Separating Security Policy Rules from Detection Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity of software systems makes it difficult for developers to identify and remove vulnerabilities before software release, leading to delayed patch installations due to concerns about unintended side effects, and existing security policies require time-consuming and error-prone customization and distribution processes.
Innovation Solution
A method and system that separates developer-provided detection criteria from administrator-provided custom policies, allowing for independent development and distribution of signature files and custom policies, enabling seamless updates and enforcement of security rules without modifying existing customizations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If security policies are customized by modifying parameters of detection criteria, then the security policy can be adapted to enterprise needs, but the customization process becomes time-consuming and error-prone
Solution Approach 1:
The patent segments the security policy into two independent parts: detection criteria (signatures) and custom policy rules. Detection criteria are maintained centrally by developers, while administrators only need to customize the policy rules that reference these criteria. This segmentation eliminates the need to modify detection criteria during customization, significantly reducing customization time and errors while preserving adaptability.
Solution Approach 2:
The patent implements preliminary action by pre-defining detection criteria (signatures) with stable, versioned identifiers before distribution. Administrators receive pre-packaged security policies that reference these stable identifiers, allowing them to customize policies by selecting and configuring pre-validated detection criteria rather than creating or modifying them from scratch, thus reducing customization complexity and time.
2Reliability
If updated security policies are distributed to administrators for customization, then the latest security signatures are available, but the customization and redistribution process delays the deployment of security updates
Solution Approach 1:
The patent separates detection criteria distribution from policy distribution. Developers can distribute updated detection criteria independently to administrators, who then automatically incorporate them into their customized policies without manual re-customization. This segmentation enables continuous updates to security signatures while maintaining customized policy configurations, eliminating deployment delays.
Solution Approach 2:
The patent uses copying by maintaining central repositories of detection criteria that are referenced by customized policies. When detection criteria are updated, the updated versions are copied to administrators' systems, and their customized policies automatically reference the new versions through stable identifiers. This copying mechanism ensures currency of security signatures without requiring administrators to redo customization work.
3Stability of the object's composition
If administrators delay patch installation to avoid unintended side effects, then system stability is maintained, but vulnerability exposure time increases
Solution Approach 1:
The patent implements preliminary action by requiring comprehensive testing and validation of detection criteria before they are distributed to administrators. Detection criteria undergo rigorous testing in controlled environments to identify and eliminate unintended side effects before release. This preliminary validation gives administrators confidence to deploy updates immediately without delaying for additional testing, reducing vulnerability exposure while maintaining system stability.
Solution Approach 2:
The patent enables self-service by allowing administrators to maintain their customized security policies without manual intervention when detection criteria are updated. The system automatically incorporates updated detection criteria into existing customized policies, eliminating the need for administrators to manually test or validate each update. This automated self-updating process reduces both vulnerability exposure time and the risk of human error in manual patch management.
Data Source
AI summary
A method and system that enables a security policy to separate developer-provided detection criteria from an administrator-provided custom policy is provided. The security system allows a developer of detection criteria to provide a signature file containing the signatures that are available for use by a security policy. The security system also allows an administrator of a computer system to specify a custom policy that uses the signatures of the signature file. The developer may distribute the signature file to host computer systems independently of the administrator's distribution of the rules of the custom policy to the host computer systems. When a security enforcement event occurs at the host computer system, the security system applies the rules of the security policy to the event.