Distributed network architecture security system

• US 20030051163A1
• Filed: 04/08/2002
• Published: 03/13/2003
• Est. Priority Date: 09/13/2001
• Status: Abandoned Application

• Current Assignee: Vigilante.com, Inc.
• Original Assignee: Vigilante.com, Inc.
• Inventors: Bidaud, Olivier
• Application Number:
  US10/118,632
• Publication Number:
  US 20030051163A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system for assessing the vulnerability of a network is disclosed and comprises a central console and a plurality of agents disposed on the network for performing active tests under control of the central console. The agents probe the network for vulnerabilities, and communicate the results of the tests to said central console, where a report on the security of the network is prepared.

Claims

1. A system for assessing the vulnerability of a network comprising:

a central console; and

an agent disposed on said network for performing active tests under control of said central console, said agent communicating the results of said tests to said central console.

2. The system of claim 1, wherein said agent includes a module for performing tests to probe the vulnerability of said network to attack.

3. The system of claim 2, wherein said network includes a plurality of computers connected thereto, and wherein said agent includes a module for collecting information about said computers to assess said vulnerability of said network.

4. The system of claim 3, wherein said agent includes a module for running test cases on said computers to assess said vulnerability of said network.

5. The system of claim 4, and further comprising a plurality of said agents disposed on said network.

6. The system of claim 5, and further comprising a repository for storing said results of said tests.

7. The system of claim 6, and further comprising a module for providing a report on said security of said network in response to said stored results.

8. The system of claim 7, wherein said network includes a plurality of sub-networks, and wherein said network includes a firewall for at least one sub-network, and wherein said central console is disposed outside said firewall and includes a module for performing tests to simulate attacks on said sub-network by a hacker.

9. The system of claim 7, wherein said central console includes a console main module for directing the operation of said central console.

10. The system of claim 7, wherein said central console includes a communication manager for managing all tasks involving access to said network by said central console.

11. The system of claim 10, wherein said agent includes a communication manager for managing tasks involving access to said network by said agent.

12. The system of claim 11, wherein said central console includes an agent manager for receiving and synchronizing communications with said agents.

13. The system of claim 12, wherein said central console has a plurality of configurations, and said central console includes a configuration manager for synchronizing said agents and said console configurations.

14. The system of claim 13, wherein said network includes a plurality of sub-networks, and wherein said central console is disposed on one of said sub-networks and includes a test engine for performing tests locally on said sub-network.

15. The system of claim 14, wherein said central console includes a virtual engine for performing network tests through said agents located remotely on said network.

16. The system of claim 15, wherein said central console includes a test manager for receiving test requests from said console, initializing said test engines to run said tests on said network in response thereto, coordinating said results of said test engines, and forwarding said results to said configuration manager.

17. The system of claim 16, wherein said agent includes an agent main for receiving and synchronizing communications with said central console.

18. The system of claim 17, wherein said agent main includes a configuration manager for synchronizing said agents and said console configurations.

19. The system of claim 18, wherein said agent includes an engine for performing tests on said network.

20. The system of claim 19, wherein said agents include an encryption module for encrypting said results of said tests.

21. A method of assessing the security of a network comprising the steps of:

deploying an agent on said network; and

directing said agent from a central console to run tests on said network to assess the vulnerability of said network.

22. The method of claim 21, wherein said step of directing said agent includes the step of directing said agent to perform active tests to probe said vulnerability of said network to attack.

23. The method of claim 22, wherein said step of directing said agent includes the step of directing said agent to collect information about computers connected to said network to assess said vulnerability of said network.

24. The method of claim 23, wherein said step of directing said agent includes the step of directing said agent to run test cases on said computers to assess said vulnerability of said network.

25. The method of claim 24, wherein said step of deploying said agents includes the step of deploying a plurality of said agents on said network.

26. The method of claim 25, and further comprising the step of communicating the results of said tests run by said agents to said central console.

27. The method of claim 26, and further comprising the step of compiling said results of said tests at said central console.

28. The method of claim 27, and further comprising the step of providing a report on said security of said network in response to said step of compiling.

29. The method of claim 28, and further comprising the steps of positioning a firewall between said central console and at least one sub-network of said network, and performing tests from said central console to simulate attacks on said sub-network by a hacker.

30. The method of claim 28, and further comprising the step of encrypting said results of said tests run by said agents before said step of communicating said results to said central console.

31. A network security system comprising:

a central console;

an agent disposed on said network for performing active tests under control of said central console, said agent communicating the results of said tests to said central console; and

report means for providing a report on said security of said network in response to said results of said tests.

32. The network security system of claim 31, wherein said agent includes a module for performing tests to probe the vulnerability of said network to attack.

33. The network security system of claim 32, wherein said network includes a plurality of computers connected thereto, and wherein said agent includes a module for collecting information about said computers to assess said vulnerability of said network.

34. The network security system of claim 33, wherein said agent includes a module for running test cases on said computers to assess said vulnerability of said network.

