Computer network security
A computer determines, by a security event detector, that an active threat exists at the computer. The security event detector resides at the computer or in a cloud resource. The security event detector identifies active threats at the computer or a network associated with the computer. The computer prevents, in response to determining that the active threat exists, access to a subset of computing resources accessible via the computer. The subset of computing resources is identified via a security policy that applies to the subset of computing resources. The security policy does not apply to one or more computing resources stored at the computer that are not in the subset. The computer determines, subsequent to determining that the active threat exists, that the active threat no longer exists. The computer allows, in response to determining that the active threat no longer exists, access to the subset of computing resources.
1 . A method comprising:
determining, by a security event detector that operates based on a security policy, that an active threat exists at a computing machine, the security policy comprising a tracking policy that monitors activity with respect to a subset of computing resources accessible via the computing machine while not monitoring activity with respect to one or more computing resources stored at the computing machine that are not in the subset, wherein the security event detector resides at the computing machine or in a cloud resource, wherein the security event detector identifies active threats at the computing machine or a network associated with the computing machine, wherein the tracking policy causes storage, at a data repository, of records of the activity with respect to the subset and does not cause storage, at the data repository, of records of the activity with respect to the one or more computing resources that are not in the subset;
preventing, in response to determining that the active threat exists, access to the subset of the computing resources, wherein the preventing comprises continuing to allow access to the one or more computing resources that are not in the subset while access to the subset is prevented, wherein the subset is determined by the security policy prior to the determining that the active threat exists, wherein preventing access to the subset comprises making inaccessible, at the computing machine, at least one running application that accesses the subset, wherein the computing machine continues to allow access to the one or more computing resources that are not in the subset, wherein the security policy is enforced with respect to the subset of computing resources and is not enforced with respect to the one or more computing resources that are not in the subset;
determining, subsequent to determining that the active threat exists, that the active threat no longer exists; and
allowing, in response to determining that the active threat no longer exists, access to the subset of computing resources.
2 . The method of claim 1 , wherein the computing machine stores personal computing resources and business computing resources, wherein the subset of computing resources comprises the business computing resources and not the personal computing resources, wherein the computing resources comprise files, email messages, applications, network ports, network destinations, website access permissions, and external filesystem access permissions.
3 . The method of claim 1 , wherein determining that the active threat exists comprises:
scanning the computing machine to detect remote access to the computing machine.
4 . The method of claim 1 , wherein determining that the active threat no longer exists comprises:
persistently checking using the security event detector, once every threshold time period or upon detection of occurrence of a specified event, whether the active threat still exists at the computing machine or the associated network.
5 . The method of claim 4 , wherein the persistently checking occurs once every threshold time period, wherein the threshold time period is between thirty and ninety seconds.
6 . The method of claim 1 , wherein preventing access to the subset comprises:
making a running application inaccessible at the computing machine, wherein the running application is in the subset or accesses a computing resource from the subset.
7 . The method of claim 1 , wherein preventing access to the subset comprises: making one or more files in the subset inaccessible at the computing machine.
8 . A non-transitory machine-readable medium storing instructions that, when executed by processing circuitry, cause the processing circuitry to perform operations comprising:
determining, by a security event detector that operates based on a security policy, that an active threat exists at a computing machine, the security policy comprising a tracking policy that monitors activity with respect to a subset of computing resources accessible via the computing machine while not monitoring activity with respect to one or more computing resources stored at the computing machine that are not in the subset, wherein the security event detector resides at the computing machine or in a cloud resource, wherein the security event detector identifies active threats at the computing machine or a network associated with the computing machine, wherein the tracking policy causes storage, at a data repository, of records of the activity with respect to the subset and does not cause storage, at the data repository, of records of the activity with respect to the one or more computing resources that are not in the subset;
preventing, in response to determining that the active threat exists, access to the subset of the computing resources, wherein the preventing comprises continuing to allow access to the one or more computing resources that are not in the subset while access to the subset is prevented, wherein the subset is determined by the security policy prior to the determining that the active threat exists, wherein preventing access to the subset comprises making inaccessible, at the computing machine, at least one running application that accesses the subset, wherein the computing machine continues to allow access to the one or more computing resources that are not in the subset, wherein the security policy is enforced with respect to the subset of computing resources and is not enforced with respect to the one or more computing resources that are not in the subset;
determining, subsequent to determining that the active threat exists, that the active threat no longer exists; and
allowing, in response to determining that the active threat no longer exists, access to the subset of computing resources.
