Transverse moving firewall

Abstract

In one or more examples disclosed herein, potential network attacks are detected in a centralized computer system. In response, the centralized policy service may utilize information about potential network attacks to generate a protection policy. The protection policy allows fine-grained blocking of selective functionality for a particular user (s). Although the protection policies are centrally generated, once generated, the protection policies will be distributed to multiple computer devices (e.g., within an organization), decentralized enforcement by policy agents running on these computer devices.

Description

Technical Field

[0001] This disclosure relates to cybersecurity techniques for protecting against or mitigating cyberattacks involving lateral movement, and more particularly to systems, methods, and computer programs for implementing such cybersecurity techniques. Background Technology

[0002] In cybersecurity, lateral movement refers to the set of methods used by cyber attackers to explore and control a compromised network. After gaining an initial "foothold" in the network (e.g., by obtaining access to user login credentials), attackers typically attempt to consolidate and expand their presence, gaining access to additional data or systems. This activity is known as lateral movement. For example, an attacker compromising one host might conduct network reconnaissance and, based on this, attempt to compromise more hosts and escalate their privileges, often with the aim of gaining access to or control of critical components or systems. Remote access capabilities (e.g., those that facilitate remote procedure calls or remote access to a device's local file system) are a source of vulnerabilities. For example, such capabilities might be exploited in ransomware attacks, becoming a means of spreading ransomware from device to device throughout the network. Summary of the Invention

[0003] This synopsis is provided to introduce a series of concepts in a simplified form, which will be described in further detail in the specific embodiments described below. This synopsis is not intended to identify key or essential features of the claimed subject matter, nor is it intended to limit the scope of the claimed subject matter. The claimed subject matter is also not limited to implementations that address any or all of the shortcomings pointed out herein.

[0004] In one or more examples disclosed herein, a potential cyberattack is detected in a centralized computer system. In response, a centralized policy service uses information about the potential cyberattack to programmatically generate a protection policy. This protection policy allows for fine-grained blocking of selective features against specific users or groups of users involved in the potential cyberattack. Although the protection policy is generated centrally, once generated, it is distributed to multiple computer devices (e.g., within an organization) and decentralizedly enforced locally on these devices by policy agents running on those devices. Attached Figure Description

[0005] The following illustrative embodiments will now be described by way of example only, with reference to the following schematic diagrams, wherein:

[0006] Figure 1 A schematic block diagram of an example networked computer system is shown;

[0007] Figure 2 This provides a schematic overview of an example of multi-layered protection based on a protection strategy.

[0008] Figure 3 A first example configuration of a computer device is shown;

[0009] Figure 4 A second example configuration of the computer device is shown;

[0010] Figure 5 A flowchart for methods of network attack detection and mitigation is shown; and

[0011] Figure 6 A schematic block diagram of a computer system is shown. Detailed Implementation

[0012] Figure 1 A schematic block diagram of system 100 is shown, which includes organizational infrastructure 112 supported by network defense platform 102.

[0013] Organizational infrastructure 112 is associated with an organization (or "tenant") and is shown to include a user management service 114 (e.g., operated by a domain controller (DC)) and multiple computer devices 116 managed by the organization. User authentication functionality is provided to the computer devices 116 by the user management service 114. Typically, users of the computer devices are authenticated by entering user credentials(s) at the computer device. The user credentials(s) are then transmitted to the user management service 114 for authentication, a process that typically involves comparing the user credentials(s) with the user identity recorded at the user management service 114 and determining the permissions or set of permissions associated with that user identity.

[0014] User management service 114, among other functions, records user identities 130 (e.g., user accounts within the organization or external accounts linked to the organization) and permissions 132 associated with user identities 130 within the organization. In the example shown, user identities 134 can be grouped into user groups 134, and roles 136 can also be defined and assigned to user identities or user groups. Permissions 132 can then be associated with individual user identities, specific user groups, specific roles, or any combination thereof. User management service 114 is a centralized service used by the organization's computer devices 118 for local and centralized authentication of users (referred to herein as network or domain authentication).

[0015] As an example, role 136 is shown as including administrator (admin) role 136B, super administrator (or "root user") role 136C, and non-administrator role 136A. Administrator role 136B typically has higher privileges than non-administrator role 136A, and super administrator role 136C has higher privileges than administrator role 136B. It should be understood that this is merely an example, and more or fewer roles may be defined within an organization (e.g., different types of administrator roles and / or different types of non-administrator roles). Unless the context otherwise requires, the administrator account mentioned below includes the super administrator account.

[0016] Once a user completes authentication at the computer device, that user has access levels (e.g., access to files, settings, functions, etc.), defined by the permissions associated with the user's authenticated identity. Access levels are particularly restricted for non-administrator users.

[0017] In a remote access scenario, a first computer device 116A attempts to initiate some remote operation 120 at a second computer device 116B via a network to which it is connected. In this case, before allowing the remote access attempt, the second computer device 116B requires the first user device 116A to prove that the remote action is authorized. Typically, this involves the first computer device 116A transmitting authentication data 118 (such as authentication tokens, credentials, etc.) to the second computer device 116B, which then submits this authentication data to a user management service 114 for verification in a “remote” authentication process 124 (where “remote” means that the second computer device 116B is authenticating the user of the first computer device 116A attempting to initiate the remote operation 120).

