Systems and methods for blocking flanking attacks on computing systems

A computer-implemented method for blocking flanking attacks on computing systems may include (1) detecting a denial-of-service attack targeting a computing network, (2) inferring, based at least in part on detecting the denial-of-service attack, a secondary attack targeting at least one computing resource within the computing network, (3) determining that the computing resource is subject to additional protection based on inferring the secondary attack targeting the computing resource, and (4) protecting the computing resource against the secondary attack by adding an authentication requirement for accessing the computing resource. Various other methods, systems, and computer-readable media are also disclosed.

BACKGROUND

In recent years, malicious programmers have created a variety of sophisticated targeted attacks aimed at high-profile or high-level entities, such as governments, corporations, political organizations, defense contractors, or the like. In many cases, the goal of such targeted attacks is to gain access to highly sensitive or confidential information, such as financial information, defense-related information, and/or intellectual property (e.g., source code), and/or to simply disrupt an entity's operations.

Many such attacks involve sending emails to a targeted entity that contain an attachment that has been carefully crafted to take advantage of an as-yet-undiscovered vulnerability of a particular application (commonly known as a “zero-day” exploit). Because many security software companies attempt to combat malware by creating and deploying malware signatures (e.g., hash functions) that uniquely identify known malware, this type of targeted attack (commonly known as a “spear phishing” attack) is often difficult for traditional security software to detect and/or neutralize since the exploits in question have yet to be publicly discovered.

Because targeted attacks may be difficult for traditional security systems to automatically detect and remediate, the attention of system administrators can be vital to identifying and/or responding to a targeted attack. However, some attackers have begun to use decoy attacks, such as distributed denial-of-service attacks, to distract systems administrators while a targeted attack takes place, thereby increasing the likelihood that the targeted attack succeeds.

Accordingly, the instant disclosure identifies and addresses a need for additional and improved systems and methods for blocking flanking attacks on computing systems.

SUMMARY

As will be described in greater detail below, the instant disclosure generally relates to systems and methods for blocking flanking attacks on computing systems by responding to denial-of-service attacks on a network with temporarily increased authentication requirements for accessing sensitive network resources. In some examples, these systems and methods may quickly and automatically deploy the increased authentication requirements through modifying software-defined networks.

In one example, a computer-implemented method for blocking flanking attacks on computing systems may include (1) detecting a denial-of-service attack targeting a computing network, (2) inferring, based at least in part on detecting the denial-of-service attack, a secondary attack targeting at least one computing resource within the computing network, (3) determining that the computing resource is subject to additional protection based on inferring the secondary attack targeting the computing resource, and (4) protecting the computing resource against the secondary attack by adding an authentication requirement for accessing the computing resource.

In one embodiment, (1) the computing network includes a software-defined network and (2) adding the authentication requirement for accessing the computing resource includes modifying the software-defined network to interpose an authentication system that implements the authentication requirement between the computing resource and at least a portion of the computing network.

In one embodiment, (1) inferring the secondary attack targeting the computing resource may include determining that the computing resource is sensitive and (2) determining that the computing resource is subject to additional protection may be performed in response to determining that the computing resource is sensitive.

In some examples, determining that the computing resource is sensitive may include (1) identifying, by a data loss prevention system, a classification of data corresponding to the computing resource and (2) determining that the classification of data indicates that the data corresponding to the computing resource includes a sensitive type of data. In some examples, determining that the computing resource is sensitive may include (1) identifying a classification of the computing resource based on user activity in connection with the computing resource and (2) determining that the classification of the computing resource indicates that the computing resource includes a sensitive type of computing resource. In some examples, determining that the computing resource is sensitive may include determining that the computing resource has been tagged as sensitive.

In some examples, adding the authentication requirement for accessing the computing resource may include adding a second authentication factor to accompany a first authentication factor that is already in place for accessing the computing resource. In one embodiment, the computer-implemented method may further include (1) determining that the secondary attack is not targeting the computing resource, and (2) removing the authentication requirement in response to determining that the secondary attack is not targeting the computing resource.

In some examples, inferring the secondary attack based at least in part on detecting the denial-of-service attack may include inferring a spear phishing attack that attempts to collect an authentication factor used by at least one user of the computing network for accessing the computing resource.

