Source: http://patents.com/us-10021119.html
Timestamp: 2018-11-17 08:37:19
Document Index: 732715249

Matched Legal Cases: ['Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62']

US Patent # 1,002,1119. Apparatus and method for automatic handling of cyber-security risk events - Patents.com
United States Patent 10,021,119
Carpenter , et al. July 10, 2018
This disclosure provides an apparatus and method for automatic handling of cyber-security risk events and other risk events. A method includes detecting, by a monitoring system, a first event associated with a device in a computing system. The method includes initializing a risk item corresponding to the first event, and setting the risk item to a full risk value, in response to detecting the event. The method includes determining whether a second event, corresponding to the first event, has been detected. The method includes altering the risk value over time in response to determining that no second event has been detected. The method includes determining if the risk value for the risk item has passed a threshold. The method includes clearing the event in response to the risk value passing the threshold.
Carpenter; Seth G. (Phoenix, AZ), Dietrich; Kenneth W. (Glendale, AZ)
Family ID: 56564565
14/871,503
US 20160234229 A1 Aug 11, 2016
62113152 Feb 6, 2015
Current CPC Class: H04L 63/1416 (20130101); H04L 63/1433 (20130101)
7984504 July 2011 Hernacki
8621637 December 2013 Al-Harbi et al.
8726393 May 2014 Macy et al.
8769412 July 2014 Gill et al.
8856936 October 2014 Datta Ray et al.
9166999 October 2015 Kulkarni et al.
9373267 June 2016 Sadeh-Koniecpol et al.
2002/0161877 October 2002 Stevenson
2006/0064740 March 2006 Kelley
2007/0157195 July 2007 Gaa-Frost
2009/0106701 April 2009 Yalamanchi
2011/0270791 November 2011 Bester
2013/0135118 May 2013 Ricci
2013/0185191 July 2013 Ganor
2013/0204783 August 2013 Klose
2014/0297495 October 2014 Dalai et al.
2014/0359777 December 2014 Lam
2015/0264061 September 2015 Ibatullin
2016/0173359 June 2016 Brenner
2017/0235848 August 2017 Van Dusen
"Risk Management and Critical Infrastructure Protection: Assessing, Integrating, and Managing Threats, Vulnerabilities and Consequences"; CRS Rpt for Congress; RL32561; Feb. 4, 2005; 28 pages. cited by applicant .
Marshall, R., "Guest Post: How to Configure Alerts in System Center 2012," https://blogs.technet.microsoft.com/uktechnet/2013/04/08/guest-post-how-t- o-configure-alerts-in-system-center-2012/, Apr. 8, 2013, 9 pages. cited by applicant .
"Configuring Symantec Vulnerability Assessment 1.0 for Network Audits," TECH111985, https://support.symantec.com/en_US/article.TECH111985.html, Jan. 16, 2003, 6 pages. cited by applicant .
U.S. Appl. No. 14/871,695, Non-Final Office Action dated Dec. 16, 2016, 11 pages. cited by applicant .
U.S. Appl. No. 14/705,379, Non-Final Office Action dated Feb. 7, 2017, 7 pages. cited by applicant .
Foreign Communication From a Related Counterpart Application, PCT Application No. PCT/US2016/028553, International Search Report and Written Opinion dated Apr. 21, 2016, 10 pages. cited by applicant.
Primary Examiner: Shepperd; Eric W
This application claims the benefit of the filing date of U.S. Provisional Patent Application 62/113,152, filed Feb. 6, 2015, which is hereby incorporated by reference.
1. A method comprising: detecting, by a monitoring system, a first event associated with a device in a computing system; in response to detecting the event, initializing a risk item corresponding to the first event, by the monitoring system, and setting the risk item to a full risk value; determining, by the monitoring system, whether a second event, corresponding to the first event, has been detected, wherein the second event corresponds to the first event when the second event is a repeat of the first event, is a same type of event as the first event, or is generated by a same process, system, or device as the first event; in response to determining, by the monitoring system, that no second event has been detected, reducing the risk value over time; in response to determining, by the monitoring system, that multiple corresponding second events have been detected, increasing the risk value to value that is greater than the full risk value; altering, by the monitoring system, when no second event has been detected, the risk value by reducing the risk value according to a decay function wherein the decay function is defined as: For t<P:Risk=R*(1-(t/P)) For t>=P:Risk=0, where Risk represents an adjusted risk value, R represents the full risk value, P represents a decay period of time, and t represents an amount of time that has passed since the first event occurred was detected; determining, by the monitoring system, if the risk value for the risk item has passed a threshold; and clearing the event, by the monitoring system, in response to the risk value passing the threshold.
