Techniques for providing security-related information

Abstract

Techniques are described for a computing system that provides security-related information by: (a) storing, by the computing system, security-related documents about a service provider; (b) monitoring, by the computing system, a plurality of security-related features of the service provided by the service provider, and storing the monitoring results; (c) receiving, by the computing system, a request to report security-related information about the service provider; (d) in response to receiving the request, creating a link for accessing the security-related document and the monitoring results; and (e) providing, by the computing system, access to the security-related document and the monitoring results to the user in response to the user accessing the link. Systems, apparatuses, and computer program products for performing the methods and similar methods are also described.

Description

Background Art

[0001] Service providers can provide a variety of online services to customers. Security and data privacy are important considerations in this relationship. If the service provider does not provide adequate security or if the service provider does not maintain the privacy of customer data, the customer may face many negative consequences. Therefore, before engaging with a service provider, the customer may ask the service provider to ensure that such security and data privacy are adequately provided for the customer's needs. For example, the customer may request a certification (such as a SOC-2 certificate) from a third party. The customer may also submit questions to the service provider, requesting the service provider to provide answers in response to these questions. Summary of the invention

[0002] However, it may be quite inefficient and incomplete for a customer to request specific information from a service provider. For example, different customers may request many of the same certificates from a service provider, but as different customers seek to engage with the service provider, requests must be repeatedly sent back and forth to obtain those same certificates. Similarly, different customers may request various other documents (e.g., policy documents, penetration test results, etc.) from a service provider, and there may be considerable overlap between the specific documents requested. In addition, many of the questions submitted by different customers may be almost identical, and the service provider may provide the same answers to many of these questions. Therefore, sending the same (or almost identical) requests and responses back and forth between a service provider and its potential customers may waste considerable time and communication resources. In addition, simply providing documents and responses may not be enough to assure customers of the security and data privacy of the service provider.

[0003] Therefore, it is desirable to implement a tool that allows a service provider to send the same information to all (or many) potential customers, so that customers do not have to request information separately, and the service provider does not have to provide a personalized response to each potential customer. It is also desirable to allow a monitoring service to monitor the security-related features of the services provided by the service provider in real time, ensuring that security and data privacy policies are actually followed and that documents are regularly updated. The tool can allow the service provider to select documents to provide to all requesting customers. The tool can also allow the service provider to select specific security-related features to be monitored and reported in real time. A link to an updated report can be provided to the customer, and the customer can view the real-time results of the document and the monitored security-related features at the link. In some embodiments, in response to a service provider requesting access to a customer, a personalized security link can be assigned to the customer. In other embodiments, the service provider can request to create a public link for use by any customer.

[0004] In one embodiment, a method for a computing system to provide security-related information is described by the following steps: (a) storing security-related documents about a service provider by the computing system; (b) monitoring a plurality of security-related features of a service provided by the service provider by the computing system, and storing the monitoring results; (c) receiving a request by the computing system to report security-related information about the service provider; (d) creating a link for accessing the security-related documents and the monitoring results in response to receiving the request; and (e) providing access to the security-related documents and the monitoring results to a user by the computing system in response to the user accessing the link. Systems, apparatuses, and computer program products for performing this method and similar methods are also described. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] The foregoing and other objects, features and advantages will be apparent from the following description of specific embodiments of the present disclosure, as shown in the accompanying drawings, in which like reference numerals refer to the same parts in different views. The accompanying drawings are not necessarily drawn to scale, emphasis instead being placed on illustrating the principles of the various embodiments.

[0006] Figure 1 Example systems, apparatus, computer program products, and associated data structures are shown for use with one or more embodiments.

[0007] Figure 2 Example methods are shown in accordance with one or more embodiments.

[0008] Figure 3 An example configuration page is shown for use with one or more embodiments.

[0009] Figure 4 An example report page is shown for use with one or more embodiments. DETAILED DESCRIPTION

[0010] Figure 1 An example system 30 is depicted for use in conjunction with the various embodiments. System 30 includes a network 32, a server computing device 38, a service provider (SP) 34, a third party authenticator, and a client computing device 72 operated by a user 39.