In one embodiment, a system for implementing the above-described method may include (1) a detection module, stored in memory, that detects a denial-of-service attack targeting a computing network, (2) an inference module, stored in memory, that infers, based at least in part on detecting the denial-of-service attack, a secondary attack targeting at least one computing resource within the computing network, (3) a determination module, stored in memory, that determines that the computing resource is subject to additional protection based on inferring the secondary attack targeting the computing resource, (4) a protection module, stored in memory, that protects the computing resource against the secondary attack by adding an authentication requirement for accessing the computing resource, and (5) at least one processor configured to execute the detection module, the inference module, the determination module, and the protection module.

In some examples, the above-described method may be encoded as computer-readable instructions on a non-transitory computer-readable medium. For example, a computer-readable medium may include one or more computer-executable instructions that, when executed by at least one processor of a computing device, may cause the computing device to (1) detect a denial-of-service attack targeting a computing network, (2) infer, based at least in part on detecting the denial-of-service attack, a secondary attack targeting at least one computing resource within the computing network, (3) determine that the computing resource is subject to additional protection based on inferring the secondary attack targeting the computing resource, and (4) protect the computing resource against the secondary attack by adding an authentication requirement for accessing the computing resource.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

The present disclosure is generally directed to systems and methods for blocking flanking attacks on computing systems. As will be explained in greater detail below, by responding to denial-of-service attacks on a network with temporarily increased authentication requirements for accessing sensitive network resources, the systems and methods described herein may prevent decoy denial-of-service attacks from increasing the likelihood of success of targeted attacks on the network. Additionally, by deploying the increased authentication requirements through modifying software-defined networks, these systems and methods may quickly and automatically protect against flanking attacks.

The following will provide, with reference toFIGS. 1,2,4, and5, detailed descriptions of exemplary systems for blocking flanking attacks on computing systems. Detailed descriptions of corresponding computer-implemented methods will also be provided in connection withFIG. 3. In addition, detailed descriptions of an exemplary computing system and network architecture capable of implementing one or more of the embodiments described herein will be provided in connection withFIGS. 6 and 7, respectively.

FIG. 1is a block diagram of an exemplary system100for blocking flanking attacks on computing systems. As illustrated in this figure, exemplary system100may include one or more modules102for performing one or more tasks. For example, and as will be explained in greater detail below, exemplary system100may include a detection module104that may detect a denial-of-service attack targeting a computing network. Exemplary system100may additionally include an inference module106that may infer, based at least in part on detecting the denial-of-service attack, a secondary attack targeting at least one computing resource within the computing network. Exemplary system100may also include a determination module108that may determine that the computing resource may be subject to additional protection based on inferring the secondary attack targeting the computing resource. Exemplary system100may additionally include a protection module110that may protect the computing resource against the secondary attack by adding an authentication requirement for accessing the computing resource. Although illustrated as separate elements, one or more of modules102inFIG. 1may represent portions of a single module or application.

Exemplary system100inFIG. 1may be implemented in a variety of ways. For example, all or a portion of exemplary system100may represent portions of exemplary system200inFIG. 2. As shown inFIG. 2, system200may include a computing device202in communication with a computing resource206via a network204. Computing device202may be programmed with one or more of modules102. Additionally or alternatively, computing resource206may be programmed with one or more of modules102.

In one embodiment, one or more of modules102fromFIG. 1may, when executed by at least one processor of computing device202and/or computing resource206, enable computing device202and/or computing resource206to blocking flanking attacks on computing systems. For example, and as will be described in greater detail below, one or more of modules102may cause computing device202and/or computing resource206to blocking flanking attacks on computing systems (e.g., to prevent a denial-of-service attack210on network204to aid in the success of a secondary attack212that may attempt to compromise computing resource206). For example, and as will be described in greater detail below, detection module104may be programmed to detect denial-of-service attack210targeting network204. Inference module106may be programmed to infer, based at least in part on detecting denial-of-service attack210, secondary attack212targeting at least one computing resource within computing network204. Determination module108may be programmed to determine that the computing resource is subject to additional protection based on inferring secondary attack212targeting the computing resource. Protection module110may be programmed to protect the computing resource against secondary attack212by adding an authentication requirement214for accessing the computing resource.