2. The method of claim 1, further comprising storing event details for the first event.
3. The method of claim 1, further comprising, in response to determining that a single second event has been detected, not altering the risk value.
4. The method of claim 1, wherein, the risk value that is greater than the full risk value indicates a significant ongoing risk.
5. The method of claim 1, further comprising displaying an alert that indicates the risk item and the risk value.
6. The method of claim 1, wherein a user specifies whether the second event is the repeat of the first event, is the same type of event as the first event, or is generated by the same process system, or device as the first event.
7. A monitoring system, further comprising: a processing device; a memory; and a network interface, wherein the processing device is configured to: detect a first event associated with a device in a computing system; in response to detecting the event, initialize a risk item corresponding to the first event and set the risk item to a full risk value; determine whether a second event, corresponding to the first event, has been detected, wherein the second event corresponds to a first event when the second event is a repeat of the first event, is a same type of event as the first event, or is generated by a same process, system, or device as the first event; in response to determining that no second event has been detected, alter the risk value over time; in response to determining that no second event has been detected, increase the risk value to a value that is greater than the full risk value; altering, by the monitoring system, when no second event has been detected, the risk value by reducing the risk value according to a decay function wherein the decay function is defined as: For t<P:Risk=R*(1-(t/P)) For t>=P:Risk=0, where Risk represents an adjusted risk value, R represents the full risk value, P represents a decay period of time, and t represents an amount of time that has passed since the first event occurred was detected; determine if the risk value for the risk item has passed a threshold; and clear the event in response to the risk value passing the threshold.
8. The monitoring system of claim 7, wherein the monitoring system also stores event details for the first event.
9. The monitoring system of claim 7, wherein, in response to determining that a single second event has been detected, the monitoring system does not alter the risk value.
10. The monitoring system of claim 7, wherein, the risk value that is greater than the full risk value indicates a significant ongoing risk.
11. The monitoring system of claim 7, wherein the monitoring system displays an alert that indicates the risk item and the risk value.
12. A non-transitory computer-readable medium encoded with computer readable program code that, when executed, causes a monitoring system to: detect a first event associated with a device in a computing system; in response to detecting the event, initialize a risk item corresponding to the first event and set the risk item to a full risk value; determine whether a second event, corresponding to the first event, has been detected, wherein the second event corresponds to the first event when the second event is a repeat of the first event, is a same type of event as the first event, or is generated by a same type of event as the first event, or is generated by same process, system, or device as the first event; in response to determining that no second event has been detected, alter the risk value over time; in response to determining that multiple corresponding second events have been detected, increase the risk value to a value that is greater than the full risk value; executing by the computer readable program code, when no second event has been detected, to reduce the risk value by reducing the risk value according to a decay function wherein the decay function is defined as: For t<P:Risk=R*(1-(t/P)) For t>=P:Risk=0, where Risk represents an adjusted risk value, R represents the full risk value, P represents a decay period of time, and t represents an amount of time that has passed since the first event occurred was detected; determine if the risk value for the risk item has passed a threshold; and clear the event in response to the risk value passing the threshold.
13. The non-transitory computer-readable medium of claim 12, wherein the monitoring system also stores event details for the first event.
14. The non-transitory computer-readable medium of claim 12, wherein, in response to determining that the second event has been detected, the monitoring system does not alter the risk value.
15. The non-transitory computer-readable medium of claim 12, wherein, in response to determining that multiple second events have been detected, the monitoring system alters the risk value to a value that indicates a significant ongoing risk.
This disclosure relates generally to network security. More specifically, this disclosure relates to an apparatus and method for automatic handling of cyber-security risk events.
FIG. 1 illustrates an example industrial process control and automation system according to this disclosure; and
FIG. 2 illustrates an example method for automatic handling of cyber-security risk events according to this disclosure.
As noted above, cyber-security is of increasing concern with respect to industrial process control and automation systems. Unaddressed security vulnerabilities in any of the components in the system 100 could be exploited by attackers to disrupt operations or cause unsafe conditions in an industrial facility. However, in many instances, operators do not have a complete understanding or inventory of all equipment running at a particular industrial site. As a result, it is often difficult to quickly determine potential sources of risk to a control and automation system.
