Method and device for scanning a plurality of computerized devices connected to a network

• US 20060184682A1
• Filed: 04/04/2006
• Published: 08/17/2006
• Est. Priority Date: 10/04/2004
• Status: Active Grant

• Current Assignee: Promiimer Ltd.
• Original Assignee: Promisec Ltd. (C MER Industries Limited)
• Inventors: Suchowski, Ron Shay, Kotler, Hilik
• Granted Patent: US 8,566,939 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols

Abstract

Some embodiments of the invention relate to a method and a device for scanning a plurality of computerized devices connected to a network. According to some embodiments of the invention, a plurality of computerize devices to be scanned may be provided. A plurality of threads of an agentless module may be provided for scanning the plurality of computerized devices. Each of the plurality of threads of the agentless module may be associated with at least one of the plurality of computerized devices. The plurality of threads of the agentless module may be utilized to configure a plurality of remote access processes to scan in parallel and without using agents at least two of the plurality of remote computerized devices.

Claims

1. A method of scanning a plurality of computerized devices connected to a network, comprising:

providing a plurality of computerize devices to be scanned; and

providing a plurality of threads of an agentless module and associating each thread of the agentless module with at least one of the plurality of computerized devices; and

utilizing the plurality of threads of the agentless module to configure a plurality of remote access processes to scan in parallel and without using agents at least two of the plurality of remote computerized devices.

2. The method according to claim 1, wherein said utilizing comprises utilizing each thread to configure one or more remote access processes to scan a computerized device associated with the thread.

3. The method according to claim 2, wherein said providing a plurality of threads of an agentless module comprises associating at least one of the threads with two or more computerized devices.

4. The method according to claim 1, wherein said providing a plurality of threads of an agentless module comprises determining the number of threads to be provided in accordance with a predefined criterion.

5. The method according to claim 4, wherein said determining comprises determining the number of threads to be provided in accordance with one or more of the following:

a number of computerized devices to be scanned, a network performance parameter, a target scanning speed, a connection speed with respect to the computerized devices to be scanned, various characteristics of the computerized devices, geographical location of the computerized devices to be scanned, statistical data collected in respect of previous scans, a result or results of a previous scan.

6. The method according to claim 5, wherein said associating each thread of the agentless module with at least one of the plurality of computerized devices is performed in accordance with one or more of the following:

parameters associated with a connection to the computerized device, various characteristics of the computerized device, geographical location of the computerized device, organizational location of the computerized devices, statistical data collected in respect of previous scans, a result or results of a previous scan.

7. The method according to claim 1, further comprising:

providing for each of the plurality of computerized devices to be scanned data with respect to one or more data items to be scanned thereon, and

wherein said utilizing comprises utilizing the plurality of threads of the agentless module to configure a plurality of remote access processes to scan in parallel and without using agents at least two of the plurality of remote computerized devices in accordance with one or more data items associated with the computerized devices.

8. The method according to claim 7, wherein said associating further comprises associating each thread of the agentless module with a data item to be scanned on a computerized device associated with the thread.

9. The method according to claim 8, wherein said providing a plurality of threads of an agentless module comprises determining the number of threads to be provided in accordance with at least one or more of the following:

a severity of a data item or data items to be scanned, a number of data items to be scanned, a target scanning speed, a connection speed with respect to the computerized devices to be scanned.

10. The method according to claim 7, wherein said associating each thread of the agentless module with a data item to be scanned on a computerized device associated therewith, comprises associating a first thread of the agentless module with a first data item to be scanned on a first computerized device and associating a second thread of the agentless module with a second data item to be scanned on the first computerized device.

11. The method according to claim 9, wherein said plurality of threads of the agentless module are utilized in a manner to cause two or more remote access processes to be utilized in parallel for scanning a remote computerized device with respect to two or more different data items.

12. The method according to claim 7, wherein the data with respect to a data item to be scanned includes one or more of the following:

a path to a location on a computerized device, data with respect to a severity of a security threat associated with the data item, data with respect to a remote access process to be used for scanning a remote computerized device for data in respect of the data item, a security setting associated with the data item, a data with respect to a type of the data item.

13. The method according to claim 7, wherein scanning a computerized device comprises one or more of the following:

scanning the remote computerized device for data in respect of a data item associated therewith;

comparing data on a computerized device in respect of a data item in accordance with a security setting associated with the data item; and

updating data on a computerized device in respect of a data item in accordance with a security setting associated with the data item.

14. The method according to claim 1, wherein a data item is one from a group including:

a configuration, an application, a file, a process, a service, a registry key, a registry value.

15. The method according to claim 1, wherein the initiation of a scanning of the plurality of computerized devices is insensitive to a new attachment of any of the plurality of computerized devices to the network.

16. The method according to claim 1, wherein the initiation of a scanning of the plurality of computerized devices is performed automatically in response to one or more of the following:

a completion of a previous scan, an event occurring on a computerized device connected to the network, a predefined schedule.

17. The method according to claim 1, wherein the scanning of the plurality of computerized devices is characterized by a relatively short turnaround time.

18. A device for scanning a plurality of computerized devices connected to a network, comprising:

a scanning module adapted to provide a plurality of computerize devices to be scanned;

an agentless module adapted to provide a plurality of threads,

wherein the scanning module is adapted to associate each of the plurality of threads of the agentless module with at least one of the plurality of computerized devices; and

wherein the scanning module is adapted to utilize the plurality of threads of the agentless module to configure a plurality of remote access processes to scan in parallel and without using agents at least two of the plurality of remote computerized devices.