[0018] To obtain the required authentication data, the first computer device 116A must first authenticate itself with the user management service 114 for a specific user identity, as described above. This can be referred to as the "local" user authentication process 122 (because it is the user of the first computer device 116A itself that is being authenticated, although a remote authentication service is being used). If authentication is successful, the authentication data 118 will be bound to the specific user identity, and then to the permissions associated with that specific user identity (directly or indirectly).

[0019] One possibility is that the authentication data 118 provided by the first computer device 116A is valid, but the user identity it is bound to does not have the necessary permissions to initiate remote operation 120. In this case, remote operation 120 is blocked and therefore cannot be executed at the second computer device 116B. For example, an organization may choose to restrict remote operations (or certain types of remote operations) to be performed only by administrator users, in which case remote operations attempted by non-administrator users are blocked.

[0020] Security "posture" refers to an organization's preparedness for cyberattacks. Techniques and mechanisms can be used to enhance this posture, such as blocking certain remote operations (e.g., Remote Procedure Call (RPC) operations or other remote protocol operations), ports, protocols, etc. In some cases, this approach can be combined with user context, such as blocking such elements for certain user roles (e.g., non-administrator roles). However, the limitation of this approach is that all choices are predetermined and statically configured, and are independent of any active attacks on the network. Furthermore, administrators and super administrators may require access levels that are somewhat incompatible with this approach. Therefore, compromised administrator or super administrator identities pose particular security risks.

[0021] The network defense platform 102 is shown to include a detection service 104 that receives network security telemetry (from one or more sources) and uses the network security telemetry to detect signs of potential network attacks. The network security telemetry can be collected, for example, from multiple sources (e.g., through network monitoring, endpoint proxies, cloud monitoring, etc.).

[0022] The action that the detection service 104 can take is to cause the user management service 114 to disable or restrict user identities involved in potential network attacks. For example, if an administrator or super administrator account is found to have been compromised, the account can be disabled. Once a user identity is disabled at the user management service 114, any subsequent local authentication process (e.g., local authentication process 122) or remote authentication process (e.g., authentication process 124) targeting that disabled user identity will fail.

[0023] However, account disabling methods have several limitations. First, in the early stages of an attack, the confidence level of the detection service 104 in finding an account compromised may be low. At this point, the probability of this finding being a false alarm is relatively high. In real-world systems, low-confidence detections have proven to be frequent false alarms because the early stages of an attack are often difficult to distinguish from legitimate activity. Disabling accounts can impact an organization. In particular, disabling administrator accounts can severely prevent legitimate administrator users from performing critical or necessary functions within the organization's infrastructure 112. Excessive disabling of non-administrator accounts can also significantly hinder productivity. Therefore, simply disabling the accounts involved at the very beginning of an attack is not feasible. It is especially important to avoid unnecessarily disabling administrator accounts, as this can impact the organization, but it is also problematic because those accounts pose the highest risk if compromised.

[0024] Therefore, in practice, disabling an account may only be feasible when there is a sufficiently high degree of confidence that the account is involved in a cyberattack. However, the risk in this case is that the disabling action comes too late and cannot effectively mitigate the attack. In centralized user authentication models, if an account is disabled only after the local authentication process or domain / network authentication process for the account has been successfully completed, the effect of disabling the account may be limited. For example, in Figure 1 In remote access scenarios, if the remote authentication process 124 for the administrator user identity has been completed, simply disabling the administrator user identity at the user management service 114 will be insufficient to prevent certain remote actions (even though the user identity has been disabled, the remote user already has an active login session on the target endpoint / server). The same result will occur if, instead of completely disabling the user identity, certain permissions are revoked at the user management service 114. In this case, centralized revocation of permissions may come too late; even if permissions are revoked, some remote actions cannot be prevented. Furthermore, the attacker may already possess the tickets or tokens that granted those revoked permissions.

[0025] In summary, the aforementioned types of mitigation solutions rely on other services (such as user management service 114) and tend to be "all or nothing," meaning they take rather aggressive mitigation actions (such as disabling accounts). Taking such actions requires a certain level of confidence, which is typically achieved late in the attack and therefore has little impact on the attack itself. The risk is that even if the activity is highly anomalous and can be detected promptly during the attack, ransomware actors can still spread rapidly across the network, making it difficult to address the issue through accountability and prevention measures.

[0026] In the following example, the "Lateral Movement Firewall" (LMF) is implemented through decentralized policy distribution and enforcement. LMF provides rapid blocking of lateral movement components. Protection policies are determined in a centralized manner but implemented in a distributed manner across the organization's computer devices 116. LMF is effective in the following scenarios: attempting lateral movement using accounts that have not yet been disabled or patched in the User Management Service 114; and attempting lateral movement using accounts that have been disabled in the User Management Service 114, but for which the attacker has previously obtained a valid authentication ticket or token for lateral movement.

[0027] LMF is a policy-based mechanism that allows a policy enforcement agent (a computer program running on the target machine) to dynamically restrict network-based functions performed on behalf of a user on the target machine based on insights generated by the detection service 104 (e.g., observations, alerts, detections, risk indicators, etc.).

