Cloud Hosting

The Internet Security Audit Market 2022 report provides the historical as well as present growth factors of the global market. The report contains financial data achieve from various research sources to provide specific and reliable analysis. The report presents information about the top regions of the world and countries with their regional development status, volume, market size, market value, and price data.

Internet Security AuditMarket 2022 Impact of COVID-19 on the Market: The report contains financial data achieve from various research sources to provide specific and reliable analysis. The report presents information about the top regions of the world and countries with their regional development status, volume, market size, market value, and price data.

Internet Security Audit Market (2022-2028) report identifies Sales of Market by regional analysis by product type and product applications. The competitive data type analysis includes capacity, market trends, profit margin, market growth, imports, exports, revenue and Marketing strategies, policies, industry chain analysis that are changing the wave of the market are also catered in the report. The Report provides potential market opportunities and Major Regions that plays a vital role in market are North America, Europe, China, Japan, Middle East and Africa, India, South America and Others.

Get a sample PDF of the report at:https://www.marketgrowthreports.com/enquiry/request-sample/19977823

Internet Security Audit Market Segmentation by Types, By Applications and By Region:

Internet Security Audit market is analyses and market size information is provided by regions (countries). Segment by Application and type, the Internet Security Audit market is segmented into United States, Europe, China, Japan, Southeast Asia, India and Rest of World. The report includes region-wise market size for the period 2022-2028.It also includes market size and forecast by players, by Type, and by Application segment in terms of sales and revenue for the period 2022-2028.

Internet Security Audit Market Segment by Applications:

Internet Security Audit Market Segment/types by Type:

List of Top Key Players in Internet Security Audit Market Report are:

Request for Covid-19 Impact Sample:https://www.marketgrowthreports.com/enquiry/request-covid19/19977823

Brief Description for Internet Security Audit Market:

As the global economy mends, the 2021 growth of Internet Security Audit will have significant change from previous year. According to our (LP Information) latest study, the global Internet Security Audit market size is USD million in 2022 from USD million in 2021, with a change of % between 2021 and 2022. The global Internet Security Audit market size will reach USD million in 2028, growing at a CAGR of % over the analysis period.The United States Internet Security Audit market is expected at value of USD million in 2021 and grow at approximately % CAGR during review period. China constitutes a % market for the global Internet Security Audit market, reaching USD million by the year 2028. As for the Europe Internet Security Audit landscape, Germany is projected to reach USD million by 2028 trailing a CAGR of % over the forecast period. In APAC, the growth rates of other notable markets (Japan and South Korea) are projected to be at % and % respectively for the next 5-year period.Global main Internet Security Audit players cover Symantec, Intel Security, IBM, and Cisco, etc. In terms of revenue, the global largest two companies occupy a share nearly % in 2021.This report presents a comprehensive overview, market shares, and growth opportunities of Internet Security Audit market by product type, application, key players and key regions and countries.

Enquire before Purchasing this Report: https://www.marketgrowthreports.com/enquiry/pre-order-enquiry/19977823

Competitive Landscape and Internet Security Audit Market Share Analysis:

Internet Security Audit market competitive landscape provides details and data information by players. The report offers comprehensive analysis and accurate statistics on revenue by the key player for the period 2021. It also offers detailed analysis supported by reliable statistics on revenue (global and regional level) by players for the period 2021. Details included are company description, major business, company total revenue and the sales, revenue generated in Internet Security Audit business, the date to enter into the Internet Security Audit market, Internet Security Audit product introduction, recent developments, etc.

Key Questions Answered in The Report:

Major Points from Table of Contents:

Major Points from Table of Contents:

Global Internet Security Audit Market Research Report 2022-2028, by Manufacturers, Regions, Types and Applications