[0011] The network 32 may be any kind of communication network or collection of communication networks, such as, for example, a LAN, a WAN, a SAN, the Internet, a wireless communication network, a virtual network, a structure of interconnected switches, or the like.

[0012] SP 34 is an entity that provides one or more services 88 with security-related features 33 to a client (e.g., client computing device 72). Service 88 may be, for example, cloud-based software as a service (SaaS). In one example, service 88 may be an online email service. In another example, service 88 may be an online content creation platform. Security-related features 33 may include both security features (e.g., use of encryption, access control, enforcement of password policies, use of anti-malware software, etc.) and data privacy features (e.g., deleting customer data when a customer deregisters, limiting access to customer data classified as confidential, deleting customer data upon request, etc.).

[0013] SP 34 may include one or more computers (e.g., servers) potentially arranged in a cloud configuration. SP 34 may include both front-end and back-end computers. SP 34 may also include a physical location that houses some of the computers. Employees of SP 34 may access the physical location. SP 34 may also include physical access controls, such as key card restricted access to employees only, video surveillance, etc. These physical access controls may also be examples of security-related features 33.

[0014] An employee of SP 34 may be an administrator 37 who accesses one or more computers of the SP using user input devices 46 and display screen 35. Display screen 35 may be any type of display, including, for example, a CRT screen, an LCD screen, an LED screen, etc. Input devices 46 may include a keyboard, a keypad, a mouse, a trackpad, a trackball, a pointing stick, a joystick, a touch screen (e.g., embedded within display screen 35), a microphone / voice controller, etc. Administrator 37 may remotely access server computing device 38 to configure how report pages 66 (also referred to as "trust packets") are generated and distributed to potential customers. Administrator 37 may view and interact with trust packet configuration window 36 in order to perform this configuration.

[0015] Both the client computing device 72 and the server computing device 38 may be any kind of computing device, such as, for example, a personal computer, a laptop computer, a workstation, a server, an enterprise server, a tablet computer, a smart phone, etc. The client computing device 72 and the server computing device 38 both include processing circuitry 40, network interface circuitry 42, and memory 50. In addition, the client computing device 72 also includes user interface (UI) circuitry 44 for connecting to a UI input device 46 and a display device 48. The client computing device 72 and the server computing device 38 may also include various additional features known in the art, such as, for example, interconnection buses, etc.

[0016] Processing circuitry 40 may include any kind of processor or set of processors configured to perform operations, such as, for example, a microprocessor, a multi-core microprocessor, a digital signal processor, a system on a chip (SoC), a collection of electronic circuits, a controller of a similar kind, or any combination of the above.

[0017] The network interface circuitry 42 may include one or more Ethernet cards, cellular modems, Fibre Channel (FC) adapters, InfiniBand adapters, wireless network adapters (e.g., Wi-Fi), and / or other devices for connecting to a network 38 (e.g., a LAN, WAN, SAN, the Internet, a wireless communication network, a virtual network, a fabric of interconnected switches, etc.).

[0018] The memory 50 may include any kind of digital system memory, such as, for example, a random access memory (RAM). The memory 50 stores an operating system (OS, not depicted, such as Linux, UNIX, Windows, MacOS, or similar operating system) and various drivers and other applications and software modules configured to execute on the processing circuit 40, as well as various data.

[0019] The UI circuitry 44 may include any circuitry necessary to communicate with and connect to one or more user input devices 46 and a display screen 48. The UI circuitry 44 may include, for example, a keyboard controller, a mouse controller, a touch controller, serial bus ports and controllers, a universal serial bus (USB) port and controller, a wireless controller and antenna (e.g., Bluetooth), a graphics adapter and port, etc.