[0028] Figure 1 The network defense platform 102 also includes a policy service 106. The policy service 106 receives information 105 from the detection service 104. This information may, for example, indicate the identity of the user attributable to the attack (i.e., the user who has been potentially compromised and is potentially involved in a network attack) and the level of confidence that the user is involved in an ongoing or ongoing network attack. Information 105 may include additional information, such as information about the nature of the potential attack and the level of confidence that the attack has actually occurred.

[0029] Policy service 106 uses information 105 to programmatically generate protection policy 107. In one embodiment, protection policy 107 is dynamically generated in response to a potential attack and customized according to the specific circumstances of the attack at that time. Specifically, protection policy 107 depends on which user(s) are currently involved in the attack, for example, it may depend on the confidence level of those users. Multiple protection policies can be generated to respond to an attack (or potential attack) as it develops. In another embodiment, protection policy 107 is generated based on one or more predetermined policies, according to the specific circumstances of the potential attack.

[0030] Protection policy 107 is distributed to each computer device 116 within the organization. Protection policy 107 contains a list of one or more user identities and, for each user identity, a set of one or more functions that restrict that user identity on the target machine.

[0031] The policy implementation agent receives and implements protection policy 107 on each computer device. Protection policy 107 is owned by policy service 106. In embodiments, policy service 106 includes computer programs or routines running in a cloud computing system or a centralized computer system.

[0032] Protection strategy 107 is implemented on all devices 116, although its success primarily affects devices that are not compromised or only partially compromised. For fully compromised devices, a "best-effort" implementation attempt is made. In some examples, the success of protecting compromised machines depends on the level of intrusion (e.g., local system code execution, proxy tampering, remote encryption only, etc.). However, it should be noted that the LMF mechanism remains highly effective even if one or more devices are fully compromised, because the LMF creates a boundary between any compromised (multiple) machines and the rest of the organization.

[0033] As an example, a first policy enforcement agent 117A is shown to be executed on a first computer device 11BA, and a second policy enforcement agent 117B is shown to be executed on a second computer device 116B.

[0034] By allowing fine-grained control over specific sets of features rejected by users, remediation actions are more flexible and allow for precise remediation.

[0035] This allows local policy enforcement agents to balance the degree of restriction applied to user identities with the risk of unnecessarily disrupting the network (e.g., in cases that prove to be false alarms). This creates an opportunity for policy enforcement agents to intervene early in the attack, halting the attacker's spread and buying time for other remediation tools to intervene and thoroughly fix the attack before the attacker compromises a large number of machines or touches more valuable assets (such as organizational servers).

[0036] Once the local policy enforcement agent receives the locally enforced policy 107 from the policy service 106, it will restrict any incoming requests made on behalf of the compromised user. This will allow healthy / uncompromised machines to protect themselves by preventing attackers from using compromised accounts to execute code on them and spread the impact within the organization to maximize their impact.

[0037] LMF runs in parallel with User Management Service 114, but is independent of User Management Service 114. To illustrate this independence, please refer to the following example scenario.

[0038] Assume that the first computer device 116A has been compromised, and the attacker has gained access to (multiple) credentials for the administrator user. The first authentication process 122 for the administrator user's identity has been successfully completed. The permissions associated with the administrator identity mean that certain remote access functions(s) are now available to the first computer device 116A. Therefore, the attacker is able to gain access to the second computer device 116B, triggering a remote authentication process 124 between the second computer device 116B and the user management service 114. This authentication succeeds because of the higher permissions associated with the compromised administrator account.

[0039] In this example scenario, detection service 104 detects some potentially suspicious behaviors or patterns associated with the compromised administrator user account and alerts policy server 106 (at which point the confidence level may be low). At this stage, there may be insufficient evidence of an attack to justify disabling the account. Therefore, the higher privileges associated with the administrator account at user management service 14 remain unchanged.

[0040] However, at this point, protection policy 107 can be generated, listing the compromised administrator accounts and one or more restricted functions associated with them. Policy server 106 distributes protection policy 107, which is received by first policy enforcement agent 117A and second policy enforcement agent 117B.

[0041] The second policy enforcement agent 117B on the second computer device 116B is monitored: Upon receiving the protection policy 107, the second policy enforcement agent 117B can immediately take steps to implement the protection policy 107, thereby restricting the scope of remote actions performed by the first computer device 116A based on the compromised administrator account. The protection policy 107 is fine-grained and can restrict (multiple) specific user identities and (multiple) specific functions associated with that (or each) user identity. Therefore, the second policy enforcement agent 117B can implement post-authentication mitigation based on the protection policy 107, greatly improving the responsiveness of system 100 to evolving attacks.

[0042] Note that protection policy 107 can override permission 132 maintained at user management service 114: while permission 132 associated with a given user identity may be sufficient to authorize access to specific functions, this can be overridden locally on the computer device by the policy protection agent based on the protection policy. Protection policy 107 is executed locally on different endpoints, rather than in the centralized user management service 114. Therefore, within user management service 114, a user with certain permissions may be "active," but these permissions may be at least partially overridden in a decentralized manner at the endpoints via the protection policy.

[0043] LMF is a multi-layered protection system that allows for both pre-authentication and post-authentication protection at different levels within the system.