1 Study Coverage

1.1 Internet Security Audit Product Introduction

1.2 Market by Type

1.2.1 Global Internet Security Audit Market Size Growth Rate by Type

1.3 Market by Application

1.3.1 Global Internet Security Audit Market Size Growth Rate by Application

1.4 Study Objectives

1.5 Years Considered

2 Global Internet Security Audit Production

2.1 Global Internet Security Audit Production Capacity (2016-2028)

2.2 Global Internet Security Audit Production by Region: 2016 VS 2022 VS 2028

2.3 Global Internet Security Audit Production by Region

2.3.1 Global Internet Security Audit Historic Production by Region (2016-2022)

2.3.2 Global Internet Security Audit Forecasted Production by Region (2022-2028)

3 Global Internet Security Audit Sales in Volume and Value Estimates and Forecasts

3.1 Global Internet Security Audit Sales Estimates and Forecasts 2016-2028

3.2 Global Internet Security Audit Revenue Estimates and Forecasts 2016-2028

3.3 Global Internet Security Audit Revenue by Region: 2016 VS 2022 VS 2028

3.4 Global Top Internet Security Audit Regions by Sales

3.4.1 Global Top Internet Security Audit Regions by Sales (2016-2022)

3.4.2 Global Top Internet Security Audit Regions by Sales (2022-2028)

3.5 Global Top Internet Security Audit Regions by Revenue

3.5.1 Global Top Internet Security Audit Regions by Revenue (2016-2022)

3.5.2 Global Top Internet Security Audit Regions by Revenue (2022-2028)

3.6 North America

3.7 Europe

3.8 Asia-Pacific

3.9 Latin America

3.10 Middle East and Africa

4 Competition by Manufactures

4.1 Global Internet Security Audit Supply by Manufacturers

4.1.1 Global Top Internet Security Audit Manufacturers by Production Capacity (2022 VS 2022)

4.1.2 Global Top Internet Security Audit Manufacturers by Production (2016-2022)

4.2 Global Internet Security Audit Sales by Manufacturers

4.2.1 Global Top Internet Security Audit Manufacturers by Sales (2016-2022)

4.2.2 Global Top Internet Security Audit Manufacturers Market Share by Sales (2016-2022)

4.2.3 Global Top 10 and Top 5 Companies by Internet Security Audit Sales in 2022

4.3 Global Internet Security Audit Revenue by Manufacturers

4.3.1 Global Top Internet Security Audit Manufacturers by Revenue (2016-2022)

4.3.2 Global Top Internet Security Audit Manufacturers Market Share by Revenue (2016-2022)

4.3.3 Global Top 10 and Top 5 Companies by Internet Security Audit Revenue in 2022

4.4 Global Internet Security Audit Sales Price by Manufacturers

4.5 Analysis of Competitive Landscape

4.5.1 Manufacturers Market Concentration Ratio (CR5 and HHI)

4.5.2 Global Internet Security Audit Market Share by Company Type (Tier 1, Tier 2, and Tier 3)

4.5.3 Global Internet Security Audit Manufacturers Geographical Distribution

4.6 Mergers and Acquisitions, Expansion Plans

5 Market Size by Type

5.1 Global Internet Security Audit Sales by Type

5.1.1 Global Internet Security Audit Historical Sales by Type (2016-2022)

5.1.2 Global Internet Security Audit Forecasted Sales by Type (2022-2028)

5.1.3 Global Internet Security Audit Sales Market Share by Type (2016-2028)

5.2 Global Internet Security Audit Revenue by Type

5.2.1 Global Internet Security Audit Historical Revenue by Type (2016-2022)

5.2.2 Global Internet Security Audit Forecasted Revenue by Type (2022-2028)

5.2.3 Global Internet Security Audit Revenue Market Share by Type (2016-2028)

5.3 Global Internet Security Audit Price by Type

5.3.1 Global Internet Security Audit Price by Type (2016-2022)

5.3.2 Global Internet Security Audit Price Forecast by Type (2022-2028)

6 Market Size by Application

6.1 Global Internet Security Audit Sales by Application

6.1.1 Global Internet Security Audit Historical Sales by Application (2016-2022)

6.1.2 Global Internet Security Audit Forecasted Sales by Application (2022-2028)

6.1.3 Global Internet Security Audit Sales Market Share by Application (2016-2028)

6.2 Global Internet Security Audit Revenue by Application

6.2.1 Global Internet Security Audit Historical Revenue by Application (2016-2022)

6.2.2 Global Internet Security Audit Forecasted Revenue by Application (2022-2028)

6.2.3 Global Internet Security Audit Revenue Market Share by Application (2016-2028)

6.3 Global Internet Security Audit Price by Application

6.3.1 Global Internet Security Audit Price by Application (2016-2022)

6.3.2 Global Internet Security Audit Price Forecast by Application (2022-2028)

7 Internet Security Audit Consumption by Regions

7.1 Global Internet Security Audit Consumption by Regions

7.1.1 Global Internet Security Audit Consumption by Regions

7.1.2 Global Internet Security Audit Consumption Market Share by Regions

7.2 North America

7.2.1 North America Internet Security Audit Consumption by Application

7.2.2 North America Internet Security Audit Consumption by Countries

7.2.3 United States

7.2.4 Canada

7.2.5 Mexico

Read more here:
Internet Security Audit Market Size in 2022 : value chain analysis, SWOT analysis, restraints, Growth Opportunities, Driving Factors, Top...

Read More..

By PTI

