Source: http://patents.com/us-10181038.html
Timestamp: 2019-03-25 06:11:45
Document Index: 769563884

Matched Legal Cases: ['Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62']

US Patent # 1,018,1038. Deployment assurance checks for monitoring industrial control systems - Patents.com
United States Patent 10,181,038
Carpenter , et al. January 15, 2019
This disclosure provides an apparatus and method for deployment assurance checks for monitoring industrial control systems and other systems. A method includes identifying, by a risk manager system, a plurality of connected devices that are vulnerable to cyber-security risks. The method includes determining devices to be monitored from the plurality of connected devices. The method includes evaluating system resource usage, by the risk manager system, on each device to be monitored. The method includes providing recommendations to a user as to whether or not the user should proceed with the monitoring, based on the evaluation.
Carpenter; Seth G. (Phoenix, AZ), Knapp; Eric D. (Milton, NH)
Family ID: 1000003762728
14/943,876
US 20170140154 A1 May 18, 2017
Current CPC Class: G06F 21/577 (20130101); G05B 19/00 (20130101); G06F 2221/034 (20130101)
Current International Class: G06F 11/00 (20060101); G08B 23/00 (20060101); G06F 21/57 (20130101); G05B 19/00 (20060101); G06F 12/14 (20060101); G06F 12/16 (20060101)
9639140 May 2017 Piga
2015/0007315 January 2015 Rivera et al.
2016/0180093 June 2016 Goss
2017/0054605 February 2017 Duncan
2015103212 Jun 2015 JP
20060017346 Feb 2006 KR
101233934 Feb 2013 KR
"Risk Management and Critical Infrastructure Protection: Assessing, Integrating, and Managing Threats, Vulnerabilities and Consequences"; CRS Rpt for Congress; RL32561; Feb 4, 2005; 28 pages. cited by applicant .
Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration dated Jan. 26, 2017 in connection with International Patent Application No. PCT/US2016/059667. cited by applicant.
1. A method for deployment assurance checks for monitoring an industrial control systems, comprising: identifying, by a risk manager system, a plurality of connected devices that are vulnerable to cyber-security risks; determining, by the risk manager system, devices to be monitored from the plurality of connected device; verifying any relevant software or hardware prerequisites on the devices to be monitored; validating whether an appropriate software version is present on each device to be monitored through a remote Windows Management Infrastructure (WMI) query by a user; evaluating system resource usage, by the risk manager system, on each device to be monitored; evaluating, by the risk manager system, security prerequisites on the connected devices, the evaluating security prerequisites includes: checking firewall setting on each device, validating that monitoring process is running from an account that is recognized, and receiving credentials from a user and sending credentials to the connected devices; and providing recommendations to the user, by the risk manager system, as to whether or not the user should proceed with the monitoring, based on the evaluation and on whether the monitoring would increase the system resource usage beyond a predetermined threshold and recommendations as to whether or not to install a monitoring agent on each of the connected devices and providing a level of enforcement of the recommendations, the level of enforcement includes at least one of "No" enforcement "Soft" enforcement or "Hard" enforcement.
2. The method of claim 1, wherein identifying the plurality of connected devices includes performing an automatic discovery process by the risk manager system.
3. The method of claim 1, wherein the system resource usage includes processor usage, memory usage, and disk space usage.
4. The method of claim 1, further comprising selectively enforcing the recommendations on each of the plurality of devices.
5. The method of claim 1, wherein identifying the plurality of connected devices includes receiving device information by the risk manager system from the user.
6. A risk manager system comprising: a controller; and a memory, the risk manager system configured to: identify a plurality of connected devices that are vulnerable to cyber-security risks; determine devices to be monitored from the plurality of connected devices; verify any relevant software or hardware prerequisites on the devices to be monitored; validate whether an appropriate software version is present on each device to be monitored through a remote Windows Management Infrastructure (WMI) query by a user: evaluate system resource usage on each device to be monitored; evaluate evaluating security prerequisites on the connected devices, the evaluation of security prerequisites includes: check firewall setting on each device, validate that monitoring process is running from an account that is recognized, and receive credentials from the user and send credentials to the connected devices; and provide recommendations to the user as to whether or not the user should proceed with the monitoring, based on the evaluation and on whether the monitoring would increase the system resource usage beyond a predetermined threshold and recommendations as to whether or not to install a monitoring agent on each of the connected devices and provide a level of enforcement of the recommendations, the level of enforcement includes at least one of "No" enforcement, "Soft" enforcement or "Hard" enforcement.
7. The risk manager system of claim 6, wherein the risk manager system is configured to identify the plurality of connected devices by performing an automatic discovery process.
8. The risk manager system of claim 6, wherein the system resource usage includes processor usage, memory usage, and disk space usage.