[0020] Display screen 48 may be any kind of display, including, for example, a CRT screen, an LCD screen, an LED screen, etc. Input device 46 may include a keyboard, a keypad, a mouse, a trackpad, a trackball, a pointing stick, a joystick, a touch screen (e.g., embedded within display screen 48), a microphone / voice controller, etc. In some embodiments, input device 46 and / or display screen 48 may be embedded within client computing device 72 (e.g., a cell phone or tablet computer with an embedded touch screen), rather than being external to client computing device 72.

[0021] The memory 50 of the client computing device 72 stores a web browser 74 that is configured to execute on the processing circuitry 40 of the client computing device 72 to interface between a user 39 operating a UI device 46 , 48 and the server computing device 38 .

[0022] The memory 50 of the server computing device 38 stores a monitoring module 60 and a web server 67. The monitoring module 60 is configured to monitor various features 33 of the SP 34 and store the results 62 when the results 62 are updated. The results 62 may take the form of a table storing a list of features 63 and corresponding values ​​64. In some embodiments, the values ​​64 may take the form of a Boolean value: 1 indicates that the corresponding feature 63 is activated, and 0 indicates that the corresponding feature 63 is not activated.

[0023] Web server 67 is configured to execute on processing circuitry 40 of server computing device 38 to interface with administrators 37 and users 39 .

[0024] The memory 50 of the server computing device 38 may also store a set of documents 51, a report page 66 including a report of the results 62 and a link to the document 51, and a list 57 of users who can access the report page 66. The document 51 may include a questionnaire 52 filled with information about the SP 34 and the services 88 and features 33 it provides, a policy document 53, penetration test results 54, frequently asked questions and answers (FAQ), and one or more of a certificate 56 provided by a third-party authenticator 70. The list 57 of users who can access the report page 66 may be in the form of a table that stores a list of user identifiers (IDs) 58 and corresponding links 59 to the report page 66. In some embodiments, the user ID 58 may be an email address of the corresponding user. In some arrangements, each user may have his own corresponding link 59 to the report page 66, so that only the user can access the report page 66 via the link 59. In some embodiments, the link 59 may have a corresponding security policy that restricts the use of such a link 59. In other arrangements, the list 57 may include only a single link 59 accessible to any user.

[0025] In operation, the administrator 37 interfaces with the web browser 67 via the trust group configuration window 36 to send specific documents 51 to the server computing device 38 and select which of those documents 51 should be included in the report page 66 (step 80). In some embodiments, some of the documents 51 may be provided by an entity other than the SP 34. For example, in some embodiments, the third-party authenticator 70 directly provides (step 81) the certificate 56 (e.g., a SOC-2 certificate, an ISO 27001 certificate, etc.) to the server computing device 38. In other embodiments, the third-party authenticator 70 provides the certificate 56 to the SP 34, and then the administrator 37 may choose to provide the certificate 56 to the server computing device 38. As another example, in some embodiments, the administrator 37 (or another representative of the SP 34) fills out the questionnaire 52 based on the policy and other information about the SP 34, and then the administrator 37 sends the filled-in questionnaire 52 to the server computing device 38. In other embodiments, the server computing device 38 fills out the questionnaire 52 based on information already available to the server computing device 38 (e.g., via the operation of the monitoring module 60). In other embodiments, server computing device 38 begins filling out questionnaire 52 based on information already available to server computing device 38 , and administrator 37 may then edit or supplement the answers on questionnaire 52 .

[0026] In some embodiments, the administrator 37 may also interface with the web browser 67 via the trust group configuration window 36 to configure the monitoring module to monitor specific features 63 .

[0027] In some embodiments, when a particular potential client of the SP 34 is interested in having the SP 34 provide service 88 to the potential client, the administrator 37 may interface with the web browser 67 via the trust group configuration window 36 (step 84) to adjust the list of users 57 that can access the report page 66 to include the particular potential client (e.g., by sending the email address of the particular potential client to the server computing device 38 for use as the user ID 58). This step (step 84) may also include establishing a policy for the link provided to the particular potential client (e.g., establishing an expiration policy or limiting access to a particular location, device, or application). Then, in step 85, the server computing device 38 sends the link 59 to one or more client computing devices 72 of the particular potential client.