NEW DELHI: US-based technology industry body ITI, having global tech firms such as Google, Facebook, IBM and Cisco as its members, has sought a revision in the Indian government's directive on reporting of cyber security breach incidents.

ITI said that the provisions under the new mandate may adversely impact organisations and undermine cyber security in the country.

ITI country manager for India Kumar Deep, in a letter to CERT-In chief Sanjay Bahl dated May 5, has asked for a wider stakeholder consultation with the industry before finalising on the directive.

"The directive has the potential to improve India's cyber security posture if appropriately developed and implemented, however, certain provisions in the bill, including counterproductive incident reporting requirements, may negatively impact Indian and global enterprises and undermine cyber security," Deep said.

Indian Computer Emergency Response Team (CERT-In) on April 28, issued a directive asking all government and private agencies, including internet service providers, social media platforms and data centres, to mandatorily report cyber security breach incidents to it within six hours of noticing them.

The new circular issued by the CERT-In mandates all service providers, intermediaries, data centres, corporates and government organisations to mandatorily enable logs of all their ICT (Information and Communication Technology) systems and maintain them securely for a rolling period of 180 days and the same shall be maintained within the Indian jurisdiction.

ITI has raised concerns over the mandatory reporting of breach incidents within six hours of noticing, to enable logs of all ICT systems and maintain them within Indian jurisdiction for 180 days, the overbroad definition of reportable incidents and the requirement that companies connect to the servers of Indian government entities.

Deep, in the letter, said that the organisations must be given 72 hours to report an incident in line with global best practices and not just six hours.

ITI said that the government's mandate to enable logs of all covered entities' information and communications technology systems, maintain logs "securely for a rolling period of 180 days" within India and make them available to the Indian government upon request is not a best practice.

"It would make such repositories of logged information a target for global threat actors, in addition to requiring significant resources (both human and technical) to implement," Deep said.

ITI also raised concern on the requirement that "all service providers, intermediaries, data centres, body corporate and government organisations shall connect to the NTP servers of Indian labs and other entities for synchronisation of all their ICT systems clocks".

The global body said that the provisions could negatively affect companies' security operations as well as the functionality of their systems, networks and applications.

ITI said that the government's current definition of reportable incident to include activities such as probing and scanning is far too broad given probes and scans are everyday occurrences.

"It would not be useful for companies or CERT-In to spend time gathering, transmitting, receiving and storing such a large volume of insignificant information that arguably will not be followed up on," Deep said.

ITI has asked the government to defer timeline for implementation of the new directive and launch a wider consultation with all stakeholders for its effective implementation.

ITI demanded CERT-In to "revise the directive to address the concerning provisions with regard to incident reporting obligations, including related to the reporting timeline, scope of covered incidents and logging data localisation requirements".

The rest is here:
Global tech industry body seeks revision in India's directive on cyber security breaches - The New Indian Express

Read More..

In the past decades, over 40 states have publicly established some sort of military cyber command, with at least a dozen more planning to do so. Yet despite this proliferation, there is still little appreciation of the sheer amount of time and resources that an effective cyber command requires.

In my book No Shortcuts: Why States Struggle to Develop a Military Cyber-Force, I break down the challenges of building an effective cyber command into five categories I call the PETIO framework: people, exploits, toolset, infrastructure, and organizational structure. What does this mean for aspiring cyber powers? First, the most important element of developing an offensive cyber capability are the people not just technically savvy ones but also linguists, analysts, front-office support, strategists, legal experts, and operation-specific consultants. Second, much attention has been paid states deployment of zero-day, or unknown, exploits. However, known exploits and tools can also be highly effective if the attacker has a superior knowledge of their target and their capabilities. Third, infrastructure investments such as establishing a cyber range for training and testing are an essential requirement to develop an offensive cyber capability and come at a great cost.