9. The risk manager system of claim 6, wherein the risk manager system is further configured to selectively enforce the recommendations on each of the plurality of devices.
10. The risk manager system of claim 6, wherein the risk manager system is configured to identify the plurality of connected devices by receiving device information by the risk manager system from the user.
11. A non-transitory machine-readable medium encoded with executable instructions that, when executed, cause one or more processors of a risk manager system to: identify a plurality of connected devices that are vulnerable to cyber-security risks; determine devices to be monitored from the plurality of connected devices; verify any relevant software or hardware prerequisites on the devices to be monitored; validate whether an appropriate software version is present on each device to be monitored through a remote Windows Management Infrastructure (WMI) query by a user: evaluate system resource usage on each device to be monitored; evaluate security prerequisites on the connected devices, the evaluation of security prerequisites includes: check firewall setting on each device, validate that monitoring process is running from an account that is recognized, and receive credentials from the user and send credentials to the connected devices; and provide recommendations to the user as to whether or not the user should proceed with the monitoring, based on the evaluation and on whether the monitoring would increase the system resource usage beyond a predetermined threshold and recommendations as to whether or not to install a monitoring agent on each of the connected devices and provide a level of enforcement of the recommendations, the level of enforcement includes at least one of "No" enforcement, "Soft" enforcement or "Hard" enforcement.
12. The non-transitory machine-readable medium of claim 11, wherein the instructions to identify the plurality of connected devices includes instructions to perform an automatic discovery process by the risk manager system.
13. The non-transitory machine-readable medium of claim 11, wherein the system resource usage includes processor usage, memory usage, and disk space usage.
14. The non-transitory machine-readable medium of claim 11, wherein the non-transitory machine-readable medium is further encoded with instructions to selectively enforce the recommendations on each of the plurality of devices.
This disclosure relates generally to network security. More specifically, this disclosure relates to an apparatus and method for deployment assurance checks for monitoring industrial control systems and other systems.
FIG. 2 illustrates a flowchart of a process in accordance with disclosed embodiments; and
FIGS. 3-8 illustrate example user interfaces that can be used as part of disclosed embodiments.
As noted above, cyber-security is of increasing concern with respect to industrial process control and automation systems. Unaddressed security vulnerabilities in any of the components in the system 100 could be exploited by attackers to disrupt operations or cause unsafe conditions in an industrial facility. In industrial environments, cyber security is of increasing concern, and it is difficult to quickly determine the potential sources of risk to the whole system. Modern control systems contain a mix of Windows servers and workstations, switches, routers, firewalls, safety systems, proprietary real-time controllers and field devices, any of which can be implemented by one or another of the components in system 100.
Often these systems are a mixture of equipment from different vendors. Sometimes the plant operators do not have a complete understanding or inventory of all the equipment running in their site. Unaddressed security vulnerabilities in any of these components could be exploited by attackers to disrupt production or cause unsafe conditions in the plant. Disclosed embodiments can address the potential vulnerabilities in all these systems, prioritize the vulnerabilities based on the risk to the system, and guide the user to mitigate the vulnerabilities.
Any monitoring system will necessarily have some performance impact on the monitored system, no matter how small. It will also have some requirements or prerequisites that must be met in order to monitor that system. The highest priorities for a control system are safety and production, so it is critical that any monitoring of that system does not jeopardize either of these aspects. This is true whether an agent is installed on the end devices for monitoring or whether "agentless" protocols are used for monitoring (which take advantage of hooks and APIs already present in the end devices).
A monitoring system then should be able to verify these requirements and ensure that it will not have an adverse impact on system safety or production prior to starting its monitoring. This can be accomplished (among other ways) using a risk manager 154. Among other things, the risk manager 154 supports a technique for monitoring a system such as an industrial control system and checking for proper deployment of the devices and components of that system.
In some risk manager implementations, the user installing and configuring the risk manager would be responsible for verifying that each end device is ready for monitoring. In many cases, a user will simply attempt to monitor the end device and hope there are no adverse effects. The attempt to monitor the device may also fail, leaving the user to contacting technical support or try independently troubleshooting.
Disclosed embodiments automate those checks, provide feedback to the installing user, and provide a recommendation as to whether the user should proceed. It can identify situations where monitoring is not recommended (e.g., the user might not want to risk upsetting the system by monitoring a device already suffering from low resources) and situations where monitoring would fail if attempted (e.g., trying to push a monitoring agent to the device would be blocked by the current security settings). A recommendation as to whether the user should proceed can be as simple as a "yes/no" indicator, or can be more specific recommendations as to actions that should or should not be taken if the user is to proceed.
