Source: https://patents.google.com/patent/US20160234243A1/en
Timestamp: 2019-09-15 09:01:10
Document Index: 409123563

Matched Legal Cases: ['Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62', 'Application No. 62']

US20160234243A1 - Technique for using infrastructure monitoring software to collect cyber-security risk data - Google Patents
Technique for using infrastructure monitoring software to collect cyber-security risk data Download PDF
US20160234243A1
US20160234243A1 US14/871,855 US201514871855A US2016234243A1 US 20160234243 A1 US20160234243 A1 US 20160234243A1 US 201514871855 A US201514871855 A US 201514871855A US 2016234243 A1 US2016234243 A1 US 2016234243A1
US14/871,855
Venkata Srinivasulu Reddy Talamanchi
Eric T. Boice
Ganesh P. Gadhe
Kenneth W. Dietrich
Andrew W. Kowalczyk
2015-02-06 Priority to US201562113100P priority Critical
2015-09-30 Application filed by Honeywell International Inc filed Critical Honeywell International Inc
2015-09-30 Priority to US14/871,855 priority patent/US20160234243A1/en
2015-09-30 Assigned to HONEYWELL INTERNATIONAL INC. reassignment HONEYWELL INTERNATIONAL INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: TALAMANCHI, Venkata Srinivasulu Reddy, GADHE, Ganesh P., BOICE, Eric T., KOWALCZYK, ANDREW W., DIETRICH, KENNETH W.
2016-08-11 Publication of US20160234243A1 publication Critical patent/US20160234243A1/en
238000000034 methods Methods 0 Abstract Description Title 35
230000002155 anti-virotic Effects 0 Claims Description 6
239000003795 chemical substance by application Substances 0 Claims Description 22
230000002265 prevention Effects 0 Claims Description 6
238000004801 process automation Methods 0 Description 5
This disclosure provides a technique for using infrastructure monitoring software to collect cyber-security risk data. A method includes sending first information from a risk manager system to a plurality of agents each associated with a respective device in a computing system. The first information is associated with one or more risk-monitoring configurations. The method includes receiving second information by the risk manager system from the agents. The second information identifies identified vulnerabilities and events associated with the respective devices. The method includes storing and displaying to a user at least one of the second information and an analysis of the second information.
This application claims the benefit of the filing date of U.S. Provisional Patent Application 62/113,100, filed Feb. 6, 2015, which is hereby incorporated by reference.
This disclosure relates generally to network security. More specifically, this disclosure relates to a technique for using infrastructure monitoring software to collect cyber-security risk data.
This disclosure provides a technique for using infrastructure monitoring software to collect cyber-security risk data, including methods and corresponding systems and machine-readable media. A method includes sending first information from a risk manager system to a plurality of agents each associated with a respective device in a computing system. The first information is associated with one or more risk-monitoring configurations. The method includes receiving second information by the risk manager system from the agents. The second information identifies identified vulnerabilities and events associated with the respective devices. The method includes storing and displaying to a user at least one of the second information and an analysis of the second information.
FIG. 2 illustrates an example architecture supporting a technique for using infrastructure monitoring software to collect cyber-security risk data according to this disclosure; and
FIG. 3 illustrates a flowchart of a process in accordance with disclosed embodiments.
In the networking world, security is a primary concern, and numerous solutions are available to secure servers, workstations, switches, routers, and firewalls on a network. For example, there are various solutions supporting functions such as:
Threat, malware, and virus detection
Network device monitoring (such as for switches and routers)
Up-to-date software patching
Solutions such as these can be used to help secure systems and devices all over the world. However, there is currently no mechanism to collect data from these various software tools in order to provide a high-level view of an entire network. Instead, administrators have to monitor these multiple software tools on different systems to secure a network. A software tool that can collect data from various systems, monitor an entire network, and provide data that indicates the health of the entire network would be very useful. This disclosure provides a risk manager 154 supporting such a software tool.
