Abstract:
Method and apparatus for discovery, inventory, and assessment of critical information in an organization, critical information including electronic data on computers, the method comprising the steps of defining critical information, distributing critical information policy to computers containing information that needs to be assessed, generating an inventory of information on each computer, assessing the criticality by applying the criticality definition, generating a report of assessment, collecting assessment reports from individual computers, and generating a reports for the organization at a computer and organization level, including a distribution of critical information and said apparatus comprising a centralized manager and distributed software components on computers containing information to be assessed.

Description:
RELATED APPLICATIONS  
       [0001]    This application is based on and claims priority and benefit of provisional U.S. patent application Ser. No. 60/420,817 filed Oct. 25, 2002. 
     
    
     
       FIELD OF THE INVENTION  
         [0002]    The present invention relates generally to security of critical information on computing devices, and more particularly, to an apparatus and method for discovery, inventory, and assessment of critical information in an organization.  
         BACKGROUND OF THE INVENTION  
         [0003]    As information grows rapidly, and with more and more of it distributed, and portable, it becomes important to be able to systematically and periodically assess the location and extent of critical information within an organization.  
         Applications  
         [0004]    Immediate applications of information assessment include:  
           [0005]    Security: Critical information should be secured from security vulnerabilities, such as corruption, loss, or theft. Otherwise an organization may incur business and monetary damage. Information Assessment is the first step in securing critical information. Once critical information is tracked down, and its criticality is assessed, security CIO can then evaluate and fix security vulnerabilities.  
           [0006]    Insurance: Even though information is an “intangible” property, its criticality to an organization can exceed tangible property assets. To help organizations insure themselves against the risk of information loss, Insurance companies may offer “information loss insurance”. Information Assessment forms a key early step in the insurance process.  
           [0007]    Legal compliance: With the recent legal compliance requirements required by government regulations such as HIPPA, GLBA, Sarbanes-Oxley, etc. there is a new set of stringent requirements on data. Compliance with such standards require that organizations have knowledge of information that is distributed on their computers and further, have knowledge of what is critical and needs to be protected in accordance with these regulations.  
         Challenges  
         [0008]    It is not straightforward, however, to discover and assess the criticality of information and several challenges exist:  
           [0009]    Definition of critical information: Defining critical information is the first step in being able to assess information criticality. Criticality depends on the organization, the context, and the content of data. For instance, critical information in a manufacturing organization is different from critical information in a financial firm. Similarly, information that is available on employee computers is more susceptible to loss that data stored only on central servers. Also, information is associated with privileges and should be associated with the appropriate level of employee. Finally, the actual content of a document makes it more or less critical than the other document. Hence, it is important to come up with a framework and methodology for defining critical information.  
           [0010]    Locating distributed information: With the advent of mobile computing, remote workspaces, and traveling employees, it is challenging to be able to exactly determine what information is available on what computer and the owner of that information.  
           [0011]    Assessment of information to determine if it is critical: Once criticality criteria are known and there is a mechanism to locate information, the last key challenge is in the ability to determine what part of that information is critical. This requires systematic techniques to scan information to determine if it is critical.  
           [0012]    There are currently no known methods that can accomplish these three tasks.  
         SUMMARY OF THE INVENTION  
         [0013]    We describe an invention for Information Assessment, involving software that can define critical information and based on this definition, discover and evaluate critical information within an organization. The information itself can be on multiple distributed computing devices. 
       
    
    
