Deployment assurance checks for monitoring industrial control systems

• US 10,181,038 B2
• Filed: 11/17/2015
• Issued: 01/15/2019
• Est. Priority Date: 11/17/2015
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Carpenter, Seth G., Knapp, Eric D.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Sherkat, Arezoo
• Application Number:
  US14/943,876
• Publication Number:
  US 20170140154A1
• Time in Patent Office: 1,155 Days
• Field of Search: None
• CPC Class Codes: G05B 19/00 Programme-control systems
• CPC Class Codes: G05B 23/0208 characterized by the configuration of the monitoring system
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling

Abstract

This disclosure provides an apparatus and method for deployment assurance checks for monitoring industrial control systems and other systems. A method includes identifying, by a risk manager system, a plurality of connected devices that are vulnerable to cyber-security risks. The method includes determining devices to be monitored from the plurality of connected devices. The method includes evaluating system resource usage, by the risk manager system, on each device to be monitored. The method includes providing recommendations to a user as to whether or not the user should proceed with the monitoring, based on the evaluation.

Claims

1. A method for deployment assurance checks for monitoring an industrial control systems, comprising:

identifying, by a risk manager system, a plurality of connected devices that are vulnerable to cyber-security risks;

determining, by the risk manager system, devices to be monitored from the plurality of connected device;

verifying any relevant software or hardware prerequisites on the devices to be monitored;

validating whether an appropriate software version is present on each device to be monitored through a remote Windows Management Infrastructure (WMI) query by a user;

evaluating system resource usage, by the risk manager system, on each device to be monitored;

evaluating, by the risk manager system, security prerequisites on the connected devices, the evaluating security prerequisites includes;

checking firewall setting on each device,

validating that monitoring process is running from an account that is recognized, and

receiving credentials from a user and sending credentials to the connected devices; and

providing recommendations to the user, by the risk manager system, as to whether or not the user should proceed with the monitoring, based on the evaluation and on whether the monitoring would increase the system resource usage beyond a predetermined threshold and recommendations as to whether or not to install a monitoring agent on each of the connected devices and providing a level of enforcement of the recommendations, the level of enforcement includes at least one of “

No”

enforcement “

Soft”

enforcement or “

Hard”

enforcement.

2. The method of claim 1, wherein identifying the plurality of connected devices includes performing an automatic discovery process by the risk manager system.

3. The method of claim 1, wherein the system resource usage includes processor usage, memory usage, and disk space usage.

4. The method of claim 1, further comprising selectively enforcing the recommendations on each of the plurality of devices.

5. The method of claim 1, wherein identifying the plurality of connected devices includes receiving device information by the risk manager system from the user.

6. A risk manager system comprising:

a controller; and

a memory, the risk manager system configured to;

identify a plurality of connected devices that are vulnerable to cyber-security risks;

determine devices to be monitored from the plurality of connected devices;

verify any relevant software or hardware prerequisites on the devices to be monitored;

validate whether an appropriate software version is present on each device to be monitored through a remote Windows Management Infrastructure (WMI) query by a user;

evaluate system resource usage on each device to be monitored;

evaluate evaluating security prerequisites on the connected devices, the evaluation of security prerequisites includes;

check firewall setting on each device,

validate that monitoring process is running from an account that is recognized, and

receive credentials from the user and send credentials to the connected devices; and

provide recommendations to the user as to whether or not the user should proceed with the monitoring, based on the evaluation and on whether the monitoring would increase the system resource usage beyond a predetermined threshold and recommendations as to whether or not to install a monitoring agent on each of the connected devices and provide a level of enforcement of the recommendations, the level of enforcement includes at least one of “

No”

enforcement, “

Soft”

enforcement or “

Hard”

enforcement.

7. The risk manager system of claim 6, wherein the risk manager system is configured to identify the plurality of connected devices by performing an automatic discovery process.

8. The risk manager system of claim 6, wherein the system resource usage includes processor usage, memory usage, and disk space usage.

9. The risk manager system of claim 6, wherein the risk manager system is further configured to selectively enforce the recommendations on each of the plurality of devices.

10. The risk manager system of claim 6, wherein the risk manager system is configured to identify the plurality of connected devices by receiving device information by the risk manager system from the user.

11. A non-transitory machine-readable medium encoded with executable instructions that, when executed, cause one or more processors of a risk manager system to:

identify a plurality of connected devices that are vulnerable to cyber-security risks;

determine devices to be monitored from the plurality of connected devices;

verify any relevant software or hardware prerequisites on the devices to be monitored;

validate whether an appropriate software version is present on each device to be monitored through a remote Windows Management Infrastructure (WMI) query by a user;

evaluate system resource usage on each device to be monitored;

evaluate security prerequisites on the connected devices, the evaluation of security prerequisites includes;

check firewall setting on each device,

validate that monitoring process is running from an account that is recognized, and

receive credentials from the user and send credentials to the connected devices; and

provide recommendations to the user as to whether or not the user should proceed with the monitoring, based on the evaluation and on whether the monitoring would increase the system resource usage beyond a predetermined threshold and recommendations as to whether or not to install a monitoring agent on each of the connected devices and provide a level of enforcement of the recommendations, the level of enforcement includes at least one of “

No”

enforcement, “

Soft”

enforcement or “

Hard”

enforcement.

12. The non-transitory machine-readable medium of claim 11, wherein the instructions to identify the plurality of connected devices includes instructions to perform an automatic discovery process by the risk manager system.

13. The non-transitory machine-readable medium of claim 11, wherein the system resource usage includes processor usage, memory usage, and disk space usage.

14. The non-transitory machine-readable medium of claim 11, wherein the non-transitory machine-readable medium is further encoded with instructions to selectively enforce the recommendations on each of the plurality of devices.