The risk manager 154 includes any suitable structure that supports a technique for using infrastructure monitoring software to collect cyber-security risk data. Here, the risk manager 154 includes one or more processing devices 156; one or more memories 158 for storing instructions and data used, generated, or collected by the processing device(s) 156; and at least one network interface 160. Each processing device 156 could represent a microprocessor, microcontroller, digital signal process, field programmable gate array, application specific integrated circuit, or discrete logic. Each memory 158 could represent a volatile or non-volatile storage and retrieval device, such as a random access memory or Flash memory. Each network interface 160 could represent an Ethernet interface, wireless transceiver, or other device facilitating external communication. The functionality of the risk manager 154 could be implemented using any suitable hardware or a combination of hardware and software/firmware instructions.
FIG. 2 illustrates an example architecture 200 supporting a technique for using infrastructure monitoring software to collect cyber-security risk data according to this disclosure. The architecture 200 could be supported or implemented using the risk manager 154. This architecture 200 supports a technique for using infrastructure monitoring software to collect cyber-security risk data.
Architecture 200 includes, in this example, a server 210, network nodes 220, a rules engine 230, monitoring nodes 240, and a user system 250. Server 210 can be implemented as risk manager 154, or as another server data processing system, having such hardware components as a processing device(s), memory, and a network interface. User system 250, similarly, can be any data processing system configured to communicate with server 210 as described herein, and in particular for configuring the processes described herein, and can be also be implemented as risk manager 154. Note that user system 250, in some embodiments, can be implemented on the same physical system as server 210.
Server 210, for example as executed by the risk manager 154, collects various data from monitoring nodes 240, such as data from antivirus tools or application whitelisting tools, Windows security events, network security data (including states of switches, routers, firewalls, and intrusion detection/prevention systems), backup status, patching status, and asset policies. Other examples are shown as monitoring nodes 240, including workstations, whitelisting servers, antivirus systems, backup servers, and other security software. Similarly, network nodes 220 can also be monitored. Network nodes 220 can include switches, routers, intrusion prevention systems (IPSes) including firewalls, and other network devices, whether implemented in hardware or software.
To start monitoring the monitoring nodes 240, a configuration can be loaded into and received by server 210, such as by receiving it from user system 250, loading it from storage, receiving it from another device or process, or otherwise. This configuration can be pushed to respective agents 242 (denoted “A” in FIG. 2, label 242 not shown for each agent) on the monitoring nodes 240 or network nodes 220 by server 210. Both the agents 242 and the server 210 know about configuration categories, and each type and subtype of data collection can have its own category identifier. Agents 242 scan devices for known vulnerabilities on each device or software application (such as out-of-date Windows patches) and monitor the devices continuously for events with security implications (such as virus detections or Windows authentication failures). Areas of monitoring may include, but are not limited to, antivirus, application whitelisting, Windows security events, network security (including state of switches, routers, firewalls, and intrusion detection/prevention systems), backup status, patching status and asset policies. Each agent 242 translates events generated on its device into alerts and assigns its configuration identifier.
Server 210 can collect or receive this information from each agent 242, analyze the information, and present the information and the analysis results to an operator (such as an administrator), store the information and results, or transmit them to a user system 250.
In various embodiments, rules engine 230 uses data adapters 232 to translate data to and from each of the agents 242, as necessary, so that the appropriate data can be sent to each agent 242, and so that the data received from each agent 242 can be converted into a consistent format for use by server 210. By converting data into a consistent format, rules engine 154 can present a “dashboard” user interface by which the relative risks from each of the monitored nodes can be easily compared.
Disclosed embodiments can be implemented, in some embodiments, on top of infrastructure monitoring tools such as the System Center Operations Manager (SCOM) infrastructure monitoring software tool from MICROSOFT CORPORATION. Disclosed embodiments can provide an infrastructure for collecting risk data from agents and for pushing custom configurations in the form of management packs. The data collected by SCOM, as modified or used as disclosed herein, can be stored in an SCOM database called the Operations Manager database. The data in the Operations Manager database can be read using SQL or the MOM (Microsoft Operations Manager) Application Program Interface (API).
Although FIG. 2 illustrates one example of an architecture 200 supporting a technique for using infrastructure monitoring software to collect cyber-security risk data, various changes may be made to FIG. 2. For example, the functional division of the components and sub-component in FIG. 2 are for illustration only. Various components or sub-components could be combined, further subdivided, rearranged, or omitted and additional components or sub-components could be added according to particular needs.