[0028] In other embodiments, the administrator 37 interfaces with the web browser 67 via the trust group configuration window 36 to instruct the server computing device 38 to create a single link 59 that is accessible to anyone.

[0029] In step 86, the user 39 operates the web browser 74 to access the report page 66 from the server computing device 38 via the link 59 (in accordance with the security policy, if implemented). The user 39 is then able to view the document 51 and the results 62 of the real-time (including periodic) monitoring (performed by the monitoring module 60) of the security-related features 33 of the SP 34. The user 39 can then decide whether to have the SP 34 provide the service 88.

[0030] The memory 50 may also store various other data structures used by the OS, the module 60, the web server 67, the web browser 74, and various other applications and drivers. In some embodiments, the memory 50 may also include a persistent storage portion. The persistent storage portion of the memory 50 may be composed of one or more persistent storage devices, such as, for example, a disk, a flash drive, a solid-state storage drive, or other types of storage drives. The persistent storage portion of the memory 50 is configured to store programs and data even when the computing device 38, 72 is powered off. The OS, the modules 52, 60, and various other applications and drivers are typically stored in this persistent storage portion of the memory 50 so that they can be loaded into the system portion of the memory 50 when the system is restarted or as needed. The OS, the module 60, the web server 67, the web browser 74, and various other applications and drivers, when stored in a non-transitory form in a volatile or persistent portion of the memory 50, each form a computer program product. The processing circuit 40 running one or more applications thus forms a dedicated circuit constructed and arranged to perform the various processes described herein.

[0031] Figure 2 An example method 100 for providing security-related information performed by system 30 is shown. It should be understood that any time a piece of software (e.g., OS, module 60, web server 67, web browser 74, etc.) is described as performing a method, process, step, or function, it means that when the piece of software is executed on its processing circuit 40, the computing device on which the piece of software is running (e.g., client computing device 72 or server computing device 38) performs the method, process, step, or function. It should be understood that one or more steps or sub-steps of method 100 may be omitted in some embodiments. Similarly, in some embodiments, one or more steps or sub-steps may be combined together or performed in a different order. Dashed lines indicate that steps or sub-steps are optional or represent alternative embodiments or use cases.

[0032] In step 110, the server computing device 38 stores security-related documents 51 about the SP 34. Depending on the embodiment and the particular circumstances, these security-related documents 51 may be received from the SP 34, received from a third-party authenticator 70, generated locally on the server computing device 38, or some combination thereof. Step 110 may include various sub-steps 111-118.

[0033] In sub-step 111, the server computing device 38 stores the certificate 56 generated by the third-party authenticator 70. The certificate 56 may be received directly from the third-party authenticator 70 (see Figure 1 81), or may be received from SP 34 or another source.

[0034] In sub-step 112, the server computing device 38 stores the results 54 from the penetration test performed by the third party (eg, security consultant). These results 54 may be received directly from the third party, or they may be received from the SP 34 or another source.

[0035] In sub-step 113, the server computing device 38 stores a questionnaire 52 including questions and answers regarding the security policies and procedures of the SP 34. The questionnaire 52 may be received directly from the SP 34, it may be generated by the server computing device 38 based on information from the monitoring module 60, or it may be generated in part by the server computing device 38 using supplemental information and / or compilations from the SP 34.

[0036] In sub-step 114, the server computing device 38 stores a policy document 53 including a description of the security policy and / or data privacy policy of the SP 34. The policy document 53 may be received directly from the SP 34.

[0037] In sub-step 118, the server computing device 38 stores a FAQ 55 including questions and accompanying answers regarding the security policy and / or data privacy policy of the SP 34. The FAQ 55 may be received directly from the SP 34. It should be understood that although the FAQ 55 is depicted as a document 51, in some embodiments, the FAQ 55 may include questions and answers that are separately entered by the administrator 37, such as by typing or copying and pasting.

[0038] In some embodiments, the server computing device 38 receives instructions from the SP 34 (e.g., via an administrator 37 interfaced with the trust group configuration window 36) regarding which documents 51 (potentially including the FAQ 55, even if it is entered as a relevant document) are made available to the user via the reporting page 66 and which security-related features 33 are monitored and reported in the reporting page 66.