Moreover, process control engineers are typically tasked with keeping industrial processes running smoothly, and new products often introduce new maintenance and administration tasks to their already heavy workload. Cyber-security risk management is no different in that, although risk management information helps users to secure a system, it also introduces the users to a new (possibly constant) stream of information.
Disclosed embodiments include solutions that evaluate potential vulnerabilities in various systems, prioritize the vulnerabilities based on risk to an overall system, and guide a user to mitigate the vulnerabilities. This is accomplished, in some embodiments, using a risk manager 154. Risk manager 154 can be implemented using, for example operator station 116, operator station 124, operator station 132, operator station 140, or other controller or data processing system configured to interact with the elements of system 100. Each operator station discussed herein can include such structural elements as one or more processors or controllers, a memory, a non-volatile storage device such as a hard drive or otherwise, displays, user input devices such as keyboards, mice, or touchscreens, and wireless or wired communication interfaces.
Among other things, the risk manager 154 balances providing useful cyber-security information to a user with minimizing the user's required tasks. The risk manager 154 includes any suitable structure that supports automatic handling of cyber-security risk events. In this example, the risk manager 154 includes one or more processing devices 156; one or more memories 158 for storing instructions and data used, generated, or collected by the processing device(s) 156; and at least one network interface 160 that can be implemented as a wired or wireless interface. Each processing device 156 could represent a microprocessor, microcontroller, digital signal processor, field programmable gate array, application specific integrated circuit, or discrete logic. Each memory 158 could represent a volatile or non-volatile storage and retrieval device, such as a random access memory or Flash memory. Each network interface 160 could represent an Ethernet interface, wireless transceiver, or other device facilitating external communication. The functionality of the risk manager 154 could be implemented using any suitable hardware or a combination of hardware and software/firmware instructions.
In some embodiments, there are two types of risk items that can be reported to users: status items and events. Status items denote risk items that have definite states (such as on/off, enabled/disabled, or installed/not installed) and are often easier to manage. For example, if in a bad state, such as a fault state, failure, or other state that indicates that a process or device is not behaving normally, a status item may stay active in the risk manager 154 until the underlying cause is addressed. As a particular example, if tracking whether or not antivirus software is running on a system or controller disclosed herein, the risk manager 154 can track the services that the antivirus program uses. If the services are running and healthy, it is not considered a risk; if they are not running, a risk is indicated and the status item stays active until the services are running again.
Events denote risk items that identify the occurrence of particular conditions or actions, which are typically harder for users to manage. Events typically have a start time or other time when the event occurred, but may not provide any indication whether an underlying condition has cleared or a clear condition may simply not exist. An example event is an authentication failure, such as when someone provides an incorrect password during a login. An operator could see a notification of an authentication failure, but as a one-time event it does not "clear" like a status item typically would.
In traditional event management systems, events need to be acknowledged manually by an authorized user if the user is to be effectively alerted at all, since the event is typically transient. To avoid the need to acknowledge events manually, in accordance with disclosed embodiments, the risk manager 154 allows a risk value associated with an event or other risk item to decay over time if it does not reoccur. If the event does reoccur, the risk value can jump back to a base value, and the decay period can begin again. If an event occurs frequently or continuously, risk manager 154 can consider and respond to such a condition, such as by raising the risk value above the starting base value.
By allowing certain events to decay, intermittent events can show up long enough for users of a system to see the events, but the users may need to take no additional steps to clear the events. More serious events by their nature can continue to occur and will not be cleared. To return to the authentication failure example, a person mistyping a password a few times could appear as several isolated events that do not reoccur and are soon cleared. However, a brute-force attack on a system (where an attacker attempts to use many different passwords in quick succession hoping to "guess" the correct password) could be seen as a constant stream of events that remain active until the attack is addressed in some way.
One disclosed implementation of the decay function uses a linear decay model. Note that other decay models, such as exponential decay, can also be used in various embodiments. In the linear decay model, a base risk score is denoted R, a decay period is denoted P, and an amount of time that has passed since an event occurred is denoted t. An instantaneous risk value can be calculated as a function of t with a piecewise function, such as: For t<P:Risk=f(t)=R*(1-(t/P)) For t>=P:Risk=f(t)=0 The value of P is carefully chosen--if it is too long, events can build up and clutter user visibility; if it is too short, an event could occur a single time and disappear before being seen by a user. In some embodiments, various steps could be taken to help with this issue. For instance, a default decay period could be set to a relatively long period of time (such as three days) so that events occurring over a weekend would still be active on the first day of the work week. Also, users could customize decay periods to values appropriate for their particular policies.
