Abstract:
The security of network connections on a computing device is protected by detecting and preventing compromise of the network connections, including man-in-the-middle (MITM) attacks. Communications are intercepted by a client-side proxy before being sent to a recipient designated by an application. The intercepted communication is inspected, and a first connection is determined to be used to send the communication based on the inspection. Finally, before the communication is sent via the first connection, an action is performed by the client-side proxy resulting in an indication that the first connection is compromised. The action may include comparing data associated with the first connection to data associated with known compromised connections. In various embodiments, additional security responses may subsequently be performed by the client-side proxy based on the indication that the first connection is compromised.
Abstract:
A method includes: after installation of software on a first mobile device, receiving new data from a second mobile device; analyzing, using a data repository, the new data to provide a security assessment; determining, based on the security assessment, a new security threat associated with the software; and in response to determining the new security threat, causing the first mobile device to implement a quarantine of the software.
Abstract:
Data is collected from a set of devices according to a data collection policy. The data is associated with device configuration, device state, or device behavior. A norm is established using the collected data. A different data collection policy is established based on the norm. Data is collected from a particular device according to the different data collection policy. The norm is compared to the data collected from the particular device. If there is a deviation outside of a threshold deviation between the norm and the data collected from the particular device, a message is transmitted to an administrator.
Abstract:
Systems and methods are disclosed for managing personal data on a mobile communications device in which personal data stored at one or more locations on the mobile communications device is identified by a policy management module on the mobile communications device. A policy is then created based on the identified personal data. The policy management module on the mobile communications device monitors at least the personal data stored in the one or more locations on the mobile communications device and detects attempts to access the monitored data.
Abstract:
A server receives from a mobile communication device information about a data object (e.g., application) on the device when the device cannot assess the data object. The server uses the information along with other information stored at the server to assess the data object. Based on the assessment, the device may be permitted to access the data object or the device may not be permitted to access the data object. The other information stored at the server can include data objects known to be bad, data objects known to be good, or both.
Abstract:
A server receives from a mobile communication device information about a data object (e.g., application) on the device when the device cannot assess the data object. The server uses the information along with other information stored at the server to assess the data object. Based on the assessment, the device may be permitted to access the data object or the device may not be permitted to access the data object. The other information stored at the server can include data objects known to be bad, data objects known to be good, or both.
Abstract:
Disclosed herein is a system and method for efficiently gathering information about applications for mobile communications devices (e.g., smartphones, netbooks, and tablets) and using that information to produce assessments of the applications. To gather information, a server may send a request for application data to a mobile communications device. In response, the server may receive some but not all of the first-requested application data. The server may then a second request for application data to a second mobile communications device that also has access to the application. The server may receive application data from the second mobile communications device, and store the received first- and second-requested application data. The server then uses the stored application data to assess the application.
Abstract:
Methods are provided for determining an enterprise risk level, for sharing security risk information between enterprises by identifying a security response by a first enterprise and then sharing the security response to a second enterprise when a relationship database profile for the first collection indicates the security response may be shared. Methods are also provided for determining whether to allow a request from an originating device where the request may have been initiated by a remote device.
Abstract:
A system and method to create and assign a policy for a mobile communications device are disclosed. The policy may be created based on personal data associated with the mobile communications device. For example, known sources of personal data on the mobile communications device may be identified and a policy may be created based on the known personal data. The policy may then be used to identify additional personal data associated with the mobile communications device. Thus, the personal data associated with the mobile communications device may be monitored. If an application attempts to access the monitored personal data, the access will be detected.
Abstract:
In one approach, a request for software evaluation is received by an evaluation server from a user device. The request relates to software to be installed on the user device. In response to receiving the request, the evaluation server sends data associated with the software to an authenticity server. The evaluation server receives, from the authenticity server, a result from the evaluation of the software. The evaluation server determines based on the result whether a security threat is associated with the software. In response to determining that there is a security threat, the evaluation server sends a communication to the user device that causes the software to be quarantined.