System and method for automated policy audit and remediation management

• US 20050015622A1
• Filed: 02/13/2004
• Published: 01/20/2005
• Est. Priority Date: 02/14/2003
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: Preventsys, Inc. (McAfee, LLC)
• Inventors: Costello, Brian, Payne, John, Pelly, John, Ritter, Stephen J., Rutherford, M. Celeste, Ravenel, John Patrick, Williams, John Leslie
• Granted Patent: US 8,561,175 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/0859 by keeping history of different configuration generations or by rolling back to previous configuration versions
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A prevention-based network auditing system includes a central compliance server providing a user interface allowing a user to schedule and configure a network audit. The configured audit is stored in an audit repository until its scheduled time. At such a time, the compliance server automatically invokes one or more audit servers to gather information about the network. The compliance server receives the gathered information and electronically applies a network policy to the information for determining compliance with the policy. A remediation task may be generated if the policy has been violated, and the task monitored until its completion.

Claims

1. A method for automated policy audit comprising:

providing a user interface for allowing a user to configure a network audit;

storing the network audit configuration information in a data store;

automatically initiating the network audit based on the configuration information to gather information about the network;

electronically applying a network policy to the gathered network information;

determining compliance with the network policy;

generating a task based on the compliance determination; and

monitoring status of the task.

2. The method of claim 1, wherein the configuration information includes audit scheduling information.

3. The method of claim 1, wherein the task is modifying a network feature.

4. The method of claim 1 further comprising assigning the task for execution.

5. The method of claim 1, wherein the monitoring of the status of the task comprises receiving an indication of a completion of the task.

6. The method of claim 5 further comprising verifying the completion of the task.

7. The method of claim 6, wherein the verifying comprises:

re-auditing the network based on the configuration information to newly gather information about the network; and

electronically re-applying the network policy to the newly gathered network information.

8. A server in a network auditing system, the server comprising:

a user interface allowing a user to configure a network audit;

a data store storing the network audit configuration information;

means for automatically initiating the network audit based on the configuration information to gather information about the network;

means for electronically applying a network policy to the gathered network information;

means for determining compliance with the network policy;

means for generating a task based on the compliance determination; and

means for monitoring status of the task.

9. The system of claim 8, wherein the configuration information includes audit scheduling information.

10. The system of claim 8, wherein the task is modifying a network feature.

11. The system of claim 8 further comprising means for assigning the task for execution.

12. The system of claim 8, wherein the means for monitoring status of the task further comprises means for receiving an indication of a completion of the task.

13. The system of claim 12 further comprising means for verifying the completion of the task.

14. The system of claim 13, wherein the means for verifying comprises:

means for re-auditing the network based on the configuration information to newly gather information about the network; and

means for electronically re-applying the network policy to the newly gathered network information.