19. The device according to claim 18, wherein the scanning module is adapted to utilize each thread of the agentless module to configure one or more remote access processes to scan a computerized device associated with the thread.

20. The device according to claim 19, wherein the agentless module is adapted to associated at least one of the threads with two or more computerized devices.

21. The device according to claim 18, wherein the agentless module is adapted to determine the number of threads to be provided.

22. The device according to claim 18, wherein the number of threads of the agentless module to be provided is manually selected by an operator.

23. The device according to claim 21, wherein the number of threads to be provided is determined in accordance with a predefined criterion.

24. The device according to claim 18, wherein said scanning module is adapted to provide to each of the plurality of computerized devices to be scanned data with respect to one or more data items to be scanned thereon, and wherein said agentless module is adapted to utilize the plurality of threads of the agentless module to configure a plurality of remote access processes to scan in parallel at least two of the plurality of remote computerized devices in accordance with one or more data items associated with the computerized devices.

25. The device according to claim 24, wherein said scanning module is adapted to associate each thread of the agentless module with a data item to be scanned on a computerized device associated with that thread.

26. The device according to claim 24, the scanning module is adapted to utilize the plurality of threads of the agentless module to configure a plurality of remote access processes to perform one or more of the following:

scan the remote computerized device for data in respect of a data item associated therewith;

compare data on a computerized device in respect of a data item in accordance with a security setting associated with the data item; and

update data on a computerized device in respect of a data item in accordance with a security setting associated with the data item.

27. The device according to claim 18, wherein a data item is selected from a group including:

a configuration, a file, a process, a service, a registry key, a registry value, a registry value.

28. The device according to claim 18, wherein the scanning module is adapted to initiate a scanning of the plurality of computerized devices, and wherein the initiation of the scanning of the plurality of computerized devices is insensitive to a new attachment of any of the plurality of computerized devices to the network.

29. The device according to claim 18, wherein the scanning module is adapted to automatically initiate a scanning of the plurality of computerized devices in response to one or more of the following:

a completion of a previous scan, an event occurring on a computerized device connected to the network, a predefined schedule.

30. A computer program product comprising a computer useable medium having computer readable program code embodied therein for scanning a plurality of computerized devices connected to a network, the computer program product comprising:

computer readable program code for causing the computer to provide a plurality of computerize devices to be scanned;

computer readable program code for causing the computer to provide a plurality of threads of an agentless module and associating each thread of the agentless module with at least one of the plurality of computerized devices; and

computer readable program code for causing the computer to utilize the plurality of threads of the agentless module to configure a plurality of remote access processes to scan in parallel and without using agents at least two of the plurality of remote computerized devices.

31. A method of enforcing a security policy on a plurality of computerized devices within an organization'"'"'s network, said method comprising:

designating a data item and an associated action for each of the plurality of computerized devices; and

providing a plurality of threads of an agentless module, each thread being associated with at least one of the plurality of computerized devices, and in respect of each computerized device, with at least a data item an associated action designated thereto;

each thread of the agentless module may be utilizing to configure a remote access process in a manner to cause each of the remote computerized device(s) associated with the thread to perform the designated action in respect of data corresponding to the designated data item on the remote computerized device(s), contingent upon there being data corresponding to the designated data item on the computerized device or the lack thereof.

32. The method according to claim 31, wherein the plurality of threads of the agentless module is utilized in a manner to cause a plurality of remote access processes to update in parallel and without using agents data items on two or more of the plurality of computerized devices in accordance with the security policy.

33. The method according to claim 31, wherein each thread of the agentless module is utilized to configure a remote access process in a manner to generate at least a command for each computerized device associated with the thread of the agentless module.

34. The method according to claim 33, wherein each thread of the agentless module is utilized to configure a remote access process in a manner to generate at least a command which is effective for causing the remote computerized device to perform without using an agent a designated action with respect to a data item on the computerized device, contingent upon there being data corresponding to the data item on the computerized device or contingent upon the lack thereof.

35. A device for enforcing a security policy on a plurality of computerized devices within an organization'"'"'s network, said device comprising:

an enforcement module adapted to receive data designating a data item and an associated action for each of the plurality of computerized devices; and

an agentless module adapted to provide a plurality of threads, each thread being associated with at least one of the plurality of computerized devices, and in respect of each computerized device, with at least a data item and an associated action designated thereto;

each thread of the agentless module is adapted configure a remote access process in a manner to cause each of the remote computerized device(s) associated with the thread to perform the designated action in respect of data corresponding to the designated data item on the remote computerized device(s), contingent upon there being data corresponding to the designated data item on the computerized device or the lack thereof.

36. A system enabling a security policy enforcement within an organization'"'"'s network, said system comprising:

a plurality of computerized devices;

an operator'"'"'s computer, said operator'"'"'s computer comprising;

an enforcement module adapted to receive data designating a data item and an associated action for each of the plurality of computerized devices; and

an agentless module adapted to provide a plurality of threads, each thread being associated with at least one of the plurality of computerized devices, and in respect of each computerized device, with at least a data item and an associated action designated thereto;

each thread of the agentless module is adapted to configure a remote access process in a manner to cause each of the remote computerized device(s) associated with the thread to perform the designated action in respect of data corresponding to the designated data item on the remote computerized device(s), contingent upon there being data corresponding to the designated data item on the computerized device or the lack thereof.