     BRIEF DESCRIPTION OF DRAWINGS  
       [0014]    [0014]FIG. 1 illustrates the two components of the invention: IAA and IAM.  
         [0015]    [0015]FIG. 2 illustrates the overall flowchart for the invention operation.  
         [0016]    [0016]FIG. 3 illustrates the modules within the IAA.  
         [0017]    [0017]FIG. 4 illustrates a sample embodiment of the invention where the IAM is implemented through a graphical user interface and is used for definition critical information tags  
         [0018]    [0018]FIG. 5 illustrates a sample embodiment of the invention where the IAM displays the results collected by the IAA on a specific computer. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0019]    The Information Assessment invention is based on two unique concepts— 
         [0020]    1. A framework to quantify the value of information by defining a metric called “criticality”. Criticality defines the importance of a particular information document. Two types of information signatures—tag signatures, which are attributes of the information document, and content signatures, which are content strings within the information document, determine the criticality of an information document.  
         [0021]    2. A method to compute the criticality of any information document, based on signatures defined in 1. This method scans an information document, and searches for matches with a pre-defined set of signatures, and computes a criticality number for the document. Information criticality can then be summarized over an entire organization.  
         [0022]    Next, we describe the details of the invention. We believe that these details are adequate for a practitioner, skilled in the art, to develop an information assessment apparatus.  
       Prior Art  
       [0023]    There is no current system that accomplishes the task of identifying critical information and using it to do an inventory of electronic data. There are many frameworks, which allow enterprise users to search for documents based on content patterns within documents. Common examples are enterprise-version search products such as Inktomi (www.inktomi.com), Google (www.google.com), AltaVista (www.Overture.com). However, we believe we are the first search-based inventory and classification system where a security-related criticality value is associated with each document.  
         [0024]    From an inventory angle, a similar inventory product (such as www.mFormation.com) exists in the enterprise world that conducts the inventory of “applications” rather than documents. Such inventory products use different technology that searches the actual name of a running application within registry or MIBs to try and match it with the target application name.  
       Invention Components  
       [0025]    The information assessment invention comprises a Software Apparatus, indicated in FIG. 1.  
         [0026]    In a preferred embodiment, the Apparatus consists of a centralized manager  10  (called Information Assessment Manager or IAM) running on a host computer or server  24 , and distributed software  12 ,  14 ,  16  (called Information Assessment Agent or IAA) on each computer device  18 ,  20 ,  22  that stores information requiring assessment. Computer devices can be desktops, laptops, PDAs, servers, databases, with a variety of operating systems etc. The IAM and IAA communicate information  26 ,  28  over a network connection. The network can be any IP connection such as 10/100/1000 Mbs Ethernet or 802.11 wireless Ethernet or dial up modem.  
       Invention Operation  
       [0027]    [0027]FIG. 2 shows the overall flow-chart of the invention operation. All modules executed by IAM are drawn horizontally, while modules executed by IAA are drawn vertically. Steps are:  
         [0028]    a) The operation  40  begins with the IAM module being installed on a central server.  
         [0029]    b) The IAM then distributes the IAA agent software  42  along with policy, and configuration information to the computer devices requiring assessment.  
         [0030]    c) Each IAA first establishes Information Inventory  44 .  
         [0031]    d) Each IAA then executes Information Criticality Assessment  46 .  
         [0032]    e) Each IAA executes Information Assessment Reporting  48 .  
         [0033]    f) The IAM collects all the reports from different IAA systems  50 .  
         [0034]    g) The IAM computes organization-wide information assessment by summarizing and aggregating individual IAA reports  52 .  
       IAA Details  
       [0035]    As described earlier, the IAA works on each system (device or media) and discovers and assesses information criticality. The IAA consists of three modules indicated in FIG. 3.  
         [0036]    These include:  
         [0037]    A. Information Inventory  60   
         [0038]    B. Information Criticality Assessment  62   
         [0039]    C. Information Assessment Reporting  64   
         [0040]    This section describes the details of each module, including processes (algorithms, capabilities) and metrics.  
         [0041]    A. AA: Information Inventory  
         [0042]    A1: Information Inventory module  60  searches through all the files, folders resident on a system and summarizes the information found according to various categories:  
         [0043]    1) Name of system—Internal DNS name  
         [0044]    2) System Attributes— 
         [0045]    a. Server, Desktop, Laptop  
         [0046]    b. OS  
         [0047]    c. MAC address  
         [0048]    d. CPU-based id  
         [0049]    3) Number of files and percentages of total number of files with certain suffix (.exe, .doc, .xls, .dll, .bin, .pdf, etc.)  
         [0050]    4) Number of files and percentage of total number of files of a certain size (&gt;1 MB, &gt;10 MB, &gt;100 MB, &gt;1 GB)  
         [0051]    5) Total amount of information (in GB)  
         [0052]    A.2 Module creates for each system, a unique inventory ID. This ID is stored within the administrative database, and also on the system in an encrypted form.  
         [0053]    B. IAA:Information Criticality Assessment  
         [0054]    The Information Criticality Assessment module  62  assesses information in three sub-modules:  
         [0055]    1) Information Signature &amp; Signature Criticality  66 —Creates two types of “signatures” as indicators of criticality  
         [0056]    2) Criticality Color Coding  68 —Associates each level of criticality with a color zone  
         [0057]    3) Signature Matching &amp; File Criticality  70 —Scans information files, searches for matches with signature, computes file criticality.  
         [0058]    We describe more details next.  
         [0059]    B.1. Information Signature &amp; Signature Criticality  66 :  
         [0060]    This sub-module defines the meaning of information criticality within an organization. It creates a set of information signatures, which are “strings” that are indicative of information criticality. The set of all signatures is called signature book.  
         [0061]    Each information signature is associated with a signature ID and a criticality level between 0 and 10. Highest level of signature criticality is 10, while lowest is 0. To make them easy to use, the criticality level can be designated as low (L) or (0), medium (M) or (3), high (H) or (7), extreme (E) or (10).  
         [0062]    Signatures can be of two types— 
         [0063]    1. Tag Signatures  
         [0064]    Tag signatures are attributes associated with information, which indicate how sensitive is the information.  
         [0065]    An example set of tag signatures are:  
                                       Sig ID   Tag   Signature Criticality                   #   File extension (.dll)   M       #   File extension (.exe)   M                  
 
