurality of groups of computers or users comprises applying each one of the group policy objects to each computer or user in the at least one group of the plurality of groups of computers or users if the computer or user satisfies the user-defined filter criterion.
25. The method of claim 24 , wherein the at least one user-defined filter criterion includes at least one user identifier.