US 12,223,037 B2
Systems and methods for context-based mitigation of computer security risks
Robert M. Juncker, Farmington, MN (US); and Christopher J. Goettl, Owatonna, MN (US)
Assigned to Ivanti, Inc., South Jordan, UT (US)
Filed by Ivanti, Inc., South Jordan, UT (US)
Filed on Oct. 13, 2020, as Appl. No. 17/069,529.
Application 17/069,529 is a continuation of application No. 15/906,559, filed on Feb. 27, 2018, granted, now 10,805,333.
Claims priority of provisional application 62/464,152, filed on Feb. 27, 2017.
Prior Publication US 2021/0150023 A1, May 20, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06F 8/65 (2018.01); G06F 21/55 (2013.01); G06F 21/62 (2013.01); H04W 12/12 (2021.01); H04W 12/126 (2021.01); H04W 12/128 (2021.01)
CPC G06F 21/55 (2013.01) [G06F 8/65 (2013.01); G06F 21/62 (2013.01); H04L 63/101 (2013.01); H04L 63/104 (2013.01); H04L 63/14 (2013.01); H04L 63/1433 (2013.01); H04L 63/1441 (2013.01); H04L 63/20 (2013.01); H04W 12/12 (2013.01); H04W 12/126 (2021.01); H04W 12/128 (2021.01); G06F 2221/034 (2013.01); G06F 2221/2141 (2013.01)] 16 Claims
OG exemplary drawing
 
1. A method of context-based privilege mitigation, the method comprising:
detecting a login event of a user of a computing device;
receiving, by the computing device from a management server, a risk assessment rule that includes risk criteria and a plurality of privilege mitigation measures associated with the risk criteria, the risk assessment rule being communicated from the management server in response to the detection of the login event at the computing device, and the risk assessment rule indicates that a software application is vulnerable to an exploit;
evaluating, by an agent on the computing device, information on the computing device that is relevant to the risk criteria;
determining that the user has elevated privileges on the computing device;
detecting, by the computing device, a vulnerable software application to which the user has access, the vulnerable software application being flagged by the risk assessment rule;
identifying, by the computing device, a particular privilege mitigation measure of the plurality of privilege mitigation measures, wherein the particular privilege mitigation measure is mapped to the detected vulnerable software application; and
applying, by the computing device, the particular privilege mitigation measure on the computing device, the particular privilege mitigation measure including an action that reduces a user privilege level of the user and prevents software from being used on the computing device by the user until a desired update to the vulnerable software application has been installed.