Distributed security agent technology

Apparatus and methods are disclosed for identifying differences in objects of a computing device using definitions expressed in vulnerability assessment languages such as Open Vulnerability and Assessment Language (OVAL). In one example of the disclosed technology, a method includes receiving criteria for evaluating the computing device using an agent. The criteria specify object tests used to generate associated state values based on states or status of the tested objects. The criteria are evaluated and first state values generated by performing the object tests are stored as expected values for object tests. The criteria are then evaluated by re-performing the object tests, and second state values thereby generated are compared to the first state values. One or more differences between the first and second state values can be identified and reported to, for example, a monitor server.

FIELD

This application relates generally to the field of information technology (“IT”) compliance, including utilizing distributed compliance and security agents.

BACKGROUND

Vulnerability assessment languages, such as OVAL (Open Vulnerability and Assessment Language), specifications of which are distributed by the MITRE Corporation, can be used to enhance interoperability by providing standardized definitions for tests that can be performed on computing devices to check, for example, registry entries, file integrity, filesystem permissions, and other system characteristics. Current OVAL definitions are authored by security authorities and can be used to evaluate whether a particular computing device complies with a published security policy described in OVAL definition files. However, because these definitions describe already-known security threats and policies, such methodologies are inflexible and are not adapted to evaluate unknown or dynamic vulnerability and compliance issues in the deployed environment.

SUMMARY

Apparatus and methods are disclosed below for using descriptions of policies to apply to computing device objects expressed in vulnerability assessment languages. For examples, descriptions of a policy can be described in an eXtensible Markup Language (XML) file and distributed to agents executing on computing devices that can evaluated the described policies. Definitions described in the policy include criteria, which are evaluated based on combining results of performing test(s) further defined in the policy. The tests describe an object associated with the computing device (e.g., a registry entry, hardware state, file state, file contents, or other objects associated with the device) and a state of the object to be tested for (e.g., expected (or unexpected) registry values, file states (e.g., file permissions, open or closed status, file sizes, or file modification dates), file contents (e.g., the existence or non-existence of strings, series of bytes, or other file contents), or other suitable states on the computing device that can be tested.

In addition to determining whether a computing device satisfies the criteria defined in a policy definition file, the state values themselves can be stored on the computing device for later comparison. By comparing two state values that are evaluating at different points in time, differences in the associated objects can be identified and reported. Thus, in situations where state values associated with an object change, but the state values are still in compliance with the specified policy definition, the state values can be flagged or reported and then subject to further evaluation.

Such reporting can help administrators improve policy definitions, for example, by identifying unusual or rare device states, and then defining improved policies based on examining the reported differences. Using the policy definitions in this way allows for dynamic security automation by applying published policy definitions.

This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. The foregoing and other objects, features, and advantages of the invention will become more apparent from the following detailed description, which proceeds with reference to the accompanying figures. Further, any trademarks used herein are the property of their respective owners.

DETAILED DESCRIPTION

I. General Considerations

This disclosure is set forth in the context of representative embodiments that are not intended to be limiting in any way.

As used in this application the singular forms “a,” “an,” and “the” include the plural forms unless the context clearly dictates otherwise. Additionally, the term “includes” means “comprises.” Further, the term “coupled” encompasses mechanical, electrical, magnetic, optical, as well as other practical ways of coupling or linking items together, and does not exclude the presence of intermediate elements between the coupled items. Furthermore, as used herein, the term “and/or” means any one item or combination of items in the phrase.

The systems, methods, and apparatus described herein should not be construed as being limiting in any way. Instead, this disclosure is directed toward all novel and non-obvious features and aspects of the various disclosed embodiments, alone and in various combinations and subcombinations with one another. The disclosed systems, methods, and apparatus are not limited to any specific aspect or feature or combinations thereof, nor do the disclosed things and methods require that any one or more specific advantages be present or problems be solved. Furthermore, any features or aspects of the disclosed embodiments can be used in various combinations and subcombinations with one another.

II. Example Networking Environment for Implementing Embodiments of the Disclosed Technology

An example of a possible network topology (e.g., a client-server network) for implementing a distributed security agent technology according to the disclosed technology is depicted inFIG. 1. As shown, a network diagram100illustrates a number of networked computing devices (e.g., laptops110and111, desktop computers112and113, touch screen tablets114and115, and file servers116and117). The computing devices are running agents that communicate with one or more central computers (e.g., a monitor server120or a definition repository125) via a network (e.g., a local area network (LAN)130, the Internet network135, a wide area network, and/or other suitable computing network). The computing devices and the central computer can have computer architectures as shown inFIG. 4and discussed in further detail below. The computing devices are not limited to traditional personal computers but can comprise other computing hardware configured to connect to and communicate with a network (e.g., smart phones or other mobile computing devices, servers, network devices, dedicated devices, and the like).

