Lateral Movement Firewall With Granular Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures for preventing lateral movement in cyberattacks are inadequate, particularly in early stages, as they often result in false positives and delayed or incomplete mitigation, especially when admin or super-admin accounts are compromised, allowing attackers to spread rapidly through networks.
Innovation Solution
Implementing a decentralized lateral movement firewall (LMF) that generates and distributes prevention policies dynamically across devices, allowing granular control over user functionalities to prevent unauthorized access and mitigate attacks without disrupting legitimate operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If centralized cybersecurity measures are used to detect and respond to lateral movement attacks, then response speed is improved, but false positives increase and legitimate operations are disrupted
Solution Approach 1:
The system segments the cybersecurity response by distributing policy enforcement agents to individual devices while maintaining centralized policy management. This allows localized decision-making at each device to reduce false positives while maintaining centralized coordination for rapid response to detected threats.
Solution Approach 2:
The patent implements local quality by enabling each device to enforce security policies independently through local agents. Each device can make granular decisions about what functionality to restrict based on the specific threat context, reducing unnecessary disruptions to legitimate operations while maintaining rapid response capability.
2Object-affected harmful factors
If broad blocking of remote access functionality is implemented to prevent lateral movement, then security coverage is improved, but legitimate remote operations are disrupted
Solution Approach 1:
The system applies partial action by implementing granular blocking of specific remote access functionalities rather than comprehensive blocking. The centralized policy service can selectively restrict only the functionalities needed for lateral movement while allowing other remote operations to continue, thus maintaining security coverage without disrupting legitimate work.
Solution Approach 2:
The patent implements dynamic security policies that can be adjusted in real-time based on detected threats. The centralized policy service can dynamically modify which functionalities are blocked and for which specific users or devices, allowing the system to adapt to changing security conditions while minimizing impact on legitimate operations.
3Stability of the object's composition
If centralized policy generation is used to coordinate security response, then policy consistency is improved, but deployment time across all devices increases
Solution Approach 1:
The system implements preliminary action by pre-distributing policy enforcement agents to all devices before threats occur. When a threat is detected, the centralized policy service can immediately push updated policies to already-prepared agents, significantly reducing deployment time while maintaining policy consistency through centralized generation.
Solution Approach 2:
The patent uses policy enforcement agents as intermediaries between the centralized policy service and device operations. These agents receive policies from the centralized service and execute them locally, enabling rapid policy deployment across the network while maintaining the consistency guarantees of centralized policy generation.
4Measurement precision
If granular control of user functionalities is implemented, then precision of attack prevention is improved, but system complexity increases
Solution Approach 1:
The patent extracts the complexity of granular policy management from individual devices and centralizes it in the policy service. The policy service handles the complex task of generating precise, granular policies, while devices simply enforce the policies provided by the central service, reducing device complexity while maintaining high precision in attack prevention.
Data Source
AI summary
In one or more examples disclosed herein, a potential cyberattack is detected in a centralized computer system. A centralized policy service generates a prevention policy in response, using the information about the potential cyberattack. The prevention policy allows granular blocking of selective functionality in respect of a certain user(s). Although generated centrally, one generated, the prevention policy is distributed to multiple computer devices (e.g. within an organization) for decentralized enforcement, by policy agents executed on those computer devices.