[0044] The detection of network attacks (or suspected attacks) is performed centrally, and protection policies are also centrally determined. More comprehensive detection methods (e.g., utilizing larger volumes of data / telemetry and / or more resource-intensive detection) can be used for centralized detection compared to local detection at a given endpoint. However, once the protection policies are centrally determined, they are distributed to devices 116 within the organization for decentralized implementation across the network. In other words, the detection and creation of protection policies are performed centrally at policy service 106 (e.g., in a cloud computing system or other centralized computer system), but the policies are implemented decentralizedly across multiple machines (potentially including a combination of physical or virtual machines), thus eliminating single points of failure. By eliminating single points of failure, network security is improved compared to centralized implementations (where policies are centrally implemented on the data center, leaving the organization vulnerable to attackers targeting the data center itself, and any attacker who has gained access to the data center can bypass its solutions, thus weakening its protection). On a given second computer device, the protection strategy is implemented to counter remotely initiated operations (implemented on the first computer device), thereby providing enhanced network security because lateral movement can still be prevented or mitigated on the second computer device even if the first computer device has been completely compromised.

[0045] Figure 2 This provides a schematic overview of an example form of multi-layered protection implemented based on protection strategy 107. As an example, Figure 2 Considering Figure 1 The protection strategy 107 for remote actions initiated at the first computer device 116A is implemented at the second computer device 116B.

[0046] In this example, protection policy 107 can restrict specific functions of a specific user identity through the following layers: an additional local security policy layer (e.g., implementing additional authentication / login implementations outside of the authentication / login implementations centrally managed by user management service 114), a network filtering layer 204 (e.g., blocking network login attempts, blocking certain ports or bindings, and blocking specific remote access actions, such as through packet filtering, after successful network login and / or binding), and a file system filtering layer 206 (e.g., blocking read and / or write actions initiated remotely by a specific remote user).

[0047] For example, a local policy enforcement agent can implement additional (multiple) login enforcement, adding login / authentication policies on top of any login policies defined and implemented in the centralized user management service 114. This multi-layered approach is more flexible, allowing for immediate remediation actions at the appropriate level based on the attacker's intrusion progress.

[0048] Users typically log in remotely to a machine using network login or interactive login (e.g., RDP) via an account. As another example, a local policy enforcement agent can prevent certain types of logins (authentications), such as network logins or Remote Desktop Protocol (RDP) logins for the accountable user.

[0049] Examples of network logins that can be extracted include interactive network login (RDP), service login, or any other type of network login.

[0050] RPC allows remote users to perform remote functions on a target machine, such as remote service controllers (PsExec), Windows Management Instrumentation (WMI), remote registry access, and task schedulers. One or more of these functions can be selectively restricted according to policy 107.

[0051] More generally, a local policy agent can block remote access sessions via some remote access protocol (such as RPC), or (selectively) block certain remote access protocol actions in an established remote access session.

[0052] A local policy enforcement agent can prevent remotely attributed users from binding to an RPC interface, even after a successful network login (RPC filtering). For example, a second local policy enforcement agent 117A can prevent interface binding attempts by a first computer device 116B after a successful network login.

[0053] As another example, a local policy enforcement agent can implement Server Message Block (SMB) or Network File Share (NFS) file system enforcement, blocking file system operations via SMB or NFS, for example, to the extent defined in Protection Policy 107. Even if a remote user has successfully authenticated and established an SMB session, or even if the remote user has begun manipulating the file system (e.g., a user on first computer device 116A has begun encrypting files on second computer device 116B), the local policy enforcement agent can still block file system-related operations attempted via SMB / NFS.

[0054] Remote file sharing / access protocols such as SMB or NFS facilitate the creation, modification, and reading of files to / from a target machine over a network. Targeting these protocols in protection strategy 107 limits attackers' ability to exploit them in attacks.

[0055] The local policy enforcement agent 116B can also disconnect active endpoint sessions (e.g., RDP sessions or established active SMB sessions), for example by forcibly disconnecting or logging out endpoint sessions (e.g., RDP) of remote users established using the responsible user identities listed in protection policy 107.

[0056] As another example, the local policy enforcement agent 116B can block or terminate WinRM connections according to the protection policy 107.

[0057] Note that not all remote actions will necessarily be blocked for the user identity specified in protection policy 107. Upon detecting a first remotely initiated operation associated with a given user identity, the local policy enforcement agent (e.g., the second policy enforcement agent 117B) can determine that the first remotely initiated operation is permitted by the protection policy (even if protection policy 107 restricts (multiple) other types of remote actions for that user identity) and, in response, allow the remotely initiated operation.

[0058] Upon detecting a second remote initiation operation associated with a user identity, the local policy enforcement agent (e.g., second policy enforcement agent 117B) can match the second remote initiation operation with the user identity and restricted functionality in the protection policy (meaning that the second remote initiation is restricted for that user identity in the current protection policy) and, in response, block the second remote initiation operation.

[0059] As the attack progresses and more information becomes available, a second protective strategy can be generated and distributed. For example, in some cases, pre-ransomware behavior might be observed, escalating the risk. At this point, a first protective strategy can be generated and distributed, such as to block a specific protocol (SMB) because it is associated with the increased risk behavior, or to restrict overall connectivity to high-value assets within the organization until the risk is remedied. Subsequently, if more attack indications are detected, a second protective strategy with additional restrictions can be generated and distributed.

