Visual policy configuration and enforcement for platform security
A system, method, and computer-readable medium are disclosed for performing a platform security operation, comprising: presenting a platform security user interface, the platform security user interface including a plurality of security blocks, each of the plurality of security blocks corresponding to a particular security policy function configuring a security policy via the platform security user interface, the configuring comprising combining a set of the security blocks according to a desired security function; converting the set of security blocks to information representing the security policy; and, deploying the security policy to an information handling system.
1. A computer-implementable method for performing a platform security operation, comprising:
presenting a platform security user interface, the platform security user interface comprising a blocks tab, the blocks tab comprising a logic option, a triggers option and an actions option, the platform security user interface presenting a plurality of security blocks, each of the plurality of security blocks corresponding to a particular security policy function;
configuring a visual security policy via the platform security user interface, the configuring comprising combining a set of the security blocks according to a desired security function, the combining being accomplished by selecting blocks presented via the platform security user interface;
converting the set of security blocks of the visual security policy to information representing the security policy; and,
deploying the security policy to an information handling system, the deploying comprising performing a policy injection operation, the policy injection operation being performed by a policy injection module, the policy injection operation injecting the security policy to a system of the information handling system, the system of the information handling system maintaining persistence of the security policy; and wherein
the plurality of security blocks include trigger security blocks and action security blocks, the trigger security blocks and the action security blocks being selected from a pool of available triggers and actions for end user manipulation of the security policy.
2. The method of claim 1 , wherein:
the trigger security blocks and the action security blocks accessed via the logic option of the platform security user interface; and,
the trigger security blocks and the action security blocks are visually presented as “if . . . do” type programming statements via the platform security user interface.
3. The method of claim 1 , wherein:
converting the set of security blocks provides scripting logic representing the security policy, the scripting logic being configured to be consumed by a low resource environment within the information handling system.
4. The method of claim 1 , wherein:
the deploying the security policy is via at least one of a variable methodology, an attribute methodology and a setting methodology.
5. The method of claim 1 , wherein:
the system of the information handling system comprises a basic input output system (BIOS); and,
the security policy is injected to the basic input output system (BIOS) of the information handling system.
6. A system comprising: a processor; a data bus coupled to the processor; and a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executed by the processor and configured for: presenting a platform security user interface, the platform security user interface comprising a blocks tab, the blocks tab comprising a logic option, a triggers option and an actions option, the platform security user interface presenting a plurality of security blocks, each of the plurality of security blocks corresponding to a particular security policy function; configuring a visual security policy via the platform security user interface, the configuring comprising combining a set of the security blocks according to a desired security function, the combining being accomplished by selecting blocks presented via the platform security user interface; converting the set of security blocks of the visual security policy to information representing the security policy; and, deploying the security policy to an information handling system, the deploying comprising performing a policy injection operation, the policy injection operation being performed by a policy injection module, the policy injection operation injecting the security policy to a system of the information handling system, the system of the information handling system maintaining persistence of the security policy; and wherein the plurality of security blocks include trigger security blocks and action security blocks, the trigger security blocks and the action security blocks being selected from a pool of available triggers and actions for end user manipulation of the security policy.
7. The system of claim 6 , wherein:
the trigger security blocks and the action security blocks accessed via the logic option of the platform security user interface; and,
the trigger security blocks and the action security blocks are visually presented as “if . . . do” type programming statements via the platform security user interface.
8. The system of claim 6 , wherein:
converting the set of security blocks provides scripting logic representing the security policy, the scripting logic being configured to be consumed by a low resource environment within the information handling system.
9. The system of claim 6 , wherein:
the deploying the security policy is via at least one of a variable methodology, an attribute methodology and a setting methodology.
10. The system of claim 6 , wherein:
the system of the information handling system comprises a basic input output system (BIOS); and,
the security policy is injected to the basic input output system (BIOS) of the information handling system.
11. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions when executed are configured for: presenting a platform security user interface, the platform security user interface comprising a blocks tab, the blocks tab comprising a logic option, a triggers option and an actions option, the platform security user interface presenting a plurality of security blocks, each of the plurality of security blocks corresponding to a particular security policy function; configuring a visual security policy via the platform security user interface, the configuring comprising combining a set of the security blocks according to a desired security function, the combining being accomplished by selecting blocks presented via the platform security user interface; converting the set of security blocks to information representing the security policy; and, deploying the security policy to an information handling system, the deploying comprising performing a policy injection operation, the policy injection operation being performed by a policy injection module, the policy injection operation injecting the security policy to a system of the information handling system, the system of the information handling system maintaining persistence of the security policy; and wherein the plurality of security blocks include trigger security blocks and action security blocks, the trigger security blocks and the action security blocks being selected from a pool of available triggers and actions for end user manipulation of the security policy.
12. The non-transitory, computer-readable storage medium of claim 11 , wherein:
the trigger security blocks and the action security blocks are presented as “if . . . do” type programming statements.
13. The non-transitory, computer-readable storage medium of claim 11 , wherein:
converting the set of security blocks provides scripting logic representing the security policy, the scripting logic being configured to be consumed by a low resource environment within the information handling system.
14. The non-transitory, computer-readable storage medium of claim 11 , wherein:
the deploying the security policy is via at least one of a variable methodology, an attribute methodology and a setting methodology.
15. The non-transitory, computer-readable storage medium of claim 11 , wherein:
the system of the information handling system comprises a basic input output system (BIOS); and,
the security policy is injected to the basic input output system (BIOS) of the information handling system.
16. The method of claim 5 , wherein:
the security policy is injected to the basic input output system (BIOS) of the information handling system via at least one of a natively spawned option and a manual option, the policy being automatically injected into the BIOS with the natively spawned option, the policy being injected into the BIOS by importing a policy file with the manual option.
17. The method of claim 5 , wherein:
the policy injection module includes at least one of a kernel mode driver and a BIOS access library.
18. The method of claim 5 , wherein:
the BIOS includes a policy monitoring and enforcement portion, the policy monitoring and enforcement portion providing a manufacturer specific operation of a system management mode (SMM) of a uniform extensible firmware interface (UEFI).