SYSTEM AND METHOD OF SECURING WEB APPLICATIONS ACROSS AN ENTERPRISE

• US 20080034425A1
• Filed: 09/14/2006
• Published: 02/07/2008
• Est. Priority Date: 07/20/2006
• Status: Active Grant

• Current Assignee: Trustwave Holdings Incorporated (Singapore Telecommunications Limited)
• Original Assignee: Trustwave