System and method of monitoring and controlling application files

摘要

A system and method for updating a system that controls files executed on a workstation. The workstation includes a workstation management module configured to detect the launch of an application. A workstation application server receives data associated with the application from the workstation. This data can include a hash value. The application server module can determine one or more categories to associate with the application by referencing an application inventory database or requesting the category from an application database factory. The application database factory can receive applications from multiple application server modules. The application database factory determines whether the application was previously categorized by the application database factory and provides the category to the application server module. Once the application server module has the category, it forwards a hash/policy table to the workstation management module. Upon receipt of the hash/policy table, the workstation management module applies the policy that is associated with the launched application to control access to the application on the workstation.

主权项

1. A method for updating a system which controls access to spyware programs and enforcing policies enumerating rules that govern access to the spyware programs on a computer, the method comprising:
receiving, at the system and in response to a user requesting access to a spyware program, an identifier from a first computer of the system, the identifier being associated with the spyware program on the first computer; associating, using an application server module of the system, one or more categories with the identifier based, at least in part, on a frequency of requested execution of the spyware program if the category was not previously associated with the identifier in a database of categorized programs of the system, the category indicating a type of application of the spyware program; determining whether the spyware program is associated with any other categories other than the associated one or more categories; retrieving one or more policies to be applied to programs associated with the associated one or more categories and the other categories to which the spyware program is determined to be associated; determining whether a user of the first computer that requested access to the spyware program is associated with privileges that violate the retrieved one or more policies; and denying access to the spyware program in response to determining the user includes insufficient privileges to access based on the retrieved one or more policies.