FIG. 2 illustrates an example of an event processing and decay process in accordance with disclosed embodiments, as performed by a risk manager, operator station, or other controller, computing system, or data processing system configured to perform processes as described herein, referred to generically as the "monitoring system" below, where a processing device of the monitoring system is configured to perform each of the actions described below. Method 200 can automatically handle of cyber-security risk events according to this disclosure. Among other operations, the risk manager 154 can identify cyber-security threats and issues associated with a control and automation system 100, and the risk manager 154 can generate notifications to users in one or various forms, including but not limited to an alert display, reports, emails, text messages, alerts, and others. While the risk manager 154 can provide a significant amount of new information about cyber-security risks to a system, the risk manager 154 also represents another information source for users to manage.
The monitoring system detects a first event (205). The first event can be any occurrence of a particular condition or action for which an operator or other user should be alerted, including specifically (but not limited to) system-security events such as failed login or other authorization attempts, unauthorized software execution attempts, network intrusion attempts, and others, and the first event is generally associated with a specific device with which the monitoring system is in communication. This can include obtaining information identifying the first event, where the first event is associated with a device in a computing system and identifies a cyber-security risk associated with the device.
The monitoring system can store the event details for the first event (210). Event details can include, for example, the type of event, the time and date of the event, the result of the event (including any monitoring system response, etc.), the system, device, or component that generated the event, any other information identifying the first event, or any other details that would be informative to the operator.
In response to detecting the first event, the monitoring system initializes a risk item corresponding to the first event and sets the risk item to a full risk value (215). The full risk value can be any value that is understood to represent a "full risk" of a new event, such as 100. As part of 215, the monitoring system can also display an alert or send a notification as described herein, indicating the risk item and its risk value or any other event details. This can include defining a risk value associated with the first event, where the first event remains active until the risk value passes a threshold as described herein.
The monitoring system determines if a second event (or further event), corresponding to the first event, has been detected (220). The second event can correspond to the first event by, for example, being a repeat of the first event, being of the same type of event as the first event (e.g., a second, but not identical, failed login attempt), being generated by the same process, system, or device as the first event, or otherwise, which can be selected or specified by the user. If such a second corresponding event is detected, the process returns to 210, processing the second event as it did the first event. In some embodiments, if multiple second (or further) events corresponding to the first event are detected, the system can alter the risk value to a value that indicates a significant ongoing risk, for example a value that is higher than the full risk value.
The monitoring system alters the risk value over time. For example, if no second event is detected, the monitoring system reduces the risk value according to a decay function as described herein (225). As part of 215, the monitoring system can also display an alert or send a notification as described herein, indicating the risk item and its reduced risk value or any other event details. The risk-value reduction can take place at specified intervals (e.g., once per hour) so that the risk value is gradually reduced over a predetermined time period (e.g., three days).
The monitoring system determines if the risk value for the risk item has reached or passed zero (or other predetermined threshold) (230). If not, the process returns to 220 to continue to detect events.
In response to determining that the risk value for the risk item has reached or passed zero or other predetermined threshold, then the monitoring system clears the risk item from the monitoring system (235). As part of 235, the monitoring system can also display an alert or send a notification as described herein, indicating the risk item and its risk value or any other event details, and indicating that the risk item has been cleared.
Of course, the process described with respect to the example of FIG. 2 is for a single event and its corresponding events, where typical implementations will be processing many events at the same time. In such cases, each new event is processed at 220 for any number of previously-detected first events to find a "match" where the new event corresponds to a previously-detected first event.
In some embodiments, a web-based application programming interface (API) can be used to support the event decay process illustrated in FIG. 2. In these embodiments, a configuration file for the API can be used to define various fields related to the decay algorithm that can be used to obtain input from users. For example, in particular embodiments, the following items could be defined in the configuration file: SecurityEventCacheAbsolutePeriodSeconds--an absolute expiration period in seconds; SecurityEventCacheSlidingPeriodSeconds--a sliding expiration period in seconds; SecurityEventCacheExpirationPolicy--the expiration policy to use (such as Sliding or Absolute); and SecurityEventCacheForceEventDecay--a flag indicating whether to force the decay (RiskFactor set to zero) of a security status event when it expires.
