For protecting data within a data storage system, such as a hard disk drive, security enable mode is entered. In that mode, initialization data is moved from a first area of a disk to a second area of the disk with a location of the second area being randomly generated. The initialization data is then erased from the first area. Also, a first cipher for firmware and a second cipher for a disk are both changed into a randomly generated value. Later, access to the initialization data from the seco...

A flexible, efficient and easy-to-use computer security management system effectively evaluates and responds to informational risks on a wide variety of computing platforms and in a rapidly changing network environment. An individual computer system dynamically monitors its end user, without regard to network connectivity, in order to calculate a risk score and to ensure that the end user's behavior does not put corporate information or other assets at risk. Data regarding such risks and respons...

A method of detecting network worms include the following steps: (1) Profiling the TCP connection information collected from the protected network, quantifying the plurality of statuses contained in the TCP connection information; (2) Clustering the connection profiles to discover all the anomaly clusters that are specified by the condition composing of several adaptive thresholds; (3) Correlating the anomaly clusters to result in a new cluster graph or to extend an existing cluster graph; (4) I...

A method that in an embodiment counts the number of times that a file or registry entry is added, changed, or deleted at clients in a network. If the count exceeds a threshold, then a warning is sent to the clients. The warning may prompt the clients to delete or rename the file or registry entry, run an anti-virus program, quarantine the file or registry entry, or issue a message. In this way, viruses may be detected at clients.

An apparatus for protecting against computer malware, comprising: a data inputter for intercepting data units flow, a trust level assigner, associated with the data inputter, for assigning to each of the data units a respective trust level, an isolated-processing environment, operable to process the data units in an isolated manner and configured to send copies of the processed data units out of the isolated-processing environment, and a processing environment selector, associated with the trust...

Systems and methods for validating integrity of an executable file are described. In one aspect, the systems and methods determine that an executable file is being introduced into a path of execution. The executable file is then automatically evaluated in view of multiple malware checks to detect if the executable file represents a type of malware. The multiple malware checks are integrated into an operating system trust verification process along the path of execution.

A method of preventing ARP broadcast flooding of subscriber access links where an ARP packet is received at a subscriber network edge device and the source and destination information contained within the ARP packet is compared to address lease information for subscribers of a subscriber network. If the destination information obtained from the ARP packet is not associated with an address lease assigned to one of the subscribers, the network device only broadcasts the ARP packet to network uplin...

System and techniques for protecting wireless communication systems from blended electronic attacks that may combine wireless and computer attacks. One embodiment is an integrated hardware and software firewall/protection system that provides a protection scheme that may include an additional functional processing layer between the hardware firewall and a mobile terminal. This additional functional processing layer performs an extra layer of communications and security processing, including such...

A system and method for using hierarchical policy levels. In one embodiment, computers of the network are arranged into a hierarchy. A management policy server with access to the network queries the network to identify computers at or below its own level within the hierarchy. Computers under the control of the management policy server are identified, and management programs, updates or policies are automatically distributed to the computers, without manual intervention.

Multiple levels of wireless network resource granting. A user who has an authorized key, e.g., an encryption key or a key indicating that they have paid for service, gets a first, better level of access to the network resources. One without the key is granted lesser access, e.g., less total bandwidth, less bandwidth speed, no access to files or the like.