In the illustrated embodiment, the computing devices are configured to communicate with one or more central computers (e.g., a monitor server120or a definition repository125). In certain implementations, the central computers execute software for performing some or all of the disclosed compliance and configuration control functionalities. For example, the central computers can transmit data to any of the computing devices (e.g., definitions including criteria for evaluating the computing devices) as well as receive data from any of the computing devices (e.g., reports identifying differences in computing device state values and/or results of performing tests on objects associated with the computing devices). For example, the computing devices can receive definitions from the monitor server120and/or the definition repository125, as well as send reports these central computers over the LAN130and/or Internet135. In some examples, the definition repository125is controlled by a third party, such as a government, a corporation, or a standards-issuing body.

III. Example Identification of State Value Differences Using Definitions

FIG. 2is a flow chart200detailing an example of method of evaluating state value differences on computing devices, as can be used in certain embodiments of the disclosed technology. The method ofFIG. 2can be performed using computing devices and central computers in a networked environment (e.g., as discussed above regardingFIG. 1).

At process block210, one or more definitions are received describing criteria for evaluating a computing device. The definitions describe a security or compliance policy, and can include descriptions of objects tests and state values associated with those objects. Examples of objects that can be described include: registry entries, files, file systems attributes, processor or memory state, peripherals, or other suitable objects coupled to the computing devices. In some examples, the definitions include criteria for determining whether the tested object(s) are in compliance with a security policy, include certain inventory items, have had software patches installed, or exhibit vulnerabilities to known security threats. The criteria can include combinations of one or more tests that can be performed by the agent to determine states associated with the object. The test can include a description of the thing to be collected (an object) and an expected state that the object must match to pass the test. Thus, performing the tests determines the current state of the associated object and compares that current state to an expected state. For example, available tests to perform on a file can include evaluating file permissions (e.g., read, write, and delete, or group and user permissions), file sizes, or file contents (e.g., the existence, or absence, of strings or byte codes in the file). For example, valid state values for testing a file could include the file permissions being write only, the file size being 50 megabytes, or the presence of a bytecode associated with a computer virus. When evaluating the criteria, the result can be expressed as a boolean true/false value (pass/fail), or as finer-grained values (e.g., a range of integer values or strings expressing an evaluated vulnerability level determined using the criteria and associated object tests).

In some examples, the definitions are expressed in a vulnerability assessment language, for example, Open Vulnerability and Assessment Language (OVAL), which is distributed by MITRE Corporation. The use of such vulnerability assessment languages allows interoperability of unified standards across different organizations and computing environments. Organizations can develop, test, and deploy standardized policy definitions, which in turn can be adapted by particular organizations as part of a comprehensive security and vulnerability compliance program. After receiving the definitions, the method proceeds to process block220.

At process block220, the criteria received at process block210are evaluated and first state values are collected by performing object tests specified by the criteria. The first state values are stored for later comparison. For example, the first state values can be stored as expected state values for object tests in an OVAL-formatted file stored in a computer-readable storage medium, or stored in volatile memory accessible to an agent executing on a computing device. Storing state values allows for later comparison and further detailed analysis, above and beyond simply reporting whether an object passes or fails the defined criteria. After storing the first state values, the method proceeds to process block230.

At process block230, the same criteria that were evaluated at process block220are evaluated to collect second state values at a later point in time, by re-performing one or more of the object tests specified by the criteria. This collecting can be performed periodically (e.g., on an hourly or weekly basis), in response to receiving an event (e.g., receiving a request by a user of a computing device or a monitor server, or in response to detecting an event on the agent (e.g., the addition of new hardware or software). Second state values generated by performing tests defined using the criteria are stored, for example, in an OVAL-formatted file. Once second state values have been generated by reforming the object tests, the method proceeds to process block240.

At process block240, differences between the first state values stored at process block220and the second state values generated at process block230are identified. In some cases, the identifying can include comparing collected state values using a threshold for determining whether a difference exists. If one or more differences in the state values are identified, the method proceeds to process block250to send a report. Alternatively, if no differences are identified, the method proceeds to process block260.

In some examples, each of the first state values and the second state values includes a single set of values generated by performing tests using criteria. In other examples, multiple sets of values can be stored as expected state values and then compared at process block240. Thus, in some examples, if there are more than one set of values stored, then newly-collected state values matching any one of the set of values can be ignored and thus not identified as a difference.

At process block250, a report is sent indicating differences identified at process block240. For example, the differences can be reported to a user of the computing device that is executing the agent via a graphical user interface, or by sending an email containing an indication or description of the differences. Alternatively, a report describing the differences can be sent to a central computer (e.g., a monitor server), where further analysis of the reported differences can be performed. For example, a system administrator can use the generated reports to evaluate vulnerabilities, resource consumption, or other properties related to the objects associated with the reported differences.