[0060] exist Figure 1 In the example, protection policy 107 is distributed to computer devices within the organization and is also received by the first computer device 116A. However, it can be seen that the implementation of protection policy 107 against remote actions does not depend on the successful implementation of policy 107 on the first computer device 116A (at which point the device may have been severely compromised).

[0061] Figure 3 A first example configuration of a second computer device 116B is shown, which includes a processor 302 (or more processors), a memory 304 (or more memories) coupled to the processor 302, and a network interface 308 coupled to the processor 302. Executable code is stored in memory 304 for execution on the processor 302. In this example, two execution modes are implemented: user mode 310 and kernel mode 312. The processor 302 is capable of switching between user mode 310 and kernel mode 312 depending on the type of code to be executed, for different parts of the code; this switching is managed by an operating system (OS) (not shown).

[0062] exist Figure 3 In example A, policy enforcement agent 117B is shown as including at least one user-mode component 314A (which runs in user mode 310) and at least one kernel-mode component 314B (which runs in kernel mode 312).

[0063] A first example function of the policy enforcement agent 117B is to implement selective network packet filtering at the second computer device 116B according to the protection policy 107. The network stack 316 is shown in kernel mode 316, where the basic filtering engine 318 runs in user mode 310, and the kernel filtering engine 320 runs in kernel mode 312. Both the basic filtering engine 318 and the kernel filtering engine 320 have packet filtering capabilities, meaning that both can operate to selectively filter (e.g., block or modify) incoming and / or outgoing network packets through the network stack 316. The policy enforcement agent 116B interacts with the basic filtering engine 318 and / or the kernel filtering engine 320 to selectively filter packets according to the protection policy. A specific use case is filtering incoming network packets involving restricted RPC operations (e.g., login, binding, etc.) or restricted SMB operations attempted by remote users (e.g., users of the first computer device 116A). In this example, restricted RPC or SMB operations are associated with the identity of the remote user in the protection policy, causing policy enforcement agent 117B to, for example, block the incoming packet.

[0064] The second example function of policy enforcement agent 117B (as a supplement to or replacement of the first example function) is to implement protection policy 107 via interaction with local security service 322 (or more services), such as implementing additional authentication / login enforcement, which is performed by... Figure 1 The authentication / login implementation is handled outside of the centralized management of the user management service 114. For example, when a user with special credentials attempts to authenticate to a second computer device 116B in a manner that violates protection policy 107 (locally or remotely), the policy enforcement agent 117B causes the local security service 322 to refuse authentication. As another example, if a user has already successfully authenticated, and subsequently multiple restrictions are imposed on that user in protection policy 107, the policy enforcement agent 117B can cause the local security service 322 to force the user to log out.

[0065] Figure 4 A second example configuration of the second computer device 116B is shown, in addition to including Figure 3 In addition to the components, this configuration is shown as including storage device 406 (or more devices) and file system 408. File system 408 operates in kernel mode, facilitating access to data (in file form) stored in storage device 406. Within file system 408, filter 410 is implemented.

[0066] The third example function of policy enforcement agent 117B (for reference) Figure 3 The first example function (or a supplement or alternative to the second example function described) is to selectively block operations (or attempted operations) within the file system 408 according to the protection policy 107. In this scenario, the policy enforcement agent 117B interacts with the file system filter 410.

[0067] One specific scenario involves a remote file access (e.g., read or write) request attempted by a user of the first computer device 116A. In this remote access scenario, the second computer device 116B acts as a server (servicing the first computer device 116A, which acts as a client). The second computer device 116B receives the remote access request at network interface 308 and passes it from network stack 316 to file system 408. The remote access request is associated with the identity of the remote user of the first computer device 116A. If the remote access request attempts to perform some remote file access operation currently restricted to that user identity, policy enforcement agent 117B causes file system filter 410 to block the attempted file access operation. Note that the protection policy 107 can be updated at any time, allowing remote file access operations to be blocked at various stages of an ongoing attack (or suspected attack).

[0068] Read / write requests initiated remotely from the first device 116A (the client in this example) are associated with the identity of the remote user, thus allowing these requests to be filtered locally on the server system (the second computer device 116B in this example) according to protection policy 107. This principle can be extended to any remote connection or remote access technology and is not limited to any particular protocol or operating system. Centralized attack detection and policy generation, combined with decentralized policy implementation targeting specific users and functions, allow for the widespread application of remote access technologies, thereby improving the protection or mitigation of lateral movement attacks.

[0069] Figure 5 An exemplary flowchart for methods of network attack detection and mitigation is shown.

[0070] In step 502, Figure 1 The policy service 106 receives information from the detection service 104 about potential cyberattacks affecting the organization.

[0071] In step 504, policy service 106 uses the information received from detection service 104 to generate a protection policy in the manner described herein.

[0072] In step 506, policy service 106 distributes the protection policy to computer devices 166 within the affected organization.

[0073] In step 508, the policy enforcement agent (e.g., 117A, 117B) on each computer device (e.g., 116A, 116B) implements a protection policy for remotely initiated operations detected at that computer device. This protection policy is implemented by selectively blocking remotely initiated operations according to the protection policy, and as noted, the protection policy can block operations against (multiple) specific users and (multiple) canonical functions in a manner described herein.