Computing device202generally represents any type or form of computing device capable of reading computer-executable instructions. Examples of computing device202include, without limitation, laptops, tablets, desktops, servers, cellular phones, Personal Digital Assistants (PDAs), multimedia players, embedded systems, combinations of one or more of the same, exemplary computing system610inFIG. 6, or any other suitable computing device. In some examples, computing device202may represent a security server and/or a software defined network controller.

Computing resource206generally represents any type or form of computing device, computing service, and/or computer-readable data that may be accessed over a network. Examples of computing resource206include, without limitation, application servers and database servers configured to provide various database services and/or run certain software applications.

Network204generally represents any medium or architecture capable of facilitating communication or data transfer. Examples of network204include, without limitation, an intranet, a Wide Area Network (WAN), a Local Area Network (LAN), a Personal Area Network (PAN), the Internet, Power Line Communications (PLC), a cellular network (e.g., a Global System for Mobile Communications (GSM) network), exemplary network architecture700inFIG. 7, or the like. Network204may facilitate communication or data transfer using wireless or wired connections. In one embodiment, network204may facilitate communication between computing device202and computing resource206. In some examples, network204may include an enterprise network. In some examples, network204may include software-defined network.

FIG. 3is a flow diagram of an exemplary computer-implemented method300for blocking flanking attacks on computing systems. The steps shown inFIG. 3may be performed by any suitable computer-executable code and/or computing system. In some embodiments, the steps shown inFIG. 3may be performed by one or more of the components of system100inFIG. 1, system200inFIG. 2, system400inFIG. 4, system500inFIG. 5, computing system610inFIG. 6, and/or portions of exemplary network architecture700inFIG. 7.

As illustrated inFIG. 3, at step302one or more of the systems described herein may detect a denial-of-service attack targeting a computing network. For example, at step302detection module104may, as part of computing device202inFIG. 2, detect denial-of-service attack210targeting computing network204.

As used herein, the phrase “denial-of-service attack” may refer to any attack that undermines or threatens to undermine the availability and/or responsiveness of one or more computing resources within a computing network. For example, a denial-of-service attack may include flooding one or more computing resources within the computing network with requests in order to consume available bandwidth to the targeted resource, to reduce the number of available connections to the targeted resource, and/or to increase the workload placed on the targeted resource (e.g., thereby consuming processing power and/or available memory). In some examples, the denial-of-service attack may include a distributed denial-of-service attack. As used herein, the phrase “distributed denial-of-service attack” may refer to any denial-of-service attack launched from multiple systems in concert. For example, an attacker may control a botnet and direct the botnet to flood the computing network (or a portion of the computing network) with requests. In some examples, the denial-of-service attack may target the computing network so as to distract and/or occupy one or more security administrators and/or security system resources during a secondary attack.

The computing network may include any type of network that may include a sensitive computing resource and/or that may be subject to an attack. For example, the computing network may include an enterprise network. In some examples, the computing network may include a software-defined network. As used herein, the phrase “software-defined network” may refer to any network that may be dynamically configured by software. For example, the phrase “software-defined network” may refer to a network where the control plane (e.g., making control path decisions for the network) is decoupled from the data plane (e.g., forwarding packets based on control path decisions). In this example, and as will be explained in greater detail below, the control plane may operate as a software-driven controller situated outside the network switches and/or software components distributed across the network switches. Examples of software-defined networks may include CISCO INSIEME and VMWARE NSX.

Detection module104may detect the denial-of-service attack in any suitable manner. For example, detection module104may detect the denial-of-service attack by receiving a message from a security system that has identified the denial-of-service attack. For example, detection module104may receive a notification from a perimeter firewall of the denial-of-service attack. Additionally or alternatively, detection module104may detect the denial-of-service attack by monitoring incoming traffic to the computing network. In some examples, detection module104may detect the denial-of-service attack by identifying the poor performance and/or the failure of one or more computing resources on the computing network.

As an example of detecting a denial-of-service attack,FIG. 4illustrates an exemplary system400. As shown inFIG. 4, system400may include a network410, an attacker client420, and a botnet430with devices430(1)-(n). In one example, an attacker may wish to access a computing resource440protected by an authentication layer442. Accordingly, at step460, the attacker may retrieve an email address414from an organizational directory412that the attacker may use in a targeted attack on network410to access computing resource440. At step462, the attacker may broadcast an instruction to botnet430to initiate a distributed denial-of-service attack on network410. Accordingly, at step464, devices430(1)-(n) may flood network410with requests (e.g., to engage and/or distract system administration personnel and/or resources).