FIG. 3 illustrates a flowchart of a process 300 in accordance with disclosed embodiments, that can be performed, for example, by risk manager 154, architecture 200, or other device configured to perform as described, referred to generically as the “risk manager system” below.
The risk manager system receives one or more risk-monitoring configurations (305).
The risk manager system sends first information to agents associated with multiple devices in a computing system, where the first information is associated with one or more of the risk-monitoring configurations (310). As part of this process, the risk manager system can translate the one or more risk-monitoring configurations into the first information according to the requirements of the respective devices.
The risk manager system receives second information from the respective agents (315), where the second information identifies identified vulnerabilities and events associated with the devices. As a part of this process, the system can translate the second information into a consistent format from the formats of the respective devices.
The risk manager system stores and displays at least one of the second information and an analysis of the second information to a user (320).
Note that the risk manager 154 and/or the architecture 200 shown here could use or operate in conjunction with any combination or all of various features described in the following previously-filed and concurrently-filed patent applications (all of which are hereby incorporated by reference):
U.S. Provisional Patent Application No. 62/113,075 entitled “RULES ENGINE FOR CONVERTING SYSTEM-RELATED CHARACTERISTICS AND EVENTS INTO CYBER-SECURITY RISK ASSESSMENT VALUES” and corresponding non-provisional U.S. patent application Ser. No. ______ of like title (Docket No. H0048932-0115) filed concurrently herewith;
U.S. Provisional Patent Application No. 62/113,221 entitled “NOTIFICATION SUBSYSTEM FOR GENERATING CONSOLIDATED, FILTERED, AND RELEVANT SECURITY RISK-BASED NOTIFICATIONS” and corresponding non-provisional U.S. patent application Ser. No. ______ of like title (Docket No. H0048937-0115) filed concurrently herewith;
U.S. Provisional Patent Application No. 62/113,186 entitled “INFRASTRUCTURE MONITORING TOOL FOR COLLECTING INDUSTRIAL PROCESS CONTROL AND AUTOMATION SYSTEM RISK DATA” and corresponding non-provisional U.S. patent application Ser. No. ______ of like title (Docket No. H0048945-0115) filed concurrently herewith;
U.S. Provisional Patent Application No. 62/113,165 entitled “PATCH MONITORING AND ANALYSIS” and corresponding non-provisional U.S. patent application Ser. No. ______ of like title (Docket No. H0048973-0115) filed concurrently herewith;
U.S. Provisional Patent Application No. 62/113,152 entitled “APPARATUS AND METHOD FOR AUTOMATIC HANDLING OF CYBER-SECURITY RISK EVENTS” and corresponding non-provisional U.S. patent application Ser. No. ______ of like title (Docket No. H0049067-0115) filed concurrently herewith;
U.S. Provisional Patent Application No. 62/114,928 entitled “APPARATUS AND METHOD FOR DYNAMIC CUSTOMIZATION OF CYBER-SECURITY RISK ITEM RULES” and corresponding non-provisional U.S. patent application Ser. No. ______ of like title (Docket No. H0049099-0115) filed concurrently herewith;
U.S. Provisional Patent Application No. 62/114,865 entitled “APPARATUS AND METHOD FOR PROVIDING POSSIBLE CAUSES, RECOMMENDED ACTIONS, AND POTENTIAL IMPACTS RELATED TO IDENTIFIED CYBER-SECURITY RISK ITEMS” and corresponding non-provisional U.S. patent application Ser. No. ______ of like title (Docket No. H0049103-0115) filed concurrently herewith;
U.S. Provisional Patent Application No. 62/114,937 entitled “APPARATUS AND METHOD FOR TYING CYBER-SECURITY RISK ANALYSIS TO COMMON RISK METHODOLOGIES AND RISK LEVELS” and corresponding non-provisional U.S. patent application Ser. No. ______ of like title (Docket No. H0049104-0115) filed concurrently herewith; and
U.S. Provisional Patent Application No. 62/116,245 entitled “RISK MANAGEMENT IN AN AIR-GAPPED ENVIRONMENT” and corresponding non-provisional U.S. patent application Ser. No. ______ of like title (Docket No. H0049081-0115) filed concurrently herewith.
sending first information from a risk manager system to a plurality of agents each associated with a respective device in a computing system, the first information associated with one or more risk-monitoring configurations;
receiving second information by the risk manager system from the agents, the second information identifying vulnerabilities and events associated with the respective devices; and
storing and displaying to a user at least one of the second information and an analysis of the second information.
