Systems and methods for implementing security
Systems and method are provided in accordance with one or more processes that run within an operating system, in which a first process of the one or more processes is an agent that encodes instructions for obtaining an authentication token uniquely associated with the agent. The agent collects security information about a first computer system running the one or more processes according to one or more commands received from a remote security system. The collected information is transmitted to the remote security system on an encrypted communication channel between the agent and the remote security system using the authentication token. Executable instructions are received through the encrypted communication channel at the first computer from the remote server according to a security policy assigned to the agent. The received executable instructions are executed at the first computer system, thereby implementing the assigned security policy.
1. A computer security system comprising:
one or more processing units;
a memory; and
one or more programs stored in the memory and configured for execution by the one or more processing units, the one or more programs including instructions for:
(a) transmitting a first set of commands to a first agent program running within a first operating system within a first virtual machine on a first remote computer distinct from the computer security system, wherein the transmitting (a) uses a first encrypted communication channel between the computer security system and the first virtual machine, and wherein the first encrypted communication channel is formed using a first API key; and
(b) transmitting the first set of commands to a second agent program running within a second operating system within a second virtual machine on a second remote computer distinct from the computer security system, wherein the transmitting (b) uses a second encrypted communication channel between the computer security system and the second virtual machine, the second encrypted communication channel is formed using the first API key, the first set of commands is associated with a first policy domain, in a plurality of policy domains, and wherein the first policy domain comprises the first virtual machine and the second virtual machine, and is uniquely associated with the first API key.
2. The computer security system of claim 1 , wherein the first remote computer and the second remote computer are the same remote computer.
3. The computer security system of claim 1 , wherein the first remote computer and the second remote computer are different remote computers.
4. The computer security system of claim 1 , wherein the one or more programs further comprise instructions for:
(c) transmitting a second set of commands to a third agent program running within a third operating system within a third virtual machine on a third remote computer distinct from the computer security system, wherein the transmitting (a) uses a third encrypted communication channel between the computer security system and the third virtual machine, the third encrypted communication channel is formed using a second API key, the third set of commands is associated with a second policy domain, in the plurality of policy domains, and wherein the second policy domain includes the third virtual machine and the second API key.
5. The computer security system of claim 4 , wherein the second policy domain includes a virtual machine that is not included in the first policy domain.
6. The computer security system of claim 1 , wherein the one or more programs further comprise instructions for displaying a management console at the computer security system, wherein the management console allows a user to create, modify or delete one or more policy domains in the plurality of policy domains.
7. The computer security system of claim 6 , wherein the modifying the one or more policy domains in the plurality of policy domains includes modifying a frequency with which one or more commands are executed by the first agent program or the second agent program.
8. The computer security system of claim 6 , wherein the modifying the one or more policy domains in the plurality of policy domains includes modifying a frequency with which a sweep is executed by the first agent program or the second agent program.
9. The computer security system of claim 6 , wherein the creating, modifying, or deleting one or more policy domains comprises creating, modifying, or deleting one or more rules of a respective policy domain in the plurality of policy domains.
10. The computer security system of claim 6 , wherein the creating, modifying, or deleting one or more policy domains comprises configuring one or more parameters associated with a module of each virtual machine of a policy domain in the plurality of policy domains.
11. The computer security system of claim 6 , wherein the management console is inaccessible from the remote computer.
12. The computer security system of claim 1 , wherein the computer security system is a plurality of load balanced computers that interface with a plurality of virtual machines associated with the plurality of policy domains.
13. The computer security system of claim 1 , wherein the transmitting the first set of commands to the first agent program and the second agent program comprises placing the first set of commands in a first command queue associated with the first agent program and the second agent program for retrieval by the first agent program and the second agent program.
14. The computer security system of claim 1 , wherein
the transmitting the first set of commands to the first agent program comprises placing the first set of command in a first command queue associated with the first agent program for retrieval by the first agent program using the first encrypted communication channel, and
the transmitting the first set of commands to the second agent program comprises placing the first set of command in a second command queue associated with the second agent program for retrieval by the second agent program using the second encrypted communication channel.
15. The computer security system of claim 1 , wherein the first operating system and the second operating system are different operating systems.
16. The computer security system of claim 1 , wherein the one or more programs further comprise instructions for:
(c) receiving information from the first agent program or the second agent program as a result of executing the first set of commands.
17. The computer security system of claim 16 , wherein the (c) receiving further comprises applying the information against one or more rules stored on the computer system to determine if a rule in a plurality of stored rules has failed.
18. A computer security system comprising:
one or more processing units;
a memory; and
one or more programs stored in the memory and configured for execution by the one or more processing units, the one or more programs including instructions for:
(a) transmitting a first set of commands to a first agent program running within a first operating system within a first virtual machine on a first remote computer distinct from the computer security system, wherein the transmitting (a) uses a first encrypted communication channel between the computer security system and the first virtual machine, and wherein the first encrypted communication channel is formed using a first API key, wherein the first set of commands is associated with a first policy domain, in a plurality of policy domains, and wherein the first policy domain comprises the first virtual machine and the first API key; and
(b) transmitting a second set of commands to a second agent program running within a second operating system within a second virtual machine on a second remote computer distinct from the computer security system, wherein the transmitting (a) uses a second encrypted communication channel between the computer security system and the second virtual machine, wherein the second encrypted communication channel is formed using a second API key, the second set of commands is associated with a second policy domain, in the plurality of policy domains, and wherein the second policy domain includes the second virtual machine and is uniquely associated with the second API key.
19. The computer security system of claim 18 , the one or more programs further comprise instructions for:
(c) transmitting a third set of commands to a third agent program running within a third operating system within a third virtual machine on a third remote computer distinct from the computer security system, wherein the transmitting (c) uses a third encrypted communication channel between the computer security system and the third virtual machine, wherein the third encrypted communication channel is formed using a third API key, the third set of commands is associated with a third policy domain, in the plurality of policy domains, and wherein the third policy domain includes the third virtual machine and the third API key.
20. The computer security system of claim 18 , wherein
the transmitting the first set of commands to the first agent program comprises placing the first set of commands in a first command queue associated with the first agent program for retrieval by the first agent program using the first encrypted communication channel, and
the transmitting the second set of commands to the second agent program comprises placing the first set of commands in a second command queue associated with the second agent program for retrieval by the second agent program using the second encrypted communication channel.