Returning toFIG. 3, at step304one or more of the systems described herein may infer, based at least in part on detecting the denial-of-service attack, a secondary attack targeting at least one computing resource within the computing network. For example, at step304inference module106may, as part of computing device202inFIG. 2, infer, based at least in part on detecting denial-of-service attack210, a secondary attack212targeting at least one computing resource (e.g., computing resource206) within the computing network204.

As used herein, the phrase “computing resource” may refer to any computing device, computing service, and/or computer-readable data that may be accessed over a network. In some examples, as will be explained in greater detail below, the computing resource may include a sensitive resource. For example, the computing resource may include and/or provide access to sensitive data (e.g., personal customer data, credit card data, defense and/or national security information, confidential documents, intellectual property, etc.). In some examples, the computing resource may include an application and/or a server that accesses sensitive data. Additionally or alternatively, the computing resource may include a database and/or a storage system that stores sensitive data. In one example, access to the computing resource may be regulated by an authentication system requiring an authentication factor (e.g., a password).

The secondary attack may include any attack that facilitates access to the computing resource for an attacker. For example, the secondary attack may include a targeted attack designed to acquire an authentication factor for accessing the computing resource and/or acquire control over a computing system that has access to the computing resource (e.g., due to an authentication factor controlled by the computing system). In some examples, the secondary attack may include a spear phishing attack. For example, the secondary attack may include a malicious document (such as a malicious Portable Document Format (PDF) document or a MICROSOFT OFFICE document), which may be sent as an email attachment to an unsuspecting user (e.g., with access to the computing resource via the authentication factor), and which may exploit a zero-day-vulnerability in a document-handling application on the user's computer. Additionally or alternatively, in some examples, the secondary attack may include an attempt to exploit a previously-established infiltration of the computing network and/or a previous acquisition of and/or control over an authentication factor for accessing the computing resource. For example, the secondary attack may include a use of an illegitimately acquired authentication factor and/or copying sensitive data from the computing resource.

Inference module106may infer the secondary attack targeting the computing resource in any suitable manner. For example, inference module106may infer the secondary attack targeting the computing resource by linking the denial-of-service attack to a computing system, a computing module, and/or one or more computing instructions that respond to attacks such as the secondary attack. For example, inference module106may call a security subroutine and/or communicate an instruction to a security system in response to having identified the denial-of-service attack. In one examples, inference module106may infer the secondary attack targeting the computing resource based on the computing resource residing within the computing network. In some examples, inference module106may infer the secondary attack targeting the computing resource by determining that the computing resource is sensitive. As used herein, the term “sensitive,” as it applies to computing resources, may refer to any computing resource which an organization may have a heightened interest to protect against attacks. For example, sensitive computing resources may include computing resources associated with private data, confidential data, valuable data, data typically targeted during attacks, and/or data typically acquired and/or used for illicit activities. As will be explained in greater detail below, in some examples the systems described herein may determine that the computing resource is subject to additional protection in response to determining that the computing resource is sensitive.

Inference module106may determine that the computing resource is sensitive in any of a variety of ways. For example, inference module106may determine that the computing resource is sensitive by identifying a classification by a data loss prevention system indicating that data corresponding to the computing resource is sensitive. For example, the data loss prevention system may analyze data corresponding to the computing resource and inference module106may receive the classification from the data loss prevention system. Additionally or alternatively, inference module106may operate as a part of the data loss prevention system. For example, the computing resource may include (or provide access to) a collection of documents. In this example, a data loss prevention system may monitor, scan, analyze, and/or parse the collection of documents and classify one or more of the documents as sensitive (e.g., subject to a rule and/or restriction of the data loss prevention system) based on one or more keywords and/or regular expressions found within the documents. Accordingly, inference module106may identify the classification of the documents performed by the data loss prevention system and classify the computing resource as sensitive due to the association between the computing resource and the documents. In some examples, inference module106may distinguish between different data loss prevention classifications. For example, a data loss prevention system may identify and track both credit card information and medical information, both of which the data loss prevention system may treat as sensitive data. However, inference module106may treat the credit card information as sensitive without treating the medical information as sensitive (e.g., because the credit card information may be more likely to be a target of a potential secondary attack).

