Patent ID: 7849497

Claim:
A method for analyzing security of a computer network, the method comprising: collecting security configuration settings from each of a plurality of nodes of the computer network, for each node: opening a communication session with the node; querying the node using the communication session to determine the node's security configurations settings; and obtaining rules that each of the nodes uses to admit or deny network traffic; graphically displaying topology of the network on a user interface by displaying a representation for each of the nodes on the network and displaying connections between the representations, the connections being representative of communication paths between each of the nodes; receiving, from a user, a selection of a first representation of a first node of the plurality of nodes and a second representation of a second node of the plurality of nodes; displaying a plurality of rules for each of the first and second nodes, the rules indicating a plurality of criteria by which each of the nodes admits or denies traffic on the network; analyzing the security configuration settings; generating a security path policy for along each of all possible communications paths between the first and second nodes based on the results of the analyzing step, the generating step further comprising: determining an aggregate effect of the security settings of each of the devices along each of the possible communications paths between the first and second nodes; expressing the generated security path policy in the form of a canonical ruleset language; displaying a plurality of rules including all rules for all nodes comprising the aggregate effect of the generated security path policy, the rules indicating a plurality of criteria by which each of the nodes admits or denies traffic on the network; and displaying the generated security path policy on the user interface.