9 . The machine-readable medium of claim 8 , wherein the computing machine stores personal computing resources and business computing resources, wherein the subset of computing resources comprises the business computing resources and not the personal computing resources, wherein the computing resources comprise files, email messages, applications, network ports, network destinations, website access permissions, and external filesystem access permissions.
10 . The machine-readable medium of claim 8 , wherein determining that the active threat exists comprises:
scanning, using the security event detector, the computing machine or the associated network to identify the active threat.
11 . The machine-readable medium of claim 8 , wherein determining that the active threat no longer exists comprises:
persistently checking using the security event detector, once every threshold time period or upon detection of occurrence of a specified event, whether the active threat still exists at the computing machine or the associated network.
12 . The machine-readable medium of claim 11 , wherein the persistently checking occurs once every threshold time period, wherein the threshold time period is between thirty and ninety seconds.
13 . The machine-readable medium of claim 8 , wherein preventing access to the subset comprises:
making a running application inaccessible at the computing machine, wherein the running application is in the subset or accesses a computing resource from the subset.
14 . The machine-readable medium of claim 8 , wherein preventing access to the subset comprises:
making one or more files in the subset inaccessible at the computing machine.
15 . A system comprising:
processing circuitry; and
a memory storing instructions that, when executed by processing circuitry, cause the processing circuitry to perform operations comprising:
determining, by a security event detector that operates based on a security policy, that an active threat exists at a computing machine, the security policy comprising a tracking policy that monitors activity with respect to a subset of computing resources accessible via the computing machine while not monitoring activity with respect to one or more computing resources stored at the computing machine that are not in the subset, wherein the security event detector resides at the computing machine or in a cloud resource, wherein the security event detector identifies active threats at the computing machine or a network associated with the computing machine, wherein the tracking policy causes storage, at a data repository, of records of the activity with respect to the subset and does not cause storage, at the data repository, of records of the activity with respect to the one or more computing resources that are not in the subset;
preventing, in response to determining that the active threat exists, access to the subset of the computing resources, wherein the preventing comprises continuing to allow access to the one or more computing resources that are not in the subset while access to the subset is prevented, wherein the subset is determined by the security policy prior to the determining that the active threat exists, wherein preventing access to the subset comprises making inaccessible, at the computing machine, at least one running application that accesses the subset, wherein the computing machine continues to allow access to the one or more computing resources that are not in the subset, wherein the security policy is enforced with respect to the subset of computing resources and is not enforced with respect to the one or more computing resources that are not in the subset;
determining, subsequent to determining that the active threat exists, that the active threat no longer exists; and
allowing, in response to determining that the active threat no longer exists, access to the subset of computing resources.
16 . The system of claim 15 , wherein the computing machine stores personal computing resources and business computing resources, wherein the subset of computing resources comprises the business computing resources and not the personal computing resources, wherein the computing resources comprise files, email messages, applications, network ports, network destinations, website access permissions, and external filesystem access permissions.
17 . The system of claim 15 , wherein determining that the active threat exists comprises:
scanning, using the security event detector, the computing machine or the associated network to identify the active threat.
18 . The system of claim 15 , wherein determining that the active threat no longer exists comprises:
persistently checking using the security event detector, once every threshold time period or upon detection of occurrence of a specified event, whether the active threat still exists at the computing machine or the associated network.
19 . The system of claim 15 , wherein preventing access to the subset comprises:
making a running application inaccessible at the computing machine, wherein the running application is in the subset or accesses a computing resource from the subset.
20 . The system of claim 15 , wherein preventing access to the subset comprises:
making one or more files in the subset inaccessible at the computing machine.