Technical People Arent Enough

A widespread view in business management is that as the cognitive skills of a job increase, people rather than technology become more important. These thought jobs, as Daniel Pink calls them, require greater problem-solving skills and creative thinking, which means that businesses can only be successful if they cultivate a culture that prioritizes the human element. For aspiring cyber powers, this is true for more than just technical experts.

Of course, a military cyber organization needs vulnerability analysts, or bug hunters. These employees search for software vulnerabilities. They also need developers, operators, testers, and system administrators to successfully execute an operation, and make sure capabilities are reliably developed, deployed, maintained, and tested.

But building an offensive cyber capability also requires a more comprehensive workforce. First, frontline assistance is required to support the activities of operators and developers. This can include activities such as registering accounts or buying capabilities from private companies. Second, a military or intelligence organization with the best cyber force in the world is bound to fail without strategic guidance. Operational or tactical success does not equal strategic victory. An operation may be perfectly executed and rely on flawless code, but this does not automatically lead to mission success. For example, U.S. Cyber Command may successfully wipe data off the server of an Iranian oil company without actually securing any change in Iranian foreign policy. An organization can only function if there is a clear understanding of how the available means will achieve the desired ends. An important task of strategists is to coordinate activities with other military units and partner states. They are also involved in selecting target packages, although a separate position is often created for targeteers. The targeteers nominate targets, assess collateral damage, manage deconfliction, and help with the planning of the operational process.

Any military or civilian agency conducting cyber operations as part of a government with a legal framework will also deal with an army of lawyers. These legal experts will be involved in training, advising, and monitoring. Compliance with the law of war, the law of armed conflict, and any other legal mandates requires legal training operators, developers, and systems administrators to prevent violations. Legal experts provide planning support as they advise, review, and monitor operational plans. For example, in the planning of U.S. Cyber Commands 2016 Operation Glowing Symphony, which sought to disrupt and deny ISIL internet usage, these experts helped to specify the notification plan, mission checklist, and authorization process.

Embedding legal experts at the various stages of a cyber operation is hard. Indeed, it likely requires numerous critical conversations with the leadership and operational teams to ensure they sufficiently understand what is being proposed before they can give approval. Also, the way certain operations are executed makes legal vetting harder. For example, in the case of self-propagating malware like Stuxnet, once you commit, it is difficult to go back.

A diverse group of technical analysts is then needed to process information during and after operations. Non-technical analysts are essential, too, particularly for understanding how people in the target network will respond to a cyber operation. This requires analysts with specific knowledge about the country, culture, or target organization. There is also the need for remote personnel. As security researcher and former NSA employee Charlie Miller puts it, Cyberwar is still aided by humans being[s] located around the world and performing covert actions. In the case of the Stuxnet attacks, for example, a Dutch mole, posing as a mechanic, helped the United States and Israel collect intelligence about Iranian nuclear centrifuges that was used to update and install the virus.

Finally, a cyber command needs administrators for human resourcing, liaising with other relevant domestic and international institutions, and speaking to the media. As Jamie Collier observes, [G]one are the days when spy agencies did not officially existand kept their personnel and activities guarded surreptitiously away from the public view. Communication can help to overcome public skepticism. This applies not just to intelligence agencies, but to some degree also to military cyber commands, especially when their mission set is expanding and concerns about escalation, norms deterioration, or allied friction are growing. In addition, being more public facing may help for recruitment purposes in a highly competitive job market.

It Is More Than Just About Zero-Days

The most talked about element of developing an offensive cyber capability are exploits. These fall into three difference categories: zero-day exploits, unpatched N-day exploits, and patched N-day exploits. A zero-day exploit is one that exposes a vulnerability not known to the vendor. An unpatched N-day exploit is one that exposes a vulnerability in software or hardware that is known to the vendor but does not have a patch in place to fix the flaw. A patched N-day exploit is one that exposes a vulnerability in software or hardware that is known to the vendor and has a patch in place to fix the flaw. Oftentimes, attackers must combine multiple vulnerabilities into a chain of attack, known as an exploit chain, to attack a given target.