[0074] Figure 6A non-limiting example of a computing system 1200, such as a computing device or interconnected computing device, is schematically shown, which can perform one or more of the methods or processes described above. The computing system 1200 is shown in a simplified form. The computing system 1200 includes a logic processor 1202, volatile memory 1204, and non-volatile storage device 1206. The computing system 1200 may optionally include a display subsystem 1208, an input subsystem 1210, a communication subsystem 1212, and / or other components not shown in FIG. 10. The logic processor 1202 includes one or more physical (hardware) processors configured to perform processing operations. For example, the logic processor 1202 may be configured to execute instructions of one or more applications, programs, routines, libraries, objects, components, data structures, or other logical constructs. The logic processor 1202 may include one or more hardware processors configured to execute software instructions based on an instruction set architecture, such as a central processing unit (CPU), a graphics processing unit (GPU), or other forms of accelerated processors. Additionally or alternatively, the logic processor 1202 may include (multiple) hardware processors in the form of logic circuits or firmware devices, configured to execute hardware-implemented logic (programmable or non-programmable) or firmware instructions. The (multiple) processors of the logic processor 1202 may be single-core or multi-core, and the instructions executed thereon may be configured for sequential, parallel, and / or distributed processing. Individual components of the logic processor may optionally be distributed across two or more independent devices that may be remotely located and / or configured for coordinated processing. Aspects of the logic processor 1202 may be virtualized and executed by remotely accessible networked computing devices configured in a cloud computing configuration. In this case, these virtualized aspects run on different physical logic processors on various different machines. The non-volatile storage device 1206 includes one or more physical devices configured to store instructions executable by the logic processor 1202 to implement the methods and processes described herein. When the methods and processes are implemented, the state of the non-volatile storage device 1206 may change, for example, to store different data. Non-volatile storage device 1206 may include removable and / or built-in physical devices. Non-volatile storage device 1206 may include optical memory (e.g., CD, DVD, HD-DVD, Blu-ray disc, etc.), semiconductor memory (e.g., ROM, EPROM, EEPROM, flash memory, etc.), and / or magnetic memory (e.g., hard disk drive), or other high-capacity storage device technologies. Non-volatile storage device 1206 may include non-volatile, dynamic, static, read / write, read-only, sequential access, location-addressable, file-addressable, and / or content-addressable devices. Volatile memory 1204 may include one or more physical devices, including random access memory. Volatile memory 1204 is typically used by logic processor 1202 to temporarily store information during the processing of software instructions.Aspects of the logic processor 1202, volatile memory 1204, and non-volatile memory device 1206 can be integrated together into one or more hardware logic components. Such hardware logic components may include, for example, field-programmable gate arrays (FPGAs), programmable and application-specific integrated circuits (PASICs / ASICs), programmable and application-specific standard products (PSS / ASSPs), system-on-a-chip (SOCs), and complex programmable logic devices (CPLDs). The terms "module," "program," and "engine" can be used to describe aspects of the computing system 1200 typically implemented in software by a processor to perform specific functions using portions of volatile memory, including transformation processing specifically configured to perform those functions. Thus, a module, program, or engine can execute instructions stored in the non-volatile memory device 1206 via the logic processor 1202 and be instantiated using portions of the volatile memory 1204. Different modules, programs, and / or engines can be instantiated from the same application, service, code block, object, library, routine, API, function, etc. Similarly, the same module, program, and / or engine can be instantiated by different applications, services, code blocks, objects, routines, APIs, functions, etc. The terms "module," "program," and "engine" can encompass a single or a group of executable files, data files, libraries, drives, scripts, database records, etc. When the display subsystem 1208 is included, it can be used to present a visual representation of data stored by the non-volatile storage device 1206. The visual representation can take the form of a graphical user interface (GUI). Because the methods and processes described herein change the data stored by the non-volatile storage device, thereby changing the state of the non-volatile storage device, the state of the display subsystem 1208 can be changed to visually display changes in the underlying data. The display subsystem 1208 may include one or more display devices utilizing virtually any type of technology. Such display devices may be combined in the same housing as the logic processor 1202, volatile memory 1204, and / or non-volatile storage device 1206, or may be peripheral display devices. When the input subsystem 1210 is included, it may include or interact with one or more user input devices, such as a keyboard, mouse, touchscreen, or game controller. In some embodiments, the input subsystem may include or interact with selected Natural User Input (NUI) components. Such components may be integrated or peripheral, and the translation and / or processing of input actions may be performed internally or externally to the device. Example NUI components may include microphones for speech and / or speech recognition; infrared cameras, color cameras, stereo cameras, and / or depth cameras for machine vision and / or gesture recognition; head trackers, eye trackers, accelerometers, and / or gyroscopes for motion detection and / or intent recognition; electric field sensing components for assessing brain activity; and / or any other suitable sensors.When the communication subsystem 1212 is included, it can be configured to communicatively couple the various computing devices described herein to each other and to other devices. The communication subsystem 1212 may include wired and / or wireless communication devices compatible with one or more different communication protocols. As a non-limiting example, the communication subsystem may be configured to communicate via a wireless telephone network, or a wired or wireless local area network or wide area network. In some embodiments, the communication subsystem may allow the computing system 1200 to send messages to and / or receive messages from other devices via a network such as the Internet. The term "computer-readable medium" as used herein may include a computer storage medium. A computer storage medium may include volatile and non-volatile, removable and non-removable media (e.g., volatile memory 1204 or non-volatile storage 1206) implemented in any information storage method or technology for storing information (such as computer-readable instructions, data structures, or program modules). Computer storage media may include RAM, ROM, electrically erasable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage or other magnetic storage devices, or any other article of manufacture that can be used to store information and is accessible by a computing device (e.g., computing system 1200 or its component devices). Computer storage media do not include carrier waves or other propagated or modulated data signals. Communication media may be embodied in computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and include any information delivery medium. The term "modulated data signal" can describe a signal having one or more characteristics set or changed in a manner that encodes information in a signal. By way of example and not limitation, communication media may include wired media (such as wired networks or direct wired connections) and wireless media (such as acoustic, radio frequency (RF), infrared, and other wireless media). Example

