International Business Machines Corporation

Sailpoint Technology Holdings, Inc.

Neil Ian Readshaw

Heather Maria Hinton

Christopher John Hockings

Simon Gilbert Canning

Christopher Y Choi

Karthik Sivakumar

Michael Sean Brown

Carlos F Franca Da Fonseca

Scott Anthony Exton

Mari F Heiser

Christopher Young-Soo Choi

Jerome R Bell, Jr

Gavin George Bray

Jayashree Ramanathan

Venkata R Jagana

Srinivasa Rao Mangipudi

Ivan Matthew Milman

Steven A Bade

Naohiko Uramoto

Srinivas Babu Tummalapenta

Shane Bradley Weeden

Craig Robert William Forster

William A Lemke

Stephen Viselli

Zoran Radenkovic

Grant Charles Murphy

Toni U Basoglu

Craig R W Forster

Katsumi Ohnishi

In a method for estimating a severity of a current security incident reported by a customer for the customer's computer system, a processor receives from one or more administrators for a plurality of prior security incidents reported by the customer, identifications of a respective plurality of actual severities for the plurality of prior security incidents. The processor estimates, based in part on the plurality of identified actual severities of the prior security incidents, a severity of the current security incident. The processor reports the estimated severity for the current security incident.

Automated security incident handling in a dynamic environment

A method of policy management in a Data Loss Prevention (DLP) system uses a policy model that associates a user with one or more DLP endpoints. When an endpoint is added to the system, a set of policies for that endpoint are determined using an identity of the user that is associated with the endpoint and a list of roles or groups for that user. At policy distribution time, the method determines a set of endpoints to which the policy is to be distributed.

Method and apparatus for associating data loss protection (DLP) policies with endpoints

A method for determining if a user of a computer system is a human. A processor receives an indication that a computer security program is needed and acquires at least one image depicting a first string of characters including at least a first and second set of one or more characters. A processor assigns a substitute character to be used as input for each of the second set of one or more characters. A processor presents the at least one image and an indication of the substitute character and when to use the substitute character to the user. A processor receives a second string of characters from the user. A processor determines whether the second string of characters substantially matches the first string of characters based on the substitute character assigned to each of the second set of one or more characters and determines whether the user is a human.

CAPTCHA challenge incorporating obfuscated characters

Monitoring across multiple-channels, used by multiple devices, to determine which email messages being sent to a user are solicited by the user. A broad spectrum of network and telephony access records are analyzed to determine whether an email message is likely being sent as a result of legitimate services access by the user.

Determining email authenticity

A security policy management solution (such as a Data Loss Prevention (DLP) system) is augmented to enable a user to model and visualize how changes in a security policy may impact (positively or negatively) the effectiveness of a policy configuration as well as the risk associated with its deployment. This technique enables a user (e.g., a security policy administrator) to evolve enterprise information technology (IT) security policies and, in particular, to generate and display 'what-if' scenarios by which the user can determine trade-offs between, on the one hand, the effectiveness of a proposed change to a policy, and on the other hand, the risk associated with the proposed change.

Risk-based model for security policy management

A distributed cloud environment system comprising: a repository; a plurality of cloud managed nodes with a client program interface; a plurality of service management components with a service management component interface; a central trusted computing platform service in communication with the repository, the plurality of cloud managed nodes and the plurality of service management components, comprising: a first interface for communication with the client program interface in each of the plurality of cloud managed nodes through a first single touch point; and a second interface for communication with the service management component interface for the plurality of service management components through a second single touch point. The central trusted computing platform service manages interaction of the plurality of service management components with the plurality of cloud managed nodes, and the interaction of the plurality of cloud managed nodes with the repository.

Scaling a trusted computing model in a globally distributed cloud environment

The method includes identifying an instance of software installed. The method further includes determining a fingerprint corresponding to the instance of software installed. The method further includes determining a security risk associated with the instance of software installed. The method further includes identifying a software management policy for the instance of software based upon the fingerprint, security risk, and designated purpose of the computing device. In one embodiment, the method further includes in response to identifying the software management policy, enforcing, by one or more computer processors, the software management policy on the instance of software installed on the computing device.

Managing software deployment

Captcha challenge incorporating obfuscated characters

Growing community of inventors

Parkwood, Australia

Neil Ian Readshaw