Patent ID: 7739720

Claim:
A method in a computer system for enforcing security policies, the method comprising: providing a plurality of different security policies, a security policy having a process set criterion and having multiple rules, a process set criterion of a security policy defining attributes of a process to which rules of that security policy are to be applied, each rule having a rule type, a condition, and an action, the rules types including global and application-specific, a rule with a global rule type for being applied to processes that satisfy the process set criterion, a rule with an application-specific rule type for being applied to processes specifically identified by the rule and that satisfy the process set criterion, the actions including allow and deny; when in user mode, generating a rule list that combines each of the plurality of security policies into the rule list representing a combined security policy, each rule in the rule list associated with the process set criterion of the security policy that contains the rule, the rule list being ordered by rule type and action within rule type, wherein rules with a global rule type are ordered before rules with an application-specific rule type and rules with actions of deny are ordered before rules with actions of allow; and when in kernel mode, prior to starting a process, identifying the rules of the rule list whose process set criterion is satisfied by the process based on comparison of attributes of the process and attributes defined by the process criterion associated with each rule of the rule list; and after identifying the rules of the rule list whose process set criterion is satisfied by the process, starting the process and during execution of the process: when a security event relating to the process occurs, applying the identified rules to the security event in the order of the rule list by selecting each of the rules in the order of the rule list; determining whether the security event satisfies the condition of the selected rule; and when it is determined that the security event satisfies the condition of the selected rule, performing the action of the selected rule.