Notification subsystem for generating consolidated, filtered, and relevant security risk-based notifications

• US 10,075,474 B2
• Filed: 09/30/2015
• Issued: 09/11/2018
• Est. Priority Date: 02/06/2015
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Boice, Eric T., Kaakani, Ziad M., Carpenter, Seth G.
• Primary Examiner(s): Shepperd, Eric W
• Application Number:
  US14/871,521
• Publication Number:
  US 20160234251A1
• Time in Patent Office: 1,077 Days
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

This disclosure provides a notification subsystem for generating consolidated, filtered, and relevant security risk-based notifications. A method includes discovering multiple devices in a computing system. The method includes grouping the multiple devices into multiple security zones. The method includes generating a risk value identifying at least one cyber-security risk of the devices for one of the security zones. The method includes comparing the risk value to a threshold. The method includes automatically generating a notification for one or more users when the risk value violates the threshold.

Claims

1. A method comprising:

discovering multiple devices in a computing system by a risk manager system;

grouping the multiple devices into multiple security zones by a rules engine of the risk manager system using a risk management database that stores rules and data identifying cyber-security risks;

generating a risk value identifying at least one cyber-security risk for the devices of one of the security zones by the risk manager system;

comparing the risk value to a threshold by the risk manager system; and

automatically generating a notification for one or more users by the risk manager system in response to the risk value violating the threshold.

2. The method of claim 1, wherein discovering the multiple devices is performed by a data collection component.

3. The method of claim 1, wherein the risk manager system uses the security zones to determine which of the multiple devices are connected to each other.

4. The method of claim 1, wherein:

the risk value indicates where an attack is able to spread in the one of the security zones if a device in the one of the security zones is compromised.

5. The method of claim 1, wherein generating the risk value is performed for each security zone and includes generating a respective risk value identifying at least one cyber-security risk of the devices in each respective security zone.

6. The method of claim 1, wherein the notification is a System Center Operations Manager notification event.

7. The method of claim 1, wherein the notification is transmitted to the one or more users according to a notification recipient list.

8. A risk manager system comprising:

a controller; and

a display;

wherein the controller is configured to;

discover multiple devices in a computing system;

group the multiple devices into multiple security zones using a rules engine and a risk management database that is configured to store rules and data identifying cyber-security risks;

generate a risk value identifying at least one cyber-security risk for the devices of one of the security zones;

compare the risk value to a threshold; and

automatically generate a notification for one or more users in response to the risk value violating the threshold.

9. The risk manager system of claim 8, wherein the controller is configured to discover the multiple devices using a data collection component.

10. The risk manager system of claim 8, wherein the controller is configured to use the security zones to determine which of the multiple devices are connected to each other.

11. The risk manager system of claim 8, wherein:

the risk value indicates where an attack is able to spread in the one of the security zones if a device in the one of the security zones is compromised.

12. The risk manager system of claim 8, wherein the controller is configured to generate the risk value for each security zone, a respective risk value identifying at least one cyber-security risk of the devices in each respective security zone.

13. The risk manager system of claim 8, wherein the notification is a System Center Operations Manager notification event.

14. The risk manager system of claim 8, wherein the controller is configured to transmit the notification to the one or more users according to a notification recipient list.

15. A non-transitory machine-readable medium encoded with executable instructions that, when executed, cause one or more processors of a risk management system to:

discover multiple devices in a computing system;

group the multiple devices into multiple security zones using a rules engine and a risk management database that is configured to store rules and data identifying cyber-security risks;

generate a risk value identifying at least one cyber-security risk for the devices of one of the security zones;

compare the risk value to a threshold; and

automatically generate a notification for one or more users in response to the risk value violating the threshold.

16. The non-transitory machine-readable medium of claim 15, wherein the instructions that, when executed, cause the one or more processors of the risk management system to discover the multiple devices comprise:

instructions that, when executed, cause the one or more processors of the risk management system to discover the multiple devices using a data collection component.

17. The non-transitory machine-readable medium of claim 15, further encoded with executable instructions that, when executed, cause the one or more processors of the risk management system to use the security zones to determine which of the multiple devices are connected to each other.

18. The non-transitory machine-readable medium of claim 15, wherein the risk value indicates where an attack is able to spread in the one of the security zones if a device in the one of the security zones is compromised.

19. The non-transitory machine-readable medium of claim 15, wherein the instructions that, when executed, cause the one or more processors of the risk management system to generate the risk value comprise:

instructions that, when executed, cause the one or more processors of the risk management system to generate the risk value for each security zone, a respective risk value identifying at least one cyber-security risk of the devices in each respective security zone.

20. The non-transitory machine-readable medium of claim 15, wherein the notification is a System Center Operations Manager notification event.