[0039] Figure 3An example configuration page 200 is depicted in accordance with some embodiments. Configuration page 200 may be an example of a trust group configuration window 36 generated by web server 67 and displayed to administrator 37 on display screen 35.

[0040] In some embodiments, the configuration page 200 may include a preview 202 of what the report page 66 will look like based on the current configuration settings. In some embodiments, when the administrator 37 clicks on the preview 202 using the input device 46, the web server 67 may navigate to display the preview 202 of what the report page 66 will look like based on the current configuration settings in a full window.

[0041] In some embodiments, the configuration page 200 may include a display 204 of statistics about the report page 66 , including, for example, information about how many documents 51 of various types have been uploaded or how often users have viewed each type of document 51 .

[0042] In some embodiments, the configuration page 200 may include a list 210 of documents 51 selected to be included on the report page 66 and a widget 215 that allows the administrator 37 to add or remove the selected documents 51 .

[0043] In some embodiments, the configuration page 200 may include a list 220 of security-related features 33 selected to be monitored by the monitoring module 60 and then displayed on the report page 66 and a widget 225 that allows the administrator 37 to add or remove monitored features 33.

[0044] In some embodiments, the configuration page 200 may include a free-form FAQ 230 to be included on the report page 66 and a widget 235 that allows the administrator 37 to edit the FAQ 230 .

[0045] Return to Figure 2 It should be understood that optional step 120 may include the administrator 37 interacting with the widgets 215 , 225 , 235 .

[0046] In step 125, server computing device 38 receives a request (eg, from administrator 37 of SP 34) to report security-related information about SP 34 on report page 66. Figure 3, the configuration page 200 includes a display 240 of the selected users and a widget 245 for adding or removing users (or for creating publicly accessible and / or publicly usable links 59). The display 240 may take the form of a table that displays the user IDs 241 of the selected users and corresponding statistics 242 of the links 59 created for these users. The statistics 242 may include, for example, information about when the user identified by the corresponding user ID 241 clicked on the link 59 or otherwise viewed the report page 66. As another example, the statistics 242 may include the number of times the user identified by the corresponding user ID 241 clicked on the link 59 or otherwise viewed the report page 66. Thus, in step 125, the administrator 37 may modify the list 240 by interacting with the widget 245 to add a new user ID 241 (e.g., an email address). The administrator 37 may modify the list 240 by interacting with the widget 245 to request the creation of a publicly accessible link 59 that can be accessed by anyone with the link 59. In some embodiments, once a publicly accessible link 59 has been created, the display 240 no longer includes the user ID 241 and the user statistics 242, while in other embodiments, the user ID 241 and the user statistics 242 remain in the display 240 along with an indication that a publicly accessible link 59 has been created using the statistics 242 about the publicly accessible link 59. The widget 245 may also allow the administrator 37 to create a security policy (or modify the default security policy) regarding how any link 59 to be created is used.

[0047] Return to Figure 2 In response to step 125, step 130 is performed. In step 130, server computing device 38 creates link 59 for accessing security-related documents 51 and monitoring results 62 via report page 66, and adds link 59 to list 57. Step 130 may include one or more of sub-steps 132-135.

[0048] In sub-step 132, which may be performed when step 125 includes requesting a report to a particular user, the server computing device 38 sends the link 59 to the particular user's email address, as entered by the administrator 37 in step 125. In other embodiments, the server computing device 38 sends the link 59 to the particular user using a different communication mode (e.g., text messaging).

[0049] In sub-step 135, which may also be performed when step 125 includes requesting a report to a specific user, the server computing device 38 establishes the link 59 as a secure user-specific link with a security policy restricting its use. For example, the link 59 may be generated with a cryptographic hash that is uniquely associated with the specific user. Sub-step 135 may include one or more of sub-steps 136-138.

