Policy management
In embodiments of the present invention improved capabilities are described for the operation of a threat management facility, wherein the threat management facility may provide for a plurality of computer asset protection services to a corporate computer network. The threat management facility may provide a policy management service as one of the plurality of protection services, wherein the policy management service may be adapted to provide corporate policy updates to a plurality of computer facilities associated with the corporate computer network. In addition, the corporate policy updates, and a related corporate policy, may relate to the acceptability of an operation of a computer application.
1. A computer program product comprising a non-transitory computer readable medium having stored thereon computer executable code that, when executing on one or more computing devices, performs the steps of:
organizing a number of applications into a number of application types including at least a messaging category, an electronic mail category, a word processing category, a database category, and a browser category;
providing a policy management service for an enterprise network, the policy management service configured to provide protection services to one or more endpoints of the enterprise network;
detecting an application executing on one of the endpoints;
determining one of the number of application types for the application by comparing characteristics of functional blocks of the application to characteristics in an analysis database that is updated by the policy management service and that relates application characteristics to application type; and
conditionally authorizing or performing a malicious code scan of the application on the endpoint according to one or more of rules of the protection services applicable to the one of the application types of the application executing on the endpoint.
2. A method comprising:
organizing a number of applications into a number of application types;
providing a policy management service for an enterprise network, the policy management service configured to provide protection services to one or more endpoints of the enterprise network;
detecting an application executing on one of the endpoints;
determining one of the number of application types for the application by comparing characteristics of functional blocks of the application to characteristics in an analysis database that is updated by the policy management service and that relates application characteristics to application type; and
conditionally authorizing or performing a malicious code scan of the application on the endpoint according to one or more of rules of the protection services applicable to the one of the application types of the application executing on the endpoint.
3. The method of claim 2 , wherein determining one of the number of application types for the application includes unpacking a file of the application.
4. The method of claim 2 , wherein determining one of the number of application types for the application includes decompressing a file of the application.
5. The method of claim 2 , wherein determining one of the number of application types for the application includes decrypting a file of the application.
6. The method of claim 2 , wherein determining one of the number of application types for the application includes disassembling binary code of the application to recreate one or more functional blocks of the application and matching the one or more functional blocks to a phenotype representing one of the number of application types.
7. The method of claim 6 , wherein the one or more functional blocks include one or more application programming interface calls and one or more string references.
8. The method of claim 6 , wherein the one or more functional blocks illustrate a function and an execution flow for the application.
9. The method of claim 6 , wherein the one or more functional blocks contains a combination of API calls and strings referenced within the one or more functional blocks.
10. The method of claim 6 , wherein the one or more functional blocks are representative of at least one function and at least one execution flow of the application.
11. The method of claim 6 , wherein the one or more functional blocks include a sequence of application program interface calls.
12. The method of claim 2 , wherein the one or more rules of the protection services include at least one of a white list of acceptable applications, a white list of a group of application types, a black list of applications, or a black list of unacceptable application types.
13. The method of claim 2 , wherein the application includes at least one of a network application and a web application.
14. The method of claim 2 , wherein the malicious code scan of the application is conditionally authorized or performed once the application has been requested to execute.
15. The method of claim 2 , wherein conditionally authorizing or performing the malicious code scan of the application includes quarantining the application.
16. The method of claim 2 , wherein conditionally authorizing or performing the malicious code scan of the application includes terminating the application.
17. The method of claim 2 , wherein conditionally authorizing or performing the malicious code scan of the application includes reporting the application to an administration facility.
18. A system comprising:
a threat management facility storing information in a database organizing a number of applications into a number of application types, the threat management facility providing a policy management service including protection services for one or more endpoints of an enterprise network;
a data network; and
an endpoint coupled to the threat management facility through the data network the endpoint configured by computer executable code stored in a memory of the endpoint to perform the steps of detecting an application executing on the one of the endpoints, determining one of the number of application types for the application by comparing characteristics of functional blocks of the application to characteristics of application types in an analysis database that is updated by the policy management service and that relates application characteristics to application type, and conditionally authorizing or performing a malicious code scan of the application on the endpoint according to one or more of rules of the protection services applicable to the one of the application types of the application executing on the endpoint.
19. The system of claim 18 , wherein the application includes at least one of a network application and a web application.
20. The system of claim 18 , wherein determining one of the number of application types for the application includes disassembling binary code of the application to recreate one or more functional blocks of the application and matching the one or more functional blocks to a phenotype representing one of the number of application types.