Much policy attention is devoted to states hoarding of zero-days. Jason Healey, a Senior Research Scholar at Columbia Universitys School for International and Public Affairs, conducted a study in 2016 to understand how many zero-day vulnerabilities the U.S. government retains. Healey states with high confidence that in 2015/2016 the U.S. government retained [n]ot hundreds or thousands per year but probably dozens. This largely corresponds with other reporting. More mature military and intelligence organizations benefit from carefully designed procedures to use their exploits as efficiently as possible.

We should not, however, exaggerate the importance of zero-days. [P]eople think, the nation-states, theyre running on this engine of zero days, you go out with your master skeleton key and unlock the door and youre in. Its not that, Rob Joyce, then-head of NSAs Office of Tailored Access Operations, said during a presentation at the Enigma Conference. He continued, Take these big corporate networks, these large networks, any large network I will tell you that persistence and focus will get you in, will achieve that exploitation without the zero days. Theres so many more vectors that are easier, less risky, and quite often more productive than going down that route.

Indeed, for military cyber organizations in particular, the race for N-days is often as important. In deploy N-day exploits, attacks can take advantage of the time it takes to develop a patch and the time it takes to adopt a patch. The average delay in patching an exploit differs based the size of the vendor, the severity of vulnerability, and source of the disclosure. While it takes an average of just over a month for in-production web applications to patch medium severe vulnerabilities, it takes vendors on average 150 days to patch vulnerabilities in supervisory control and data acquisition systems. Adopting the patch can also take a considerable amount of time especially in environments that lack standardization, such as industrial control systems. Partially due to the long lead-time on industrial control-system patching, we have witnessed several prominent attacks against these devices and protocols. For example, in December 2016 a Kremlin-backed hacker group known as Sandworm used malware dubbed CrashOverride or Industroyer to turn large parts of Ukraine dark. To do this, the attackers bypassed the automated protected systems at a Ukrainian electrical transmission substation by using a known vulnerability in its Siemens SIPROTEC relays.

Testing and Infrastructure Matter

There is a widespread belief that launching cyber attacks is cheap while defending against them is expensive. But as Matthew Monte observed, based on his experience in the U.S. intelligence community, Attackers do not stumble into being right once. They put in the time and effort to build an infrastructure and then work through Thomas Edisons alleged 10,000 ways that wont work. This requires infrastructure, an absolutely crucial element of cyber capability that is not talked about enough. Infrastructure can be broadly defined as the processes, structures, and facilities needed to pull off an offensive cyber operation.

Infrastructure falls into two categories: control infrastructure and preparatory infrastructure. Control infrastructure refers to processes directly used to run an operation. These are generally burned down after a failed operation. This type of infrastructure can include domain names of phishing sites, leaked email addresses, or other abused technologies. It also includes command-and-control infrastructure used in remotely conducted operations that maintain communications with compromised systems within a target network. This infrastructure can be used, for example, to keep track of compromised systems, update malware, or exfiltrate data. Depending on the goal and resources of an operation, the command-and-control infrastructure can be as basic as a single server operating on the external network.

More mature actors, however, tend to use more complex infrastructure and techniques to remain stealthy and resilient against takedowns. For example, Russia-based Fancy Bear spent more than $95,000 on the infrastructure they used to target people involved in the 2016 U.S. presidential election. And this is often about far more than just renting infrastructure: An organization may run a whole set of operations just to compromise legitimate webservers to use them for running future operations.

Preparatory infrastructure concerns a set of processes that are used to put oneself in a state of readiness to conduct cyber operations. Rarely will an attacker throw away this infrastructure after a (failed) operation.

One of the most difficult things to do when crafting good attack tools is testing them before deployment. As Dan Geer, a prominent computer-security expert, points out, Knowing what your tool will find, and how to cope with that, is surely harder than finding an exploitable flaw in and of itself. Much of the preparatory infrastructure for an attack usually consists of databases used in target mapping. An attacker will need to do a lot of work to find their targets. Network mapping exercises can help an organization understand the range of possible targets, sometimes also referred to as target acquisition. Hence, the most mature actors in this space have invested enormous resources in network-mapping tools to identify and visualize devices on certain networks.

