Process Tainting for Zero Trust Security and Application Reliability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity of modern enterprise infrastructure, particularly in zero trust security models, makes it difficult to identify and manage unknown application behaviors, leading to potential false alerts or application failures when enforcing a zero trust posture, as legacy perimeter-based security methods are insufficient and can hinder lateral movement.
Innovation Solution
A system and method for tainting suspicious processes, allowing execution while monitoring and blocking access to sensitive assets or operations, and raising alerts when sensitive actions are attempted, using telemetry data, kernel-level instruments, and container orchestration systems to differentiate between known and unknown processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If zero trust security posture is enforced to block unknown processes, then security protection is improved, but application functionality deteriorates due to false alerts and blocking of benign operations
Solution Approach 1:
The patent applies different security policies to different processes based on their characteristics. Known processes receive standard monitoring while unknown processes are evaluated individually. Benign unknown processes (like periodic backup utilities) are allowed to execute after evaluation, while malicious ones are blocked. This local differentiation resolves the contradiction by protecting security without unnecessarily blocking application functionality.
Solution Approach 2:
The system performs preliminary evaluation of unknown processes before blocking them. When an unknown process is detected, the system checks process lists, evaluates the process against security policies, and only then decides whether to block or allow execution. This preliminary action prevents false positives from blocking benign operations while maintaining security protection.
2Reliability
If comprehensive monitoring of all application behaviors is implemented to identify zero trust posture, then security coverage is improved, but system complexity increases making it difficult to manage
Solution Approach 1:
The patent segments the security monitoring system into distinct components: process identification module, process list management module, evaluation module, and policy enforcement module. Each component handles a specific aspect of security monitoring, making the overall system more manageable despite comprehensive coverage. The process lists are also segmented by application and behavior type.
Solution Approach 2:
The system uses universal process lists that can be applied across multiple applications and contexts. These process lists serve multiple functions: identifying known processes, evaluating unknown processes, and enforcing security policies. This multi-functionality reduces system complexity by reusing the same structures across different security scenarios.
3Object-affected harmful factors
If unknown processes are completely blocked to prevent zero-day attacks, then security against unknown threats is improved, but application reliability deteriorates due to blocking of legitimate periodic operations
Solution Approach 1:
The security policy is dynamic rather than static. When an unknown process is detected, the system evaluates it against current process lists and security criteria. If the process is determined to be benign (such as a periodic backup utility), the policy is updated to allow that specific process. This dynamic adaptation maintains protection against zero-day attacks while ensuring application reliability.
Solution Approach 2:
The system implements feedback loops where the results of process evaluations are used to update process lists and refine security policies. When a periodic operation is identified as legitimate, feedback from its successful execution updates the system to recognize similar processes as known and benign. This feedback mechanism prevents future false positives while maintaining security.
Data Source
AI summary
The embodiments herein provide a system and method for tainting suspicious processes and applying targeted rules thereof are provided. The method involves tainting/tagging/marking unknown process and allowing execution of the unknown process, such that on identifying the unknown process, which tries to access a sensitive asset such as raw database tables or unknown process which carries out an operation that is usually considered advanced such as establishing network connection to external network, blocking the access or operation of the unknown process or increasing the severity level of the alert that is generated as a part of the sensitive access or operation of the unknown process.