35. The network security system of claim 34, and further comprising a plurality of said agents disposed on said network.

36. The network security system of claim 35, and further comprising a repository for storing said results of said tests, and wherein said report means includes a report generator coupled to said repository for generating reports from said stored results.

37. The network security system of claim 36, wherein said report generator includes means for providing a written report on said security of said network.

38. The network security system of claim 37, wherein said network includes a plurality of sub-networks, and wherein said network includes a firewall for at least one sub-network, and wherein said central console is disposed outside said firewall and includes a module for performing tests to simulate attacks on said sub-network by a hacker.

39. The network security system of claim 37, wherein said central console includes a console main module for directing the operation of said central console.

40. The network security system of claim 37, wherein said central console includes a communication manager for managing all tasks involving access to said network by said central console.

41. The network security system of claim 40, wherein said agent includes a communication manager for managing tasks involving access to said network by said agent.

42. The network security system of claim 41, wherein said central console includes an agent manager for receiving and synchronizing communications with said agents.

43. The network security system of claim 42, wherein said central console has a plurality of configurations, and said central console includes a configuration manager for synchronizing said agents and said console configurations.

44. The network security system of claim 43, wherein said network includes a plurality of sub-networks, and wherein said central console is disposed on one of said sub-networks and includes a test engine for performing tests locally on said sub-network.

45. The network security system of claim 44, wherein said central console includes a virtual engine for performing network tests through agents located remotely on said network.

46. The network security system of claim 45, wherein said central console includes a test manager for receiving test requests from said console, initializing said test engines to run said tests on said network in response thereto, coordinating said results of said test engines, and forwarding said results to said configuration manager.

47. The network security system of claim 46, wherein said agent includes an agent main for receiving and synchronizing communications with said central console.

48. The network security system of claim 47, wherein said agent main includes a configuration manager for synchronizing said agents and said console configurations.

49. The network security system of claim 48, wherein said agent includes an engine for performing tests on said network.

50. The network security system of claim 49, wherein said agents include an encryption module for encrypting said results of said tests.

51. A network security assessment method comprising the steps of:

deploying an agent on said network;

directing said agent from a central console to run active tests on said network to assess the vulnerability of said network; and

compiling said results of said tests.

52. The method of claim 51, wherein said step of directing said agent includes the step of directing said agent to perform active tests to probe said vulnerability of said network to attack.

53. The method of claim 52, wherein said step of directing said agent includes the step of directing said agent to collect information about computers connected to said network to assess said vulnerability of said network.

54. The method of claim 53, wherein said step of directing said agent includes the step of directing said agent to run test cases on said computers to assess said vulnerability of said network.

55. The method of claim 54, wherein said step of deploying said agents includes the step of deploying a plurality of said agents on said network.

56. The method of claim 55, and further comprising the step of communicating the results of said tests run by said agents to said central console.

61. A computer program product comprising a computer usable medium having computer readable program code means embodied in said medium for causing an application program to execute on a computer to provide an assessment of the vulnerability of a network of computers, said computer readable program code means comprising:

a first computer readable program code means executing on at least one computer on said network for performing active tests on said network; and

a second computer readable program code means for sending instructions to said first computer readable program code means to perform said tests and for receiving the results of said tests run by said first computer readable program code means.

57. The method of claim 66, and further comprising the step of compiling said results of said tests at said central console.

58. The method of claim 57, and further comprising the step of providing a report on said security of said network in response to said step of compiling.

59. The method of claim 58, and further comprising the steps of positioning a firewall between said central console and at least one sub-network of said network, and performing tests from said central console to simulate attacks on said sub-network by a hacker.

60. The method of claim 59, and further comprising the step of encrypting said results of said tests run by said agents before said step of communicating said results to said central console.

62. The computer program product of claim 61, wherein said first computer readable program code means includes a computer readable program code means for performing tests to probe the vulnerability of said network to attack.

63. The computer program product of claim 62, wherein said network includes a plurality of computers connected thereto, and wherein said first computer readable program code means includes a computer readable program code means for collecting information about said computers to assess said vulnerability of said network.

64. The computer program product of claim 63, wherein said first computer readable program code means includes a computer readable program code means for running test cases on said computers to assess said vulnerability of said network.

65. The computer program product of claim 64, and further comprising a plurality of said first computer readable program code means disposed on a plurality of computers on said network.

66. The computer program product of claim 65, and further comprising a repository for storing said results of said tests.

67. The computer program product of claim 66, and further comprising a computer readable program code means for providing a report on said security of said network in response to said stored results.

68. The computer program product of claim 67, wherein said network includes a plurality of sub-networks, and wherein said network includes a firewall for at least one sub-network, and wherein said second computer readable program code means is disposed outside said firewall and includes a computer readable program code means for performing tests to simulate attacks on said sub-network by a hacker.

69. The computer program product of claim 67, wherein said second computer readable program code means includes a computer readable main program code means for directing the operation of said second computer readable program code means.

70. The computer program product of claim 67, wherein said second computer readable program code means includes a computer readable communication manager program code means for managing all tasks involving access to said network by said second computer readable program code means.