Although FIG. 2 illustrates one example of method 200 for automatic handling of cyber-security risk events, various changes may be made to FIG. 2. For example, various steps shown in FIG. 2 could overlap, occur in parallel, occur in a different order, or occur any number of times. Also, while not shown, an additional loop in the method 200 could be used to increase the risk value if an event occurs repeatedly (such as more than a threshold number of times or at more than a threshold frequency). In addition, the threshold value of "0" in FIG. 2 is for illustration only, and any other suitable threshold value(s) could be used (including different thresholds for different types of events).
Note that the risk manager 154 here could use or operate in conjunction with any combination or all of various features described in the following previously-filed and concurrently-filed patent applications (all of which are hereby incorporated by reference): U.S. patent application Ser. No. 14/482,888 entitled "DYNAMIC QUANTIFICATION OF CYBER-SECURITY RISKS IN A CONTROL SYSTEM"; U.S. Provisional Patent Application No. 62/036,920 entitled "ANALYZING CYBER-SECURITY RISKS IN AN INDUSTRIAL CONTROL ENVIRONMENT"; U.S. Provisional Patent Application No. 62/113,075 entitled "RULES ENGINE FOR CONVERTING SYSTEM-RELATED CHARACTERISTICS AND EVENTS INTO CYBER-SECURITY RISK ASSESSMENT VALUES" and corresponding non-provisional U.S. patent application Ser. No. 14/871,695 of like title filed concurrently herewith; U.S. Provisional Patent Application No. 62/113,221 entitled "NOTIFICATION SUBSYSTEM FOR GENERATING CONSOLIDATED, FILTERED, AND RELEVANT SECURITY RISK-BASED NOTIFICATIONS" and corresponding non-provisional U.S. patent application Ser. No. 14/871,521 of like title filed concurrently herewith; U.S. Provisional Patent Application No. 62/113,100 entitled "TECHNIQUE FOR USING INFRASTRUCTURE MONITORING SOFTWARE TO COLLECT CYBER-SECURITY RISK DATA" and corresponding non-provisional U.S. patent application Ser. No. 14/871,855 of like title filed concurrently herewith; U.S. Provisional Patent Application No. 62/113,186 entitled "INFRASTRUCTURE MONITORING TOOL FOR COLLECTING INDUSTRIAL PROCESS CONTROL AND AUTOMATION SYSTEM RISK DATA" and corresponding non-provisional U.S. patent application Ser. No. 14/871,732 of like title filed concurrently herewith; U.S. Provisional Patent Application No. 62/113,165 entitled "PATCH MONITORING AND ANALYSIS" and corresponding non-provisional U.S. patent application Ser. No. 14/871,921 of like title filed concurrently herewith; U.S. Provisional Patent Application No. 62/114,928 entitled "APPARATUS AND METHOD FOR DYNAMIC CUSTOMIZATION OF CYBER-SECURITY RISK ITEM RULES" and corresponding non-provisional U.S. patent application Ser. No. 14/871,605 of like title filed concurrently herewith; U.S. Provisional Patent Application No. 62/114,865 entitled "APPARATUS AND METHOD FOR PROVIDING POSSIBLE CAUSES, RECOMMENDED ACTIONS, AND POTENTIAL IMPACTS RELATED TO IDENTIFIED CYBER-SECURITY RISK ITEMS" and corresponding non-provisional U.S. patent application Ser. No. 14/871,814 of like title filed concurrently herewith; U.S. Provisional Patent Application No. 62/114,937 entitled "APPARATUS AND METHOD FOR TYING CYBER-SECURITY RISK ANALYSIS TO COMMON RISK METHODOLOGIES AND RISK LEVELS" and corresponding non-provisional U.S. patent application Ser. No. 14/871,136 of like title filed concurrently herewith; and U.S. Provisional Patent Application No. 62/116,245 entitled "RISK MANAGEMENT IN AN AIR-GAPPED ENVIRONMENT" and corresponding non-provisional U.S. patent application Ser. No. 14/871,547 of like title filed concurrently herewith.
Previous Patent US 10,021,118 | Next Patent US 10,021,120