There are also other targeted databases. For example, GCHQ maintains a special database that stores details of computers used by engineers and system administrators who work in network operation centers across the world. The reason why engineers and system administrators are particularly interesting targets is because they manage networks and have access to large troves of data.

An illustrative, high-profile case is the hack of Belgacom,a partly state-owned Belgian phone and internet provider with the European Commission, the European Parliament, and the European Council as part of their customer base. The British spy agency GCHQ, possibly assisted by other Five-Eyes members, used malware it had developed to gain access to Belgacoms GRX routers. From there, it could undertake Man in the Middle attacks, which made it possible to secretly intercept communications of targets roaming using smartphones. As reporters discovered, the Belgacom Hack, code-named Operation Socialist, occurred in stages between 2010 and 2011, each time penetrating deeper into Belgacoms systems, eventually compromising the very core of the companys networks.

Preparing for cyber attacks also requires creating a cyber range. This is a platform for the development and use of interactive simulation environments that can be used for training and capability development. In past years, businesses have increasingly invested in cyber ranges, based on cloud technology. These ranges are either developed on public cloud providers such as Amazon Web Services, Microsoft Azure, or Google or private cloud networks deployed on premises. Cloud cyber ranges generally provide flexible hands-on learning environments with convenient click-and-play scenarios for training. For military cyber organizations, however, the conventional non-cloud-based ranges are generally still preferable, given the need for highly customable simulation environments and bespoke operational testing and training.

In trying to keep up with the fast pace of developments in cyber conflict, much expert commentary has focused on whether cyber effect operations can produce strategic advantages or be influenced by norms. Yet, we first need to address a more fundamental question: When are states actually able to conduct operations in the first place? While the proliferation of military cyber commands suggests major change is afoot in cyber warfare, making these organizations work remains much harder and more expensive than it appears.

This essay is based on No Shortcuts: Why States Struggle to Develop a Military Cyber-Force, published with Oxford University Press and Hurst Publishers in May 2022.

Max Smeets is a senior researcher at the Center for Security Studies at ETH Zurich and director of the European Cyber Conflict Research Initiative,

Image: Joseph Eddins, Airman Magazine

See the original post:
Building a Cyber Force Is Even Harder Than You Thought - War on the Rocks

Read More..

2022 MAY 11 (NewsRx) -- By a News Reporter-Staff News Editor at Insurance Daily News -- A patent by the inventors Hatch, Thomas S. (Lehi, UT, US), filed on September 7, 2018, was published online on April 19, 2022, according to news reporting originating from Alexandria, Virginia, by NewsRx correspondents.

Patent number 11310283 is assigned to VMware Inc. (Palo Alto, California, United States).

The following quote was obtained by the news editors from the background information supplied by the inventors: Recent years have seen rapid development in software products and electronic devices. For example, software products can affect functionality related to communication of data to and from electronic devices as well as operation of operating systems and/or individual applications installed on the electronic devices. As software and hardware become more complex, it becomes increasingly difficult to effectively secure information contained on electronic devices as well as information transmitted to and from electronic devices (e.g., over the Internet). Indeed, in an attempt to gather information, many individuals use viruses, spyware, malware, and other threatening tools to gather sensitive and/or valuable information.

While many tools exist for avoiding potential threats in cybersecurity of electronic devices, conventional cybersecurity systems often fail to adequately address potential security issues. For example, conventional cybersecurity systems typically utilize dedicated diagnostic tools for identifying whether a personal computer is compliant with a known security standard. Conventional diagnostic tools, however, are limited to providing a report of settings or configurations on a device that are out of compliance with a known set of standards. The report is then generally provided to an information technology (IT) administrator who manually addresses issues identified by the report or, alternatively, utilizes a separate software tool to facilitate remediation of various issues identified by the diagnostic tool.