         [0066]    [0066]                                           #   File password   H           protection       #   File encryption   E                    
         [0067]    As seen above, tag signatures are attributes. For example, a file name with certain extension may indicate that it is critical for an organization. Alternatively, a file that is password-protected may indicate that it consists of highly critical information.  
         [0068]    Other custom tag signatures can be defined by administrator, including file name, file author, other file extensions, file permissions, etc.  
         [0069]    2. Content Signatures  
         [0070]    Content signatures are strings “within” an information document that represent sensitive information. We define two types of content signatures—Generic, which are “organization-wide”, and Functional, which are “specific” to a particular functional group within the organization.  
         [0071]    2a. Generic Signatures  
         [0072]    An example set includes  
                                       Signature ID   Signature   Signature Criticality                   #   Top-Secret   E       #   Secret   E       #   Confidential   H       #   Proprietary   H       #   Restricted   H       #   Need-to-know   H           Basis       #   “organization-   H           name” strategy       #   “organization-   H           name” plan       #   Password   E                  
 
         [0073]    Additional generic signatures can be custom added by the administrators.  
         [0074]    2b. Functional Signatures  
         [0075]    As described earlier, Functional signatures are “specific” to a particular functional group within the organization.  
         [0076]    Administrators have to create functional signatures suitable for their organization. To aid them with this, the invention provides default functions (categories).  
         [0077]    Within each function, the administrator can create a set of signatures that captures sensitive information for that function. For instance, within the  
         [0078]    Technology function, the administrator of a pharmaceutical company can enter typical technical terms describing a new drug being discovered, or related to a recent patent etc.  
         [0079]    Default functions include:  
                                               Technology                           Product Management           Product Marketing           Sales           Business Development           Financial                      
 
         [0080]    Additionally, administrators may be allowed to create customized functions.  
         [0081]    B.2 Criticality Color Coding  68 :  
         [0082]    To make visualization easy, each criticality level is assigned a color (or, interchangeably, called a zone).  
         [0083]    Default colors are:  
                                             Criticality Level   Color (Zone)                                10   Red       7   Orange       3   Yellow       0   Green                  
 
         [0084]    This sub-module can allow additional colors to support finer level of granularity.  
         [0085]    B.3 Signature Matching &amp; File Criticality Fc  70 :  
         [0086]    On each invocation, the sub-module searches to see if there is a signature match between the signature book and the information files on the system being surveyed.  
         [0087]    A variety of commonly available OS-level or application-level Application Program Interfaces (APIs) can be used to determine for this. As an illustration, search for content signatures on Windows XP operating system could be implemented at the OS-level using the OS-level searching called Indexing Service. Alternatively, search can be implemented by a third-party programmatic application.  
         [0088]    Because these APIs are obvious and dependent on each system, we will not specify actual APIS.  
         [0089]    c1. File Criticality Fc  
         [0090]    If the search yields a match between a particular signature and a file, the file is assigned a File Criticality level (Fc) equal to the Signature Criticality of the particular signature. If more than one signature is found in a file, the File Criticality is chosen as the maximum number between the Signature Criticalities of the matching signatures.  
         [0091]    c2. Information Database  
         [0092]    The sub-module creates an Information Database, where important properties are stored for each file. A row is created for each file discovered, and is then updated with the file name and criticality fields of the database. The database is stored within the system, and ultimately transported to the Information Assessment Manager. The following table illustrates the schema and one example row for the Information Database. Table 1 Information Database: Updates File Name and File Criticality  
                                           Fully qualified   File Criticality               file name   (Fc)   Tag Signature   Content Signature                   //hostid/path/file.doc   10   .exe   “Confidential”                  
 