[0075] According to a first aspect of this document, a computer-implemented method includes: receiving information about a potential cyberattack detected by a detection service at a policy service; generating a protection policy by the policy service using the information about the potential cyberattack, the protection policy including: a user identity having remote access rights and involved in the potential cyberattack, and restricted functions associated with the user identity; and transmitting the protection policy from the policy service to a policy enforcement agent executing on a computer device, such that the policy enforcement agent: upon detecting a first remote initiation operation associated with the user identity, determines that the first remote initiation operation is permitted by the protection policy, and allows the remote initiation operation in response; and upon detecting a second remote initiation operation associated with the user identity, matches the second remote initiation operation with the user identity and restricted functions in the protection policy, and blocks the second remote initiation operation in response. In an embodiment, the generated protection policy includes computer instructions for the policy enforcement agent running on the computer device, the computer instructions causing the policy enforcement agent to perform operations when executed by a computer processor associated with the computer device. In an embodiment, the operations include (a) upon detecting a first remote initiation operation associated with the user identity, determining that the first remote initiation operation is permitted by the protection policy, and allowing the remote initiation operation in response. Alternatively or additionally, the operation includes: upon detecting a second remotely initiated operation associated with a user identity, matching the second remotely initiated operation against the user identity and restricted functions in the protection policy, and in response, blocking the second remotely initiated operation.

[0076] According to a second aspect, a computer device includes: a processor; a network interface coupled to the processor; and a memory. The memory is coupled to the processor and configured to store computer-readable instructions configured to, when executed on the processor, cause the processor to: receive a protection policy via the network interface from a policy service, the protection policy including: a user identity having remote access rights and involved in a potential network attack, and restricted functions associated with the user identity; and, upon receiving the protection policy, detect a first remote initiation operation associated with the user identity; determine that the first remote initiation operation is permitted by the protection policy; allow the remote initiation operation in response to determining that the first remote initiation operation is permitted; detect a second remote initiation operation associated with the user identity after receiving the protection policy; match the second remote initiation operation with the user identity and restricted functions in the protection policy; and block the second remote initiation operation in response to the second remote initiation operation matching the user identity and restricted functions in the protection policy.

[0077] According to a third aspect, a computer-readable storage medium is configured to store executable instructions that, when executed on a processor of a computer device, cause the processor to: remotely obtain a protection policy from a policy service of the computer device, the protection policy including: a user identity having remote access rights and involved in a potential network attack, and restricted functions associated with the user identity; and, after obtaining the protection policy, detect a first remote initiation operation associated with the user identity; determine that the first remote initiation operation is permitted by the protection policy; in response to determining that the first remote initiation operation is permitted, allow the remote initiation operation; after obtaining the protection policy, detect a second remote initiation operation associated with the user identity; match the second remote initiation operation with the user identity and restricted functions in the protection policy; and, in response to the second remote initiation operation matching the user identity and restricted functions in the protection policy, block the second remote initiation operation.

[0078] In any of the embodiments described above, the restricted functionality may involve file access, and the policy enforcement agent may be configured to cause the computer device's file system to block a second remotely initiated operation.

[0079] For example, the restricted functionality could be Server Message Block (SMB) or Network File Sharing (NFS) functionality, and the second remotely initiated operation could be an SMB or NFS operation.

[0080] Restricted functionality may involve remote access protocols, and policy enforcement agents can be configured to prevent a second remotely initiated operation from being performed by the computer device's file system. A second remotely initiated operation may attempt to establish a remote access session or perform actions within an established remote access session.

[0081] For example, a second remotely initiated operation could be a network login attempt.

[0082] For example, a policy enforcement agent can prevent a second remotely initiated operation from being blocked by terminating the established remote access session in response to a received protection policy.

[0083] The restricted functionality can be Remote Procedure Call (RPC) or Remote Desktop Protocol (RDP) functionality, and the second remotely initiated operation can be an RPC or RDP operation.

[0084] For example, a second remote initiation operation could attempt to establish an RPC interface binding.

[0085] Protection policies can be transmitted from the policy service to multiple computer devices.

[0086] After a user's identity is successfully authenticated by a computer device, the protection policy can be received at the computer device.

[0087] Restricted functionality associated with a user identity allows a computer device to override permissions associated with that user identity, which would otherwise grant that user identity access to the restricted functionality.

[0088] For example, user identities can be authenticated through the user management service, and user identities are associated with permissions within the user management service.

[0089] Restricted functionality can involve file access, and policy enforcement agents can be configured to prevent a second remotely initiated operation from being performed on the computer device's file system.