In addition to or as an alternative to receiving information about data associated with the computing resource from a data loss prevention system, inference module106may analyze the data directly (e.g., searching for keywords and/or regular expressions within a collection of documents stored within and/or accessible by the computing resource) to determine that the documents are sensitive and that, therefore, the computing resource is sensitive.

In some examples, inference module106may determine the computing resource is sensitive by identifying a classification of the computing resource based on user activity in connection with the computing resource and determining that the classification of the computing resource represents a sensitive type of computing resource. For example, inference module106may determine that data within and/or accessible to the computing resource is sensitive because it is only accessed by and/or accessible to a select group of users within an organization (e.g., users with sensitive roles within the organization). In one example, inference module106may determine that the computing resource is frequently accessed by a vice president of the financial department of an organization but is rarely accessed by other high-level executives and is never accessed by members of the organization lower in the organizational hierarchy. In this example, based on the access patterns of the various members of the organization and in light of their respective roles, inference module106may determine that the computing resource is sensitive. In some examples, inference module106may identify the classification of the computing resource based on user activity by interfacing with a system for the governance of unstructured data. For example, inference module106may interface with SYMANTEC DATA INSIGHT and/or VARONIS DATADVANTAGE to identify sensitive data and/or user access patterns to data.

In some examples, inference module106may determine that the computing resource is sensitive by determining that the computing resource has been tagged as sensitive. For example, an administrator of the computing network may tag one or more servers, databases, and/or applications as sensitive.

UsingFIG. 4as an example, inference module106may as a part of a security system450, infer a secondary attack on computing resource440based on detecting the denial-of-service attack launched by botnet430in step464.

Returning toFIG. 3, at step306one or more of the systems described herein may determine that the computing resource is subject to additional protection based on inferring the secondary attack targeting the computing resource. For example, at step306determination module108may, as part of computing device202inFIG. 2, determine that computing resource206is subject to additional protection based on inferring secondary attack212targeting the computing resource.

Determination module108may determine that the computing resource is subject to additional protection based on inferring the secondary attack in any suitable manner. For example, as mentioned earlier, in some examples the systems described herein may determine that the computing resource is sensitive. Accordingly, determination module108may determine that the computing resource is subject to additional protection in response to determining that the computing resource is sensitive. In some examples, determination module108may determine that the computing resource is subject to additional protection based at least in part on the computing resource requiring an authentication factor to access (e.g., because the secondary attack may be used to acquire or undermine the authentication factor, leaving the computing resource exposed).

Returning toFIG. 3, at step308one or more of the systems described herein may protect the computing resource against the secondary attack by adding an authentication requirement for accessing the computing resource. For example, at step308protection module110may, as part of computing device202inFIG. 2, protect computing resource206against secondary attack212by adding an authentication requirement214for accessing computing resource206.

Protection module110may add the authentication requirement for accessing the computing resource in any suitable manner. For example, as mentioned earlier, the computing network may include a software-defined network. In this example, protection module110may add the authentication requirement for accessing the computing resource by modifying the software-defined network to interpose an authentication system that implements the authentication requirement between the computing resource and at least a portion of the computing network. For example, protection module110may modify the software-defined network at the control plane to redirect one or more routing paths to the computing resource through a gateway that includes the authentication system that implements the authentication requirement.

In some examples, access to the computing resource may already require a first authentication factor. In these examples, adding the authentication requirement for accessing the computing resource may entail adding a second authentication factor to accompany the first authentication factor that is already in place for accessing the computing resource. In this manner, protection module110may protect computing resource by adding the second authentication factor in case the first authentication factor is compromised (e.g., by the secondary attack). In some examples, the first authentication factor may be stored within the computing network (e.g., such that the secondary attack could give an attacker access to the first authentication factor) while the second authentication factor may not be stored within the computing network (e.g., may be issued out-of-band).