71. The computer program product of claim 70, wherein said first computer readable program code means includes a computer readable communications manager program code means for managing tasks involving access to said network by said first computer readable program code means.

72. The computer program product of claim 71, wherein said second computer readable program code means includes a computer readable agent manager program code means for receiving and synchronizing communications with said first computer readable program code means.

73. The computer program product of claim 72, wherein said second computer readable program code means has a plurality of configurations, and wherein said second computer readable program code means includes a computer readable configuration manager program code means for synchronizing said first computer readable program code means and said second computer readable program code configuration means.

74. The computer program product of claim 73, wherein said network includes a plurality of sub-networks, and wherein said second computer readable program code means is disposed on one of said sub-networks and includes a computer readable test engine program code means for performing tests locally on said sub-network.

75. The computer program product of claim 74, wherein said second computer readable program code means includes a computer readable virtual engine program code means for performing network tests through said first computer readable program code means located remotely on said network.

76. The computer program product of claim 75, wherein said second computer readable program code means includes a computer readable test manager program code means for receiving test requests from said computer readable main program code means, initializing computer readable test engine program code means to run said tests on said network in response thereto, coordinating said results of said computer readable test engine program code means, and forwarding said results to said second computer readable program code means.

77. The computer program product of claim 76, wherein said first computer readable program code means includes a computer readable agent main program code means for receiving and synchronizing communications with said second computer readable program code means.

78. The computer program product of claim 77, wherein said computer readable agent main program code means includes a computer readable configuration manager program code means for synchronizing said first computer readable program code means and said second computer readable program code configuration means.

79. The computer program product of claim 78, wherein said first computer readable program code means includes a computer readable engine program code means for performing tests on said network.

80. The computer program product of claim 79, wherein said first computer readable program code means include a computer readable encryption program code means for encrypting said results of said tests.

81. A computer data signal embodied in a carrier wave representing sequences of instructions which, when executed by a processor, assess the vulnerability of a network of processors, said computer data signal comprising:

a first program code segment executing on at least one processor on said network for performing active tests on said network; and

a second program code segment for sending instructions to said first program code segment to perform said tests and for receiving the results of said tests run by said first program code segment.

82. The computer data signal of claim 81, wherein said first program code segment includes a program code segment for performing tests to probe the vulnerability of said network to attack.

83. The computer data signal of claim 82, wherein said first program code segment includes a program code segment for collecting information about said processors to assess said vulnerability of said network.

84. The computer data signal of claim 83, wherein said first program code segment includes a program code segment for running test cases on said processors to assess said vulnerability of said network.

85. The computer data signal of claim 84, and further comprising a plurality of said first program code segments disposed on a plurality of said processors on said network.

86. The computer data signal of claim 85, and further comprising a program code segment for compiling said results of said tests.

87. The computer data signal of claim 86, and further comprising a program code segment for providing a report on said security of said network in response to said compiled results.

88. The computer data signal of claim 87, wherein said network includes a plurality of sub-networks, and wherein said network includes a firewall for at least one sub-network, and wherein said second program code segment is disposed outside said firewall and includes a program code segment for performing tests to simulate attacks on said sub-network by a hacker.

89. The computer data signal of claim 87, wherein said second program code segment includes a main program code segment for directing the operation of said second program code segment.

90. The computer data signal of claim 87, wherein said second program code segment includes a communication manager program code segment for managing all tasks involving access to said network by said second program code segment.

91. The computer data signal of claim 90, wherein said first program code segment includes a communications manager program code segment for managing tasks involving access to said network by said first program code segment.

92. The computer data signal of claim 91, wherein said second program code segment includes an agent manager program code segment for receiving and synchronizing communications with said first program code segment.

93. The computer data signal of claim 92, wherein said second program code segment has a plurality of configuration segments, and wherein said second program code segment includes a configuration manager program code segment for synchronizing said first program code segment and said second program code configuration segment.

94. The computer data signal of claim 93, wherein said network includes a plurality of sub-networks, and wherein said second program code segment is disposed on one of said sub-networks and includes a test engine program code segment for performing tests locally on said sub-network.

95. The computer data signal of claim 94, wherein said second program code segment includes a virtual engine program code segment for performing network tests through said first program code segments located remotely on said network.

96. The computer data signal of claim 95, wherein said second program code segment includes a test manager program code segment for receiving test requests from said main program code segment, initializing a test engine program code segment to run said tests on said network in response thereto, coordinating said results of said test engine program code segment, and forwarding said results to said second program code segment.

97. The computer data signal of claim 96, wherein said first program code segment includes an agent main program code segment for receiving and synchronizing communications with said second program code segment.

98. The computer data signal of claim 97, wherein said agent main program code segment includes a configuration manager program code segment for synchronizing said first program code segment and said second program code configuration segment.

99. The computer data signal of claim 98, wherein said first program code segment includes an engine program code segment for performing said tests on said network.

100. The computer data signal of claim 99, wherein said first program code segment includes an encryption program code segment for encrypting said results of said tests.