2. The method of claim 1, further comprising receiving the risk-monitoring configurations.
3. The method of claim 1, further comprising translating the one or more risk-monitoring configurations into the first information according to requirements of the respective devices.
4. The method of claim 1, further comprising translating the second information into a consistent format from a plurality of formats associated with the respective devices.
5. The method of claim 1, wherein the devices are network nodes, including switches, routers, and intrusion prevention systems.
6. The method of claim 1, wherein the devices are monitoring nodes, including one or more of workstations, whitelisting servers, antivirus systems, backup servers, and other security software.
7. The method of claim 1, wherein the risk manager system includes a rules engine that uses data adapters to translate data to and from each of the agents.
a display, the risk manager system configured to
send first information to a plurality of agents each associated with a respective device in a computing system, the first information associated with one or more risk-monitoring configurations;
receive second information from the agents, the second information identifying vulnerabilities and events associated with the respective devices; and
store and display to a user at least one of the second information and an analysis of the second information.
9. The risk manager system of claim 8, wherein the risk manager system also receives the risk-monitoring configurations.
10. The risk manager system of claim 8, wherein the risk manager system translates the one or more risk-monitoring configurations into the first information according to requirements of the respective devices.
11. The risk manager system of claim 8, wherein the risk manager system translates the second information into a consistent format from a plurality of formats associated with the respective devices.
12. The risk manager system of claim 8, wherein the devices are network nodes, including switches, routers, and intrusion prevention systems.
13. The risk manager system of claim 8, wherein the devices are monitoring nodes, including one or more of workstations, whitelisting servers, antivirus systems, backup servers, and other security software.
14. The risk manager system of claim 8, wherein the risk manager system includes a rules engine that uses data adapters to translate data to and from each of the agents.
15. A non-transitory machine-readable medium encoded with executable instructions that, when executed, cause one or more processors of a risk manager system to:
16. The non-transitory machine-readable medium of claim 15, wherein the risk manager system also receives the risk-monitoring configurations.
17. The non-transitory machine-readable medium of claim 15, wherein the risk manager system translates the one or more risk-monitoring configurations into the first information according to requirements of the respective devices.
18. The non-transitory machine-readable medium of claim 15, wherein the risk manager system translates the second information into a consistent format from a plurality of formats associated with the respective devices.
19. The non-transitory machine-readable medium of claim 15, wherein the devices are network nodes, including switches, routers, and intrusion prevention systems.
20. The non-transitory machine-readable medium of claim 15, wherein the devices are monitoring nodes, including one or more of workstations, whitelisting servers, antivirus systems, backup servers, and other security software.
