Abstract: An automated method for securing a target system is provided. In this method, a request to change an entity in the target system is detected. The target system has an existing security profile or one is created. As a result, a security configuration group associated with the changed entity is constructed. The security configuration group is then fused with the existing security profile to form a unified security profile, and the unified security profile is prosecuted onto the target system. Other methods and a system for securing the target system are also described.

Abstract: Several methods are provided for applying minimization to computer systems. A unified security profile is created and applied to a computer system. This provides a listing of software packages required to be installed on the computer system. Extraneous files not associated with a required software package are identified. In one method, a software module interposes between calls to filesystem operations and the filesystem. This module allows or denies access to files based on a configuration information source (which is itself based on the unified security profile), the zone from which the access request originates, and the privileges of the user making the request. Reference to each file minimized is removed from the computer system's package manifest. Files thus minimized are neither visible nor accessible to unauthorized entities on the computer system. If the unified security profile of the system is required to change, minimization actions can therefore be reversed.