[0090] The restricted functionality can be Server Message Block (SMB) or Network File Sharing (NFS) functionality, and the second remotely initiated operation can be an SMB or NFS operation.

[0091] Restricted functionality may involve remote access protocols, and policy enforcement agents can be configured to prevent a second remotely initiated operation from being initiated by the computer device's file system. A second remotely initiated operation may attempt to establish a remote access session or perform actions within an established remote access session.

[0092] The examples described herein should be understood as illustrative examples of embodiments of the invention. Other embodiments and examples are contemplated. Any feature described with respect to any example or embodiment may be used alone or in combination with other features. Furthermore, any feature described with respect to any example or embodiment may also be used in combination with one or more features of any other example or embodiment, or any combination of any other example or embodiment. Moreover, equivalents and modifications not described herein may be employed within the scope of this disclosure.

Claims

1. A computer-implemented method, comprising: The policy service receives information from the detection service regarding potential network attacks detected by the detection service. The policy service generates a protection policy using the information about the potential network attack, the protection policy including: The identities of users with remote access rights and involved in the potential cyberattack, and Restricted functionality associated with the user's identity; as well as The protection policy is transmitted from the policy service to the policy enforcement agent executed on the computer device, so that the policy enforcement agent: Upon detecting a first remote initiation operation associated with the user identity, it is determined that the first remote initiation operation is permitted by the protection policy, and in response, the remote initiation operation is allowed. Upon detecting a second remote initiation operation associated with the user identity, the second remote initiation operation is matched with the user identity and the restricted functions in the protection policy, and the second remote initiation operation is blocked in response.

2. A computer device, comprising: processor; The network interface coupled to the processor; as well as Memory, coupled to the processor and configured to store computer-readable instructions, configured to, when executed on the processor, cause the processor to: The protection policy is received from the policy service via the network interface, and the protection policy includes: The identities of users with remote access rights and involved in potential cyberattacks, and Restricted functionality associated with the user identity; and Upon receiving the protection policy, a first remotely initiated operation associated with the user's identity is detected; Determine that the first remotely initiated operation is permitted by the protection policy; In response to determining that the first remote initiation operation is permitted, the remote initiation operation is allowed; Upon receiving the protection policy, a second remotely initiated operation associated with the user's identity is detected; Match the second remotely initiated operation with the user identity and restricted functions in the protection policy; and In response to the second remote initiation operation matching the user identity and the restricted functions in the protection policy, the second remote initiation operation is blocked.

3. The method or computer device of claim 1 or 2, wherein the restricted functionality relates to file access, and the policy enforcement agent is configured to cause the file system of the computer device to block the second remotely initiated operation.

4. The method or computer device of claim 3, wherein the restricted function is a Server Message Block (SMB) function or a Network File Sharing (NFS) function, and the second remotely initiated operation is an SMB or NFS operation.

5. The method or computer device according to any of the preceding claims, wherein the restricted functionality relates to a remote access protocol, and the policy enforcement agent is configured to cause the file system of the computer device to block the second remote initiation operation, wherein the second remote initiation operation attempts to establish a remote access session or perform an action in an established remote access session.

6. The method or computer device of claim 5, wherein the second remote initiation operation is a network login attempt.

7. The method or computer device of claim 5, wherein the policy enforcement agent prevents the second remote initiation operation from being blocked by terminating the established remote access session in response to receiving the protection policy.

8. The method or computer device of claim 5, wherein the restricted function is a Remote Procedure Call (RPC) or Remote Desktop Protocol (RDP) function, and the second remote initiation operation is an RPC or RDP operation.

9. The method or computer device of claim 8, wherein the second remote initiation operation attempts to establish an RPC interface binding.

10. The method according to claim 1 or any dependent claim thereof, wherein the protection policy is transmitted from the policy service to a plurality of computer devices.

11. The method or computer device according to any of the preceding claims, wherein the protection policy is received at the computer device after the user identity is successfully authenticated by the computer device.

12. The method or computer device of claim 11, wherein the restricted functionality associated with the user identity causes the computer device to override permissions associated with the user device, which would otherwise authorize the user identity to access the restricted functionality.

13. The method or computer apparatus of claim 12, wherein the user identity is authenticated through a user management service, and the user identity is associated with the permissions at the user management service.

14. A computer-readable storage medium configured to store executable instructions that, when executed on a processor of a computer device, cause the processor to: The protection policy is remotely obtained from a policy service of the computer device, and the protection policy includes: The identities of users with remote access rights and involved in potential cyberattacks, and Restricted functionality associated with the user's identity; as well as After obtaining the protection policy, detect the first remotely initiated operation associated with the user identity; Determine that the first remotely initiated operation is permitted by the protection policy; In response to determining that the first remote initiation operation is permitted, the remote initiation operation is allowed; After obtaining the protection policy, detect a second remotely initiated operation associated with the user identity; The second remote initiation operation is matched with the user identity and the restricted functions in the protection policy; as well as In response to the second remote initiation operation matching the user identity and the restricted functions in the protection policy, the second remote initiation operation is blocked.

15. The computer-readable storage medium of claim 14, wherein the restricted functionality relates to file access, and the policy enforcement agent is configured to cause the file system of the computer device to block the second remotely initiated operation.

Images