US14/871,855 2015-02-06 2015-09-30 Technique for using infrastructure monitoring software to collect cyber-security risk data Abandoned US20160234243A1 (en)
US201562113100P true 2015-02-06 2015-02-06
US14/871,855 US20160234243A1 (en) 2015-02-06 2015-09-30 Technique for using infrastructure monitoring software to collect cyber-security risk data
EP16747148.1A EP3254438A4 (en) 2015-02-06 2016-02-03 Technique for using infrastructure monitoring software to collect cyber-security risk data
JP2017541612A JP2018510544A (en) 2015-02-06 2016-02-03 Techniques for collecting cyber security risk data using the infrastructure monitoring software
AU2016215462A AU2016215462A1 (en) 2015-02-06 2016-02-03 Technique for using infrastructure monitoring software to collect cyber-security risk data
CN201680019865.XA CN107431715A (en) 2015-02-06 2016-02-03 Technique for using infrastructure monitoring software to collect cyber-security risk data
PCT/US2016/016265 WO2016126755A1 (en) 2015-02-06 2016-02-03 Technique for using infrastructure monitoring software to collect cyber-security risk data
US20160234243A1 true US20160234243A1 (en) 2016-08-11
ID=56564621
US14/871,855 Abandoned US20160234243A1 (en) 2015-02-06 2015-09-30 Technique for using infrastructure monitoring software to collect cyber-security risk data
US (1) US20160234243A1 (en)
EP (1) EP3254438A4 (en)
JP (1) JP2018510544A (en)
CN (1) CN107431715A (en)
AU (1) AU2016215462A1 (en)
WO (1) WO2016126755A1 (en)
US20060126501A1 (en) * 2004-12-09 2006-06-15 Honeywell International Inc. Fault tolerance in a wireless network
US20080141377A1 (en) * 2006-12-07 2008-06-12 Microsoft Corporation Strategies for Investigating and Mitigating Vulnerabilities Caused by the Acquisition of Credentials
US20130174259A1 (en) * 2011-12-29 2013-07-04 Mcafee, Inc. Geo-mapping system security events
US20140305525A1 (en) * 2013-04-16 2014-10-16 Honeywell International Inc. Autonomous valve control and monitoring
US20150033337A1 (en) * 2013-07-25 2015-01-29 Bank Of America Corporation Cyber security analytics architecture
AU5740001A (en) * 2000-04-28 2001-11-12 Internet Security Systems Inc System and method for managing security events on a network
US8020210B2 (en) * 2004-06-09 2011-09-13 Verizon Patent And Licensing Inc. System and method for assessing risk to a collection of information resources
EP2519893A1 (en) * 2009-12-31 2012-11-07 Fiberlink Communications Corporation Consolidated security application dashboard
US20130247205A1 (en) * 2010-07-14 2013-09-19 Mcafee, Inc. Calculating quantitative asset risk
US9467464B2 (en) * 2013-03-15 2016-10-11 Tenable Network Security, Inc. System and method for correlating log data to discover network vulnerabilities and assets
2015-09-30 US US14/871,855 patent/US20160234243A1/en not_active Abandoned
2016-02-03 CN CN201680019865.XA patent/CN107431715A/en active Search and Examination
2016-02-03 EP EP16747148.1A patent/EP3254438A4/en not_active Withdrawn
2016-02-03 WO PCT/US2016/016265 patent/WO2016126755A1/en active Application Filing
2016-02-03 AU AU2016215462A patent/AU2016215462A1/en active Pending
2016-02-03 JP JP2017541612A patent/JP2018510544A/en active Pending
Symantec "Configuring Symantec Vulnerability Assessment 1.0 for network audits", Article ID TECH111985, 2003. *
AU2016215462A1 (en) 2017-08-17
JP2018510544A (en) 2018-04-12
CN107431715A (en) 2017-12-01
EP3254438A4 (en) 2018-09-19
WO2016126755A1 (en) 2016-08-11
EP3254438A1 (en) 2017-12-13
JP5846730B2 (en) 2016-01-20 Automatic deployment of computer-specific software update
US9363336B2 (en) 2016-06-07 Smart device for industrial automation
US7395195B2 (en) 2008-07-01 Sensor network modeling and deployment
CN103685442B (en) 2017-05-10 Industrial use of remote monitoring cloud architecture
CN104977874B (en) 2018-04-10 Industrial-enabled mobile device
CN103957228B (en) 2017-06-09 Cloud-based drive monitoring program
US9537731B2 (en) 2017-01-03 Management techniques for non-traditional network and information system topologies
CN104142661A (en) 2014-11-12 Using cloud-based data for industrial automation system training
US7538664B2 (en) 2009-05-26 Customized industrial alarms
EP2487860A1 (en) 2012-08-15 Method and system for improving security threats detection in communication networks
EP3037901B1 (en) 2018-12-12 Cloud-based emulation and modeling for automation systems
US9300673B2 (en) 2016-03-29 Automation system access control system and method
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:TALAMANCHI, VENKATA SRINIVASULU REDDY;BOICE, ERIC T.;GADHE, GANESH P.;AND OTHERS;SIGNING DATES FROM 20150918 TO 20150929;REEL/FRAME:036698/0586