Abstract: A reputation of an installer may be determined based on contextual information including its source (e.g., its publisher), a cryptographic signature or certificate, a process that carried out its download, a user that initiated its download, whether the installer has been previously vetted by a security policy, and so forth. A corresponding reputation may then be inferred for each of the computer objects contained within the installer, such that the reputation remains with the computer objects if/when they are unpacked on an endpoint. Each of the computer objects may then be unpacked for individual analysis (e.g., a static analysis) regarding each object's compliance with a security policy, thereby producing a second reputation for each computer object. A decision whether to execute the installer/objects, e.g., during an installation process, may then be made by reconciling the reputation of the installer and the second reputation for each computer object.

Abstract: A reputation of an installer may be determined based on contextual information including its source (e.g., its publisher), a cryptographic signature or certificate, a process that carried out its download, a user that initiated its download, whether the installer has been previously vetted by a security policy, and so forth. A corresponding reputation may then be inferred for each of the computer objects contained within the installer, such that the reputation remains with the computer objects if/when they are unpacked on an endpoint. Each of the computer objects may then be unpacked for individual analysis (e.g., a static analysis) regarding each object's compliance with a security policy, thereby producing a second reputation for each computer object. A decision whether to execute the installer/objects, e.g., during an installation process, may then be made by reconciling the reputation of the installer and the second reputation for each computer object.

Abstract: In embodiments of the present invention improved capabilities are described for virtual machine scan optimization.

Abstract: In embodiments of the present invention improved capabilities are described for providing data protection through the detection of tags associated with data or a file. In embodiments the present invention may provide for a step A, where data may be scanned that is intended to be communicated from the client computing facility. In response to step A, at step B, restricted data may be identified by identifying an absence of a tag associated with the data. And finally, in response to step B, at step C, an interruption to the intended communication may be caused.

Abstract: In embodiments of the present invention improved capabilities are described for virtual machine scan optimization.

Abstract: In embodiments of the present invention improved capabilities are described for tracking modified files on a virtual machine including the steps of identifying an altered disk sector, associating the altered disk sector with code that is operated in a virtual machine, and causing a malicious code scan to be performed on the code.

Abstract: In embodiments of the present invention improved capabilities are described for providing data protection through the detection of tags associated with data or a file. In embodiments the present invention may provide for a step A, where data may be scanned that is intended to be communicated from the client computing facility. In response to step A, at step B, restricted data may be identified by identifying an absence of a tag associated with the data. And finally, in response to step B, at step C, an interruption to the intended communication may be caused.