Patent ID: 7540013

Claim:
A method for controlling connections to a new computer upon its initial deployment, the method comprising: before deployment of the new computer, imaging the computer's storage to include a preconfigured security update policy for preventing Internet-borne infections occurring before the computer can obtain security-relevant updates; upon the initial deployment of the new computer, applying said preconfigured security update policy to establish at the computer a pre-access restricted zone of at least one preapproved host that the computer is restricted to connect to upon its initial deployment for obtaining current security-relevant updates, so that without relying on any external network-based security mechanisms the computer is provided with a fully self-contained enforcement mechanisms that completely blocks the computer from all other connectivity to the Internet until security-relevant updates have been completed; receiving a request for a connection from the computer to a particular host; based on said preconfigured security update policy, determining whether the particular host is within the restricted zone of at least one preapproved host; blocking said connection if said particular host is not within the restricted zone of at least one preapproved host; and once the computer has complied with the security update policy, lifting the restricted zone so that the computer is allowed to participate with general connectivity to the Internet.