         [0093]    C. Information Assessment Reporting  64   
         [0094]    This module defines metrics of criticality and issues an information assessment report.  
         [0095]    C.1 System Criticality Metrics &amp; Computation  
         [0096]    d1. Table 1  
         [0097]    f_count=Total number of information files on the system  
                                                                     Criti-   File   Security   Number           cality   Criti-   Desig-   of info   % of information in each       Zone   cality   nation   files   criticality zone                                Red   10   E   f_red —     f_red_count/f_count)*100                   count       Orange   7   H   f_orange —     (f_orange_count/                   count   f_count)*100       Yellow   3   M   f_yellow —     f_yellow_count/                   count   f_count)*100       Green   0   L   f_green —     f_green_count/f_count)*100                   count                  
 
         [0098]    d2. Criticality Report: System Criticality 2 :  
         [0099]    The sub-module defines a metric called System Criticality (S_criticality) 2 , which represents the average criticality of information within the system (device).  
         [0100]    S_criticality=Sum(criticality level×number of files at criticality level/f_count As an illustration, in the default example with 4 colors,  
         [0101]    S_criticality=(10×f_red_count/f_count+7×f_orange_count/f_count+3×f_yellow_count/f_count+0×f_green_count/f_count)  
         [0102]    System Criticality ranges from 0 and 10.  
         [0103]    d3. Criticality Distribution:  
         [0104]    Distribution of information in each criticality zone  
         [0105]    The sub-module also defines criticality distribution, by plotting the histogram of percentages of files within each criticality zone.  
         [0106]    Percentages have been computed in column  5  of the table above.  
         [0107]    C.2 System Criticality Criteria  
         [0108]    The sub-module computes three different criticality criteria, which can help summarize the criticality of the system. One or the other criteria may best suit a particular organizational environment.  
         [0109]    e1. Absolutely Critical  
         [0110]    System is absolutely critical if at least X information files lie in &gt;=C 1 -color zone. X (integer), C 1  (enum) are parameters, by default, X=1, C 1 =orange.  
         [0111]    e2. Average Critical  
         [0112]    System is average critical if average system information criticality S_criticality &gt;=Y. Y (double) is parameter, by default, Y=3.0.  
         [0113]    e3. Percentile Critical  
         [0114]    System is percentile critical if at least Z % of information files lie in &gt;=C 2  color zone. Z(double), C 2  (enum) are parameters, set by default to Z=10, C 2 =orange.  
         [0115]    e4. Table: Summary of How Information Critical is the System:  
                                                   Criticality Criterion   System Status                           Absolutely Critical   Critical/NOT Critical           Average Critical   Critical/NOT Critical           Percentile Critical   Critical/NOT Critical                      
 
       IAM Module  
       [0116]    Policy Configuration and Distribution: The IAM is used to configure the criticality policies through a user interface. Once configured, the IAM allows the policies to be distributed to the IAA. This distribution can be configured to be on-demand or on a periodic schedule.  
         [0117]    Organization Information Collection and Assessment Report: Once each IAA has completed issuing their individual system-level information assessment reports, these reports and the Information Database are sent back to the IAM module. The IAM module aggregates this information, and summarizes it at an organizational level.  
         [0118]    f1: Table: Overall Information Assessment Summary  
         [0119]    Date/Time:  
                                                   Systems Scanned   Number of Systems                           System Categories               Servers           Desktops           Laptops           Media - Floppies           Media - CDs           Media - Tapes           Databases                      
 
         [0120]    f2. Organization Information Criticality Report  
                                       Criticality Criteria   Number of systems   % of total systems                   Absolutely critical systems   Xabs   Pabs       Average critical systems   Xave   Pave       Percentile critical systems   Xper   Pper                  
 
         [0121]    In the above table, the sub-module computes the number of systems that are critical by three definitions (Xabs, Xave, Xper), as well as the percentage of total systems that meet this criterion (Pabs, Pave, Pper).  
         [0122]    The foregoing merely illustrates the principles of the present invention. Those skilled in the art will be able to device various modifications, which although not explicitly described or shown herein, embody the principles of the invention and are thus within its spirit and scope.  
         [0123]    The above mentioned invention has been implemented in a specific embodiment. One instance of definition of criticality information  72  on the IAM is by means of a graphical user interface, as shown in FIG. 4. The IAA is implemented on user computers and generates results that are uploaded to the IAM. FIG. 5 shows one embodiment of the results when uploaded to the IAM and viewed by the graphical user interface on the IAM. FIG. 5( a )  74  shows the color coded organization level critical information,  5 ( b )  76  shows the distribution of critical information,  5 ( c )  78  shows the distribution of critical information at a computer level, and  5 ( d )  80  shows the details of critical information collected from a specific IAA.