In some examples, the report also includes a report describing whether the object is in compliance with the evaluated criteria. Thus, there can be cases where an object complies with the policy as specified in the criteria description, but the disclosed methods identify differences that can be reported for further analysis. Alternatively, an object may not comply with a policy, but no difference is determined by comparing the state values.

At process block260, a report is not sent identifying differences. By not sending a report (such as described above regarding process block250), an agent performing the method illustrated inFIG. 2can avoid generating excessive data and consuming network resources when state differences in monitored objects have not been identified.

FIG. 3Ais a portion300of OVAL-like code for a definition that can be used with some implementations of the disclosed methods. As shown, the definition includes identifying information, a description of the version and origin of the definition, and a classification of the definition (e.g., the definition can be classified as a vulnerability or compliance definition). As shown, the definition includes criteria303defined using Boolean operators to combine a number of file tests. The file tests include tests for the existence of the file, as well as a file test305for file permissions associated with the file /etc/password. As shown, the expected value307of the test is a Boolean 0 (or false), because the file is not expected to be writable by other users (“def:owrite”). A number of features of the code have been omitted or modified for clarity, but techniques for authoring such code will be readily discernible to one of ordinary skill in the relevant art.

FIG. 3Bis a portion310of OVAL-like code for a modified test definition315that has been subsequently stored after the portion300was generated. As indicated by the updated portion310, the/etc/password file was determined to have write permissions for other users (indicated by an expected value317of one). Thus, the new state of the computing device will be considered the “normal” (or expected) state of the computing device for future evaluations of the criteria using the modified test definition. In some examples, multiple states of the computing device can be collected and stored as expected states.

IV. Example Computing Environments for Implementing Embodiments of the Disclosed Technology

FIG. 4illustrates a generalized example of a suitable computing environment400in which described embodiments, techniques, and technologies, including reporting agents and monitor servers, can be implemented. For example, the computing environment400can implement evaluating criteria, performing tests, and sending reports of differences in state values, as described herein.

The computing environment400is not intended to suggest any limitation as to scope of use or functionality of the technology, as the technology may be implemented in diverse general-purpose or special-purpose computing environments. For example, the disclosed technology may be implemented with other computer system configurations, including hand held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, and the like. The disclosed technology may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

With reference toFIG. 4, the computing environment400includes at least one central processing unit410and memory420. InFIG. 4, this most basic configuration430is included within a dashed line. The central processing unit410executes computer-executable instructions and may be a real or a virtual processor. In a multi-processing system, multiple processing units execute computer-executable instructions to increase processing power and as such, multiple processors can be running simultaneously. The memory420may be volatile memory (e.g., registers, cache, RAM), non-volatile memory (e.g., ROM, EEPROM, flash memory, etc.), or some combination of the two. The memory420stores software480, images, and video that can, for example, implement the technologies described herein. A computing environment may have additional features. For example, the computing environment400includes storage440, one or more input devices450, one or more output devices460, and one or more communication connections470. An interconnection mechanism (not shown) such as a bus, a controller, or a network, interconnects the components of the computing environment400. Typically, operating system software (not shown) provides an operating environment for other software executing in the computing environment400, and coordinates activities of the components of the computing environment400.

The storage440may be removable or non-removable, and includes magnetic disks, magnetic tapes or cassettes, CD-ROMs, CD-RWs, DVDs, or any other medium which can be used to store information and that can be accessed within the computing environment400. The storage440stores instructions for the software480and image data, which can implement technologies described herein.

The input device(s)450may be a touch input device, such as a keyboard, keypad, mouse, touch screen display, pen, or trackball, a voice input device, a scanning device, or another device, that provides input to the computing environment400. For audio, the input device(s)450may be a sound card or similar device that accepts audio input in analog or digital form, or a CD-ROM reader that provides audio samples to the computing environment400. The output device(s)460may be a display, printer, speaker, CD-writer, or another device that provides output from the computing environment400.

The communication connection(s)470enable communication over a communication medium (e.g., a connecting network) to another computing entity. The communication medium conveys information such as computer-executable instructions, compressed graphics information, video, or other data in a modulated data signal.

Some embodiments of the disclosed methods can be performed using computer-executable instructions implementing all or a portion of the disclosed technology in a computing cloud490. For example, agents can be executed in the computing environment430while producing definitions or receiving reports can be performed on servers located in the computing cloud490.

Computer-readable media are any available media that can be accessed within a computing environment400. By way of example, and not limitation, with the computing environment400, computer-readable media include memory420and/or storage440. As should be readily understood, the term computer-readable storage media includes the media for data storage such as memory420and storage440, and not transmission media such as modulated data signals.

Any of the methods described herein can be performed via one or more computer-readable media (e.g., storage or other tangible media) comprising (e.g., having or storing) computer-executable instructions for performing (e.g., causing a computing device to perform) such methods. Operation can be fully automatic, semi-automatic, or involve manual intervention.