System and method for providing network security policy enforcement

• US 20020184533A1
• Filed: 05/29/2002
• Published: 12/05/2002
• Est. Priority Date: 05/30/2001
• Status: Abandoned Application

• Current Assignee: Paul D. Fox
• Original Assignee: Paul D. Fox
• Inventors: Fox, Paul D.
• Application Number:
  US10/159,316
• Publication Number:
  US 20020184533A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A rack-mountable, self-contained computer network security device that actively monitors a computer network'"'"'s policy-defined configuration baseline for deviations. The device compares system identifying attributes and active TCP/UDP daemons to a policy baseline to determine policy compliance. Computer system events may be stored within a database.

Claims

1. A method of determining whether a networked system complies with a network security policy, the method comprising the steps of:

identifying at least one system to scan;

scanning the at least one system for current information pertaining to the at least one system;

comparing the current information obtained from the step of scanning against stored information for a network security policy pertaining to the at least one system; and

determining whether the at least one system complies with a network security policy based on the step of comparing.

2. The method of claim 1, further comprising the step of:

create a list of the at least one system to scan, wherein the list identifies the at least one system using a system identifier.

3. The method of claim 2, wherein the system identifier is an Internet Protocol (IP) address.

4. The method of claim 1, further comprising the step of:

associating at least one stored network security policy value with the system identifier.

5. The method of claim 1, further comprising the step of:

determining whether the at least one system is active.

6. The method of claim 5, further comprises the step of:

transmitting a Transmission Control Protocol (TCP) ping request.

7. The method of claim 5, further comprises the step of:

transmitting an Internet Control Message Protocol (ICMP) echo request.

8. The method of claim 1, further comprising the step of:

setting an operating system identifying flag.

9. The method of claim 8, further comprising the step of:

determining an operating system for the at least one system;

10. The method of claim 1, further comprising the step of:

importing the current information to a database.

11. The method of claim 1, wherein the current information comprises at least one of a DNS hostname, netbios hostname, netbios username, operating system, and MAC address.

12. The method of claim 1, wherein the stored information comprises at least one of a DNS hostname, netbios hostname, netbios username, operating system, and MAC address.

14. The system of claim 13, further comprising a list creating module that creates a list of the at least one system to scan, wherein the list identifies the at least one system using a system identifier.

15. The system of claim 14, wherein the system identifier is an Internet Protocol (IP) address.

16. The system of claim 13, further comprising an associating module that associates at least one stored network security policy value with the system identifier.

17. The system of claim 13, further comprising an active system determining module that determines whether the at least one system is active.

18. The system of claim 17, further comprising a ping transmitting module that transmits a Transmission Control Protocol (TCP) ping request.

19. The system of claim 17, further comprising an ICMP transmitting module that transmits an Internet Control Message Protocol (ICMP) echo request.

20. The system of claim 13, further comprising a setting module that sets an operating system identifying flag.

21. The system of claim 20, further comprising an operating system determining module that determines an operating system for the at least one system.

22. The system of claim 13, further comprising an importing module that imports the current information to a database.

23. The system of claim 13, wherein the current information comprises at least one of a DNS hostname, netbios hostname, netbios username, operating system, and MAC address.

24. The system of claim 13, wherein the stored information comprises at least one of a DNS hostname, netbios hostname, netbios username, operating system, and MAC address.

13. A system for determining whether a networked system complies with a network security policy, the system comprising:

an identifying module that identifies at least one system to scan;

a scanning module that scans the at least one system for current information pertaining to the at least one system;

a comparing module that compares the current information obtained from the step of scanning against stored information for a network security policy pertaining to the at least one system; and

a compliance determining module that determines whether the at least one system complies with a network security policy based on the step of comparing.