As an example of protection module110adding the authentication requirement via a software-defined network,FIG. 5is a block diagram of an exemplary computing system500for blocking flanking attacks on computing systems. As shown inFIG. 5, exemplary system500may include a client502that may attempt to access a computing resource550via a software-defined network that includes network switches532,534,536, and538. In one example, a security system510(e.g., including one or more of modules102) may infer an attack on computing resource550and/or determine that computing resource550is subject to additional protection in response to a denial-of-service attack. Accordingly, protection module110may send an instruction to software defined network controller520to reconfigure the software-defined network by, e.g., adding a flow rule to the software-defined network to direct traffic to computing resource550through an authentication gateway540. Based on the flow rule, software defined network controller520and/or network switch536may modify the forwarding table of network switch536to forward traffic destined for computing resource550to authentication gateway540. In this manner, protection module110may change a path560from client502to computing resource550through the software-defined network to a path562.

In some examples, one or more of the systems described herein (e.g., protection module110) may determine that the secondary attack is not targeting the computing resource (e.g., that the secondary attack has passed and/or that the secondary attack has been neutralized). In these examples, protection module110may remove the authentication requirement in response to determining that the secondary attack is not targeting the computing resource. Additionally or alternatively, protection module110may remove the authentication requirement once the denial-of-service attack is concluded (and, e.g., system administrators are therefore no longer distracted and/or occupied). For example, protection module110may reconfigure a software-defined network to cause network paths that had previously led to the computing resource via the authentication gateway to lead directly to the computing resource without passing through the authentication gateway.

FIG. 4may provide an example of protection module110protecting a computing resource against a secondary attack by adding an authentication requirement for accessing the computing resource. As explained earlier, in one example, an attacker may wish to access computing resource440protected by authentication layer442. Accordingly, at step460, the attacker may retrieve email address414from organizational directory412for subsequent use in a targeted attack on network410to access computing resource440. At step462, the attacker may broadcast an instruction to botnet430to initiate a distributed denial-of-service attack on network410. Accordingly, at step464, devices430(1)-(n) may flood network410with requests (e.g., to engage and/or distract system administration personnel and/or resources). Security system450may then observe the distributed denial-of-service attack on network410and infer a secondary attack on computing resource440(e.g., based on sensitive data stored by computing resource440, based on computing resource440employing authentication layer442, and/or based on computing resource440having previously been tagged as sensitive). Accordingly, at step466security system450may temporarily provision computing resource440with an authentication layer452(thereby temporarily implementing two-factor authentication for computing resource440). At step468, attacker client420may launch a spear phishing attack on network410. For example, attacker client420may send an email with a malicious attachment to email address414. The malicious attachment may leverage a zero-day exploit to infect and/or gain control over a device within network410. Accordingly, at step470, attacker client420may gain control of an authentication factor416that satisfies authentication layer442and would therefore normally grant access to computing resource440. At step472, attacker client420may attempt to access computing resource440. However, authentication layer452may require a second authentication factor for accessing computing resource440, leaving authentication factor416alone insufficient to access computing resource440. Accordingly, attacker client420may fail to access computing resource440. At step474, an authorized user of network410may attempt to access computing resource440from client device418. The user may have been issued a second authentication factor to satisfy authentication layer452(e.g., previously or in response to identifying the denial-of-service attack). Accordingly, the legitimate attempt to access computing resource440may be successful.

As explained above, by responding to denial-of-service attacks on a network with temporarily increased authentication requirements for accessing sensitive network resources, the systems and methods described herein may prevent decoy denial-of-service attacks from increasing the likelihood of success of targeted attacks on the network. Additionally, by deploying the increased authentication requirements through modifying software-defined networks, these systems and methods may quickly and automatically protect against flanking attacks. For example, by quickly deploying a second authentication factor in response to denial-of-service attacks to protect against secondary targeted attacks and removing the second authentication factor when the threat of a secondary targeted attack has passed, these systems and methods may increase computing network security when it is needed most while minimizing inconvenience to users.

In one example, a perimeter firewall may detect a distributed denial-of-service attack on a network. A threat response broker may, in response, automatically provision an authentication gateway in front of critical servers using a software-defined-network manager. In this case, if an endpoint is compromised using a spear-phishing attack, then the stolen single-factor credential may be insufficient to breach critical internal servers. The end user may be prompted for a second factor. Once the threat profile has lowered, the threat response broker may dynamically deprovision the two-factor authentication network gateways through the software-defined network. This may limit the inconvenience imposed due to two-factor authentication for the duration of the threat.

As detailed above, computing system610and/or one or more components of network architecture700may perform and/or be a means for performing, either alone or in combination with other elements, one or more steps of an exemplary method for blocking flanking attacks on computing systems.