The techniques disclosed herein can be applied to both "agent-based" and "agentless" monitoring of end devices. The distinction between the two is that agent-based monitoring will add a resident program to the monitored device, while agentless monitoring takes advantage of features already present in the end device to perform the monitoring functions. Often agentless monitoring takes advantages of APIs present in the operating system (such as the Windows Management Infrastructure (WMI) available on Microsoft Windows platforms) or otherwise already present on the end device.
For example, in agent-based system, once devices are discovered, the agent needs to be deployed. This may require that some security settings are disabled, and requires a certain amount of free CPU, memory and disk space. The pre-check process can perform such functions as checking security configurations to see if the agent can be pushed without any changes; checking memory to ensure that there is sufficient free RAM to install the agent and still have a healthy margin of available memory; checking CPU utilization to ensure that there is sufficient free CPU to install the agent and still have a healthy margin of available memory; and checking a hard disk drive (HDD) to ensure that there is sufficient free HDD space to install the agent and still have a healthy margin of available storage.
FIG. 2 illustrates a flowchart of a method 200 in accordance with disclosed embodiments, as can be performed, for example, by risk manager 154 or another device or controller (referred to as the "system" or "risk manager system" below).
The system identifies a plurality of connected devices that are vulnerable to cyber-security risks (205). These devices can be any computing devices, such as any of the components of FIG. 1 or those described below. Devices can be automatically discovered and added by the system. Devices can be added manually by the user, for example by entering such information as an IP address, an SNMP community string, or others.
The system determines devices to be monitored (210). This can include receiving manual entries from a user that identify the devices to be monitored, by automatic discovery methods such as enumerating PCs in Active Directory for Windows domains or searching through machines within the subnet of the monitoring host, or otherwise. The devices to be monitored can include any of the devices described herein, including those described above with respect to FIG. 1 and those described below.
The system can verify any relevant software or hardware prerequisites on the devices to be monitored (215). For example, in implementations using agent-based monitoring, when monitoring Windows PCs, the agent can use Microsoft PowerShell scripts on the local machine to collect data, and some of these scripts require PowerShell version 2.0 or later. The system can validate whether or not the appropriate software version is present on each device to be monitored through a remote WMI query against that machine. This step may not be necessary for agentless monitoring approaches, as the mechanism for data collection may be an integral part of the system.
The system evaluates system resource usage on each device to be monitored to ensure that the monitoring will not push it beyond acceptable thresholds (220). Useful resources to check include, but are not limited to, CPU, memory and disk space. A threshold can be selected for each resource checked (e.g., all validated resource usage should be below 80%). This can be used to help make the user recommendation described herein. Again, in the example of a risk manager looking at a Windows PC, this data can be collected via remote WMI queries.
The system evaluates security prerequisites on the connected devices (225). These might include checking firewall settings on each device and validating that the monitoring process is running from an account that is recognized and has sufficient privileges on the end device. This process can also include receiving credentials from a user or sending credentials to the connected devices.
The system provides recommendations to the user as to whether or not they should proceed with the monitoring (230). If a device fails hardware, software or security prerequisite checks, the user can be advised that monitoring may not work correctly (or at all), and provide steps that need to be taken on the end device. If a device fails resource checks, the user can be advised of possible system instability if they proceed with monitoring. The recommendations can be displayed to a user, transmitted to a user device, or otherwise.
As part of providing recommendations, the system can also offer some level of enforcement of the recommendations. Possible levels of enforcement include:
a. No enforcement--The user is presented with the information gathered by the system, but uses that information to decide how to proceed with no further restriction from the system.
b. "Soft" enforcement--The user is presented with a recommendation for each device, and the option whether or not to proceed for a given device is preselected. The user can still override that selection (they may be presented with a warning message that they must acknowledge first).
c. "Hard" enforcement--The user is presented with a recommendation for each device, but cannot proceed with monitoring on any device that does not pass the system checks.
The system can provide the recommendations by means of a notification, such as by email, SMS, OPC, system center, or otherwise.
The steps in the processes described herein, unless specifically described otherwise, may be performed concurrently, sequentially, or repeatedly, may be omitted, or may be performed in a different order.
FIG. 3 illustrates a user interface 300 that may be presented to a user, for example by the risk manager 154 or another system, for interacting with a user as part of processes described herein. This figure illustrates a device configuration 302, showing a plurality of connected devices 304 that have been identified by the system. Also shown is an "add new devices" button 306; when a user selects this button, the system will receive new device information from the user either manually or via a wizard. Devices 304 can be automatically discovered and added by the system. Devices can be added manually by the user, for example by entering such information as an IP address, an SNMP community string, or others.
FIG. 4 illustrates a user interface 400 that may be presented to a user, for example by the risk manager 154 or another system, for interacting with a user as part of processes described herein. This figure illustrates an interface to add new devices, either manually or by automatic discovery by the system of PCs, network devices, or other connected devices. Similar techniques can be used to delete a connected device from the monitoring list.