[0050] In sub-step 136, server computing device 38 establishes a time-limited security policy. For example, link 59 may have an expiration time after which link 59 is no longer valid. As another example, link 59 may have an expiration interval defined by the first time a particular user accesses link 59 and the amount of time after the first time that link 59 is no longer valid.

[0051] In sub-step 137, the server computing device 38 establishes a security policy that is restricted by device or address (e.g., IP address). For example, the link 59 may be configured to be accessible only from a particular client computing device 72 (e.g., defined by its MAC address or another unique machine identifier) ​​or a particular IP address associated with a particular user. As another example, the first time a particular user accesses a link 59, the server computing device 38 may record the IP address (and possibly the port number or application identifier) ​​from which the particular user accessed the link 59, and thereafter the link 59 may only be accessed from the recorded IP address (and possibly the port number or application identified by the application identifier).

[0052] In sub-step 138, server computing device 38 establishes a security policy that allows administrator 37 to revoke link 59 at any time.

[0053] In sub-step 133 , which may be performed when step 125 includes requesting the report from any user via publicly accessible link 59 , server computing device 38 creates publicly accessible link 59 and provides it to administrator 37 for dissemination.

[0054] In step 140, which may be performed in the background by the monitoring module 60, the monitoring module 60 monitors a plurality of characteristics 63 of the service 88 provided by the SP 34 (e.g., those characteristics 33 selected by the administrator 37 in step 120), storing the monitored results 62. Step 140 may include one or more of sub-steps 142-147.

[0055] In sub-step 142, the monitoring module 60 accesses the computing resources of the SP 34 and confirms whether the service 88 complies with the selected characteristics 63. For example, the monitoring module 60 can access the back-end computing resources to determine how to provide the service 88. In some embodiments, the access can be performed securely. As another example, the monitoring module 60 can access other computing resources, such as cameras and key card readers installed on the physical premises of the SP 34 to ensure that there are no unauthorized persons who may interfere with security or data privacy. In some embodiments, the access can be performed securely.

[0056] In sub-step 143, monitoring module 60 checks for specific unexpired documents (e.g., policy documents and contracts) of the computing resources of SP 34. For example, one selected feature 63 may be the presence of an unexpired data privacy policy. As another example, one selected feature 63 may be the presence of an unexpired contract with an antivirus provider or insurance company.

[0057] Sub-step 144 indicates that step 140 is performed periodically (also referred to as "real time"). For example, step 140 is performed with a periodicity ranging between every 1 minute and every 120 minutes. A typical periodicity may be approximately once an hour.

[0058] In sub-step 146, the monitoring module 60 monitors security features. Examples of security features may include whether encryption is used in various defined contexts, whether access controls are implemented in various defined contexts, whether various password policies are enforced (e.g., whether certain resources are blocked if a password is not entered, whether restrictions on password types defined by the policy are actually enforced when a password is created, etc.), whether anti-malware software is running, etc. It should be understood that more types of security features may also be monitored.

[0059] In sub-step 147, the monitoring module 60 monitors data privacy characteristics. Examples of data privacy characteristics may include whether customer data is actually deleted when a customer deregisters from a service 88 maintained by the SP 34, whether access to customer data classified as confidential is restricted, whether customer data requested for deletion is actually deleted, etc. It should be understood that more types of data privacy characteristics may also be monitored.

[0060] In step 150, the user may access link 59, for example via web browser 74 operating on client computing device 72. In embodiments where a security policy may be used (see above in conjunction with sub-step 135), server computing device 38 enforces the security policy when user 39 accesses link 59.

[0061] In response to step 150, in step 160, the server computing device 38 (e.g., via the web server 67) provides access to the (selected) security-related documents 51 and the stored monitoring results 62 to the user 39 via the report page 66 downloaded to the web browser 74. The user 39 may view the report page display 75 on the display screen 48. In some embodiments, step 160 may include sub-steps 162-166.