In addition to failing to enable effective diagnosis and remediation of potential security issues, conventional cybersecurity systems can be inflexible and computationally prohibitive. For example, conventional cybersecurity systems are often limited to scanning a device for compliance with a specific security standard (e.g., Center for Internet Security (CIS) standards, Standard Technical Implementation Guide (STIG) standards, Payment Card Industry (PCI) standards, and Health Insurance Portability and Accountability Act (HIPAA)). As a result, conventional systems may provide an effective tool for identifying potential security threats for a select group of devices or programs uniquely tailored to a particular security standard. However, conventional cybersecurity systems may fail to effectively identify potential security threats for other devices or programs not specifically tailored to the security standard. Furthermore, while a device may simply run different security checks based on multiple security standards, running comprehensive checks based on multiple standards can be expensive and can utilize significant computing resources.

These along with additional problems and issues exist with regard to conventional cybersecurity systems.

In addition to the background information obtained for this patent, NewsRx journalists also obtained the inventors summary information for this patent: Embodiments of the present disclosure provide benefits and/or solve one or more of the foregoing and other problems in the art with systems, methods and computer-readable media that enforce security policies on a client device (or other computing device). In particular, in one or more embodiments, the disclosed systems enforce security policies by performing operations that enable an agent on the client device to both scan and fix security issues. For example, the disclosed systems can enforce a security policy by performing an idempotent operation in which a check and a fix of a security policy are the same operation (e.g., a check operation is the fix operation). In this way, the systems described herein can effectively identify and remediate configuration settings of a client device out of compliance with security standards using a single software agent.

In addition, in one or more embodiments the disclosed systems provide a policy-driven approach to enforcing security policies applicable to a wider range of client devices and applications. Indeed, by providing a policy-driven approach to enforcing security policies, the disclosed systems can enable a client device to comply with multiple security standards while performing a fewer number of operations than conventional systems, thereby improving performance of the client device without sacrificing substantial processing resources. In addition, by enforcing security policies using a policy-driven approach, the disclosed systems provide more effective security across a wider range of client devices and applications for which different security standards may be better suited to address potential security issues.

Additional features and advantages of one or more embodiments of the present disclosure are outlined in the description which follows, and in part will be obvious from the description, or may be learned by the practice of such example embodiments.

The claims supplied by the inventors are:

1. A system comprising: at least one processor; and a computer-readable medium storing instructions thereon that, when executed by the at least one processor, cause a computing device to: maintain a plurality of security policies, the plurality of security policies including: a plurality of configuration states associated with configuration settings of a client device, the configuration settings referring to one or more settings of an application or operating system on the client device that grant or restrict access to one or more intended functionalities of the application or operating system; and mapping information associating the plurality of security policies to a plurality of security standards; receive a request to enforce a first security standard from the plurality of security standards; identify a first subset of security policies from the plurality of security policies having mapping information associated with the first security standard for enforcement on the client device, wherein enforcing the first security standard includes causing the client device to perform an operation to enforce a configuration state for a corresponding configuration setting defined by a security policy from the identified subset of security policies regardless of a current state of the configuration setting prior to receiving the request to implement the plurality of security policies on the client device; determine whether an exemption applies to at least one of the first subset of security policies; in response to determining that the exemption applies to the at least one of the first subset of security policies, bypass enforcement of the at least one of the first subset of security policies; and identify a second subset of security policies from the plurality of security policies having mapping information associated with a second security standard for enforcement on the client device.

2. The system of claim 1, wherein the operation to enforce the configuration state includes an idempotent operation in which a check and a fix of the security policy are the same operation.

3. The system of claim 1, wherein the instructions cause the computing device to: receive a report including information associated with enforcing at least one of the first or second subset of security policies on the client device; and generate a compliance report indicating a measure of compliance with at least one of the first or second security standard.

4. The system of claim 3, wherein generating the compliance report further includes: based on overlap between mapping information for the first subset of security policies and the mapping information associated with the second security standard, providing, within the compliance report, an indication of a second measure of compliance with the second security standard.

5. The system of claim 1, wherein the instructions cause the computing device to provide an option to request enforcement of the second security standard.

6. The system of claim 1, wherein enforcing the second security standard includes causing the client device to perform one or more operations to enforce one or more configuration states for one or more corresponding configuration settings defined by the second subset of security policies.

7. The system of claim 1, wherein the plurality of security standards includes two or more of Center for Internet Security (CIS) standards, Standard Technical Implementation Guide (STIG) standards, Payment Card Industry (PCI) standards, and Health Insurance Portability and Accountability Act (HIPAA) standards, and wherein the instructions further cause the computing device to: generate the mapping information for the plurality of security policies by mapping the plurality of configuration states associated with configuration settings of the client device to respective security standards from the plurality of security standards.