FIG. 5 illustrates a user interface 500 that may be presented to a user, for example by the risk manager 154 or another system, for interacting with a user as part of processes described herein. This figure illustrates an interface for determining devices to monitor 502, in this case by receiving a selection from a user.
FIG. 6 illustrates a user interface 600 that may be presented to a user, for example by the risk manager 154 or another system, for interacting with a user as part of processes described herein. This figure illustrates an interface for evaluating resources of the devices to be monitored, such as CPU usage 602, physical memory usage 604, and disk space usage 606.
FIG. 7 illustrates a user interface 700 that may be presented to a user, for example by the risk manager 154 or another system, for interacting with a user as part of processes described herein. This figure illustrates an interface for providing credentials to install or deploy an agent on a connected device. A similar interface can be used to provide credentials to remove an agent from a connected device. This figure also illustrates an example of recommendations 702 that are provided to a used as to whether or not the user should proceed with the monitoring, based on the evaluation, including specific actions that are recommended to be taken or not taken (such as installing an agent or adding firewall exceptions).
FIG. 8 illustrates a user interface 800 that may be presented to a user, for example by the risk manager 154 or another system, for interacting with a user as part of processes described herein. This figure illustrates an interface for showing results of adding new devices and installing or deploying an agent on the connected devices.
Note that the risk manager 154 and/or the other processes, devices, and techniques described herein could use or operate in conjunction with any combination or all of various features described in the following previously-filed patent applications (all of which are hereby incorporated by reference): U.S. patent application Ser. No. 14/482,888 entitled "DYNAMIC QUANTIFICATION OF CYBER-SECURITY RISKS IN A CONTROL SYSTEM"; U.S. Provisional Patent Application No. 62/036,920 entitled "ANALYZING CYBER-SECURITY RISKS IN AN INDUSTRIAL CONTROL ENVIRONMENT"; U.S. Provisional Patent Application No. 62/113,075 entitled "RULES ENGINE FOR CONVERTING SYSTEM-RELATED CHARACTERISTICS AND EVENTS INTO CYBER-SECURITY RISK ASSESSMENT VALUES" and corresponding non-provisional U.S. patent application Ser. No. 14/871,695; U.S. Provisional Patent Application No. 62/113,221 entitled "NOTIFICATION SUBSYSTEM FOR GENERATING CONSOLIDATED, FILTERED, AND RELEVANT SECURITY RISK-BASED NOTIFICATIONS" and corresponding non-provisional U.S. patent application Ser. No. 14/871,521; U.S. Provisional Patent Application No. 62/113,100 entitled "TECHNIQUE FOR USING INFRASTRUCTURE MONITORING SOFTWARE TO COLLECT CYBER-SECURITY RISK DATA" and corresponding non-provisional U.S. patent application Ser. No. 14/871,855; U.S. Provisional Patent Application No. 62/113,186 entitled "INFRASTRUCTURE MONITORING TOOL FOR COLLECTING INDUSTRIAL PROCESS CONTROL AND AUTOMATION SYSTEM RISK DATA" and corresponding non-provisional U.S. patent application Ser. No. 14/871,732; U.S. Provisional Patent Application No. 62/113,165 entitled "PATCH MONITORING AND ANALYSIS" and corresponding non-provisional U.S. patent application Ser. No. 14/871,921; U.S. Provisional Patent Application No. 62/113,152 entitled "APPARATUS AND METHOD FOR AUTOMATIC HANDLING OF CYBER-SECURITY RISK EVENTS" and corresponding non-provisional U.S. patent application Ser. No. 14/871,503; U.S. Provisional Patent Application No. 62/114,928 entitled "APPARATUS AND METHOD FOR DYNAMIC CUSTOMIZATION OF CYBER-SECURITY RISK ITEM RULES" and corresponding non-provisional U.S. patent application Ser. No. 14/871,605; U.S. Provisional Patent Application No. 62/114,865 entitled "APPARATUS AND METHOD FOR PROVIDING POSSIBLE CAUSES, RECOMMENDED ACTIONS, AND POTENTIAL IMPACTS RELATED TO IDENTIFIED CYBER-SECURITY RISK ITEMS" and corresponding non-provisional U.S. patent application Ser. No. 14/871,814; and U.S. Provisional Patent Application No. 62/114,937 entitled "APPARATUS AND METHOD FOR TYING CYBER-SECURITY RISK ANALYSIS TO COMMON RISK METHODOLOGIES AND RISK LEVELS" and corresponding non-provisional U.S. patent application Ser. No. 14/871,136; and U.S. Provisional Patent Application No. 62/116,245 entitled "RISK MANAGEMENT IN AN AIR-GAPPED ENVIRONMENT" and corresponding non-provisional U.S. patent application Ser. No. 14/871,547.