[0062] In sub-step 162 , the server computing device 38 generates a report page 66 summarizing the monitoring results 62 and links to the selected security-related documents 51 . Figure 4 An example report page 300 is depicted. The report page 300 may include a name 306 of the SP 34, a list 310 with links to the selected security-related documents 51, and a list of features 63 monitored by the monitoring module 60. In some embodiments, only features 63 whose corresponding result values ​​64 are positive values ​​are displayed in the list 320; therefore, features 63 whose corresponding result values ​​64 are negative values ​​are omitted from being displayed in the list 320. In other embodiments, features 63 whose result values ​​64 are negative values ​​are also displayed in the list 320 along with an indication that those features 63 are not confirmed. In some embodiments, the list 320 includes an indication of the last time the stored monitoring results 62 were updated. In some embodiments, the FAQ 330 is displayed separately from the other security-related documents 51 on the report page 300. Although the other security-related documents 51 are only linked from the report page 300, the FAQ 330 can be displayed directly on the report page 300.

[0063] Return to Figure 2 , in sub-step 164, the web server 67 sends the report page 66, 300 to the web browser 74 to display the report page display 75 on the display screen 48. In sub-step 166, when the results 62 are updated in real time (see sub-step 144 above), the server computing device 38 updates the results 62 on the report page 66, 300, and the web server 67 sends the update to the web browser 74 so that the report page display 75 can be updated on the display screen 48.

[0064] Thus, a tool has been provided that allows SP 34 to send the same information (e.g., report page 66, 300) to one or more potential customers, eliminating the need for customers to request information individually and eliminating the need for SP 34 to provide personalized responses to each potential customer. The tool also allows monitoring module 60 to monitor the security-related features 33 of the service 88 provided by SP 34 in real time, ensuring that security and data privacy policies are actually followed and that documents are updated regularly. The tool can allow SP 34 to select documents 51 to provide to one or more requesting customers. The tool can also allow SP 34 to select specific security-related features 63 to be monitored and reported in real time or periodically. A link 59 to the updated report 66, 300 can be provided to the customer, where the customer can view the document 51 and the real-time results 62 of the monitored security-related features 63. In some embodiments, in response to SP 34 requesting access to the customer, the customer can be assigned a personalized security link 59. In other embodiments, SP 34 can instead request the creation of a public link 59 for use by any customer.

[0065] While various embodiments of the present invention have been particularly shown and described, it will be understood by those skilled in the art that various changes in form and details may be made without departing from the spirit and scope of the invention as defined by the following claims.

[0066] It should be understood that although various embodiments have been described as methods, software embodying these methods is also included. Thus, one embodiment includes a tangible computer-readable medium (such as, for example, a hard disk, a floppy disk, an optical disk, a computer memory, a flash memory, etc.) programmed with instructions that, when executed by a computer or a group of computers, cause one or more of the methods described in the various embodiments to be performed. Another embodiment includes a computer programmed to perform one or more of the methods described in the various embodiments.

[0067] Furthermore, it is to be understood that all embodiments that have been described can be combined with each other in all possible combinations, unless such combinations are explicitly excluded.

[0068] Finally, nothing in this specification should be construed as an admission of any kind. Even if a technology, method, device, or other concept is specifically labeled as "prior art" or "conventional," Applicant does not admit that such technology, method, device, or other concept is actually prior art under 35 U.S.C. §102 or 103, as such determination is a legitimate determination that relies on many factors, not all of which are known to Applicant at this time.

Claims

1. A method for providing security-related information performed by a computing system, the method comprising: storing, by the computing system, security-related documents regarding the service provider; monitoring, by the computing system, a plurality of security-related characteristics of a service provided by the service provider, and storing monitoring results; receiving, by the computing system, a request to report security-related information about the service provider; In response to receiving the request, creating a link for accessing the security-related document and the monitoring result; as well as In response to a user accessing the link, access to the security-related document and monitoring results is provided to the user by the computing system.

2. The method according to claim 1, wherein: The security-related documents include one or more of the following: Certificates from third parties, The results of the penetration test, a questionnaire including information about the service provider and the service in response to standardized questions, and A policy document that explains the security or data privacy policy implemented by the service provider.