8. A computer-implemented method comprising: maintaining a plurality of security policies, the plurality of security policies including: a plurality of configuration states associated with configuration settings of a client device, the configuration settings referring to one or more settings of an application or operating system on the client device that grant or restrict access to one or more intended functionalities of the application or operating system; and mapping information associating the plurality of security policies to a plurality of security standards; receiving a request to enforce a first security standard from the plurality of security standards; identifying a first subset of security policies from the plurality of security policies having mapping information associated with the first security standard for enforcement on the client device, wherein enforcing the first security standard includes causing the client device to perform an operation to enforce a configuration state for a corresponding configuration setting defined by a security policy from the identified subset of security policies regardless of a current state of the configuration setting prior to receiving the request to implement the plurality of security policies on the client device; determining whether an exemption applies to at least one of the first subset of security policies; in response to determining that the exemption applies to the at least one of the first subset of security policies, bypassing enforcement of the at least one of the first subset of security policies; and identifying a second subset of security policies from the plurality of security policies having mapping information associated with a second security standard for enforcement on the client device.

9. The computer-implemented method of claim 8, further including: receiving a report including information associated with enforcing at least one of the first or second subset of security policies on the client device; and generating a compliance report indicating a measure of compliance with at least one of the first or second security standard.

10. The computer-implemented method of claim 9, wherein generating the compliance report further includes: based on overlap between mapping information for the first subset of security policies and the mapping information associated with the second security standard, providing, within the compliance report, an indication of a second measure of compliance with the second security standard.

11. The computer-implemented method of claim 8, wherein enforcing the second security standard includes causing the client device to perform one or more operations to enforce one or more configuration states for one or more corresponding configuration settings defined by the second subset of security policies.

12. A non-transitory computer-readable medium storing instructions thereon that, when executed by at least one processor, cause a computing device to: maintain a plurality of security policies, the plurality of security policies including: a plurality of configuration states associated with configuration settings of a client device, the configuration settings referring to one or more settings of an application or operating system on the client device that grant or restrict access to one or more intended functionalities of the application or operating system; and mapping information associating the plurality of security policies to a plurality of security standards; receive a request to enforce a first security standard from the plurality of security standards; identify a first subset of security policies from the plurality of security policies having mapping information associated with the first security standard for enforcement on the client device, wherein enforcing the first security standard includes causing the client device to perform an operation to enforce a configuration state for a corresponding configuration setting defined by a security policy from the identified subset of security policies regardless of a current state of the configuration setting prior to receiving the request to implement the plurality of security policies on the client device; determine whether an exemption applies to at least one of the first subset of security policies; in response to determining that the exemption applies to the at least one of the first subset of security policies, bypass enforcement of the at least one of the first subset of security policies; and identify a second subset of security policies from the plurality of security policies having mapping information associated with a second security standard for enforcement on the client device.

13. The non-transitory computer-readable medium of claim 12, further including instructions that, when executed by the at least one processor, cause the computing device to: receive a report including information associated with enforcing at least one of the first or second subset of security policies on the client device; and generate a compliance report indicating a measure of compliance with at least one of the first or second security standard.

14. The non-transitory computer-readable medium of claim 13, wherein generating the compliance report further includes: based on overlap between mapping information for the first subset of security policies and the mapping information associated with the second security standard, providing, within the compliance report, an indication of a second measure of compliance with the second security standard.

15. The non-transitory computer-readable medium of claim 12, wherein enforcing the second security standard includes causing the client device to perform one or more operations to enforce one or more configuration states for one or more corresponding configuration settings defined by the second subset of security policies.

URL and more information on this patent, see: Hatch, Thomas S. Scanning and remediating configuration settings of a device using a policy-driven approach. U.S. Patent Number 11310283, filed September 7, 2018, and published online on April 19, 2022. Patent URL: http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=11310283.PN.&OS=PN/11310283RS=PN/11310283

(Our reports deliver fact-based news of research and discoveries from around the world.)

Read the original here:
Patent Issued for Scanning and remediating configuration settings of a device using a policy-driven approach (USPTO 11310283): VMware Inc. - Insurance...

Read More..