3. The method of claim 1, wherein monitoring the plurality of security-related characteristics of the service provided by the service provider comprises accessing computing resources of the service provider and confirming whether the service complies with one or more of the plurality of security-related characteristics.

4. The method according to claim 3, wherein: Storing the monitoring results is performed periodically.

5. The method according to claim 3, wherein: Monitoring the plurality of security-related characteristics includes monitoring security characteristics of the computing resource, including one or more of the following: The use of encryption, Access Control, Password policy enforcement, and Use of anti-malware software.

6. The method of claim 3, wherein monitoring the plurality of security-related characteristics comprises monitoring data privacy characteristics of the computing resources, including one or more of: Deletion of customer data when the customer cancels their registration, restrict access to customer data that is classified as confidential, and Delete customer data upon request.

7. The method of claim 3, wherein accessing the computing resource comprises accessing a backend of the service provider to comply with the one or more of the plurality of security-related characteristics.

8. The method of claim 3, wherein accessing the computing resource comprises checking for unexpired documentation maintained by the service provider.

9. The method according to claim 1, wherein: Receiving the request includes receiving an email address identifying the user; as well as Creating the link includes: associating the link with the received email address, the link having a security policy limiting its use; as well as The link is sent to the received email address.

10. The method according to claim 9, wherein: The security policy is an access point policy; Providing access to the user in response to the user accessing the link comprises associating the link with an access point from which the user initially accessed the link; and The method also includes denying access to the link from outside the access point after the user initially accesses the link.

11. The method according to claim 9, wherein: The security policy is a time-limited policy having an expiration time; and Access to the link is denied after the expiration time.

12. The method of claim 1, wherein: Receiving the request includes receiving an instruction to publicly report the security-related information; and Providing access to the user in response to the user accessing the link includes providing the access without a security policy.

13. The method according to claim 1, wherein: Providing the user with access to the security-related documents and monitoring results includes: generating a report page summarizing the monitoring results and links to the security-related documents; and The report page is sent to the user.

14. A computer program product comprising a non-transitory computer-readable storage medium storing a set of instructions that, when executed by a computing system, cause the computing system to provide security-related information by: Storing security-related documentation about service providers; monitoring a plurality of security-related characteristics of a service provided by the service provider, and storing monitoring results; receiving requests to report security-related information about service providers; In response to receiving the request, creating a link for accessing the security-related document and the monitoring result; as well as In response to a user accessing the link, the user is provided access to the security-related document and the monitoring results.

15. The computer program product of claim 14, wherein monitoring the plurality of security-related characteristics of the service provided by the service provider comprises accessing computing resources of the service provider and confirming whether the service complies with one or more of the plurality of security-related characteristics.

16. The computer program product of claim 14, wherein: Receiving the request includes receiving an instruction to publicly report the security-related information; and Providing access to the user in response to the user accessing the link includes providing the access without a security policy.

17. A system comprising: network; a service provider connected to the network; as well as One or more computing devices, the one or more computing devices comprising a processing circuit coupled to a memory, configured to provide security-related information by: Storing security-related documentation about service providers; monitoring, via the network, a plurality of security-related characteristics of a service provided by the service provider, and storing monitoring results; receiving, via the network, a request to report security-related information about the service provider; In response to receiving the request, creating a link for accessing the security-related document and the monitoring result; as well as In response to a user accessing the link, the user is provided access to the security-related document and the monitoring results via the network.

18. The system of claim 17, wherein monitoring the plurality of security-related characteristics of the service provided by the service provider comprises accessing computing resources of the service provider via the network and confirming whether the service complies with one or more of the plurality of security-related characteristics.

19. The system of claim 17, wherein: Receiving the request includes receiving an email address identifying the user; as well as Creating the link includes: associating the link with the received email address, the link having a security policy limiting its use; as well as The link is sent to the received email address.

20. The system of claim 17, wherein: Receiving the request includes receiving an instruction to publicly report the security-related information; and Providing access to the user in response to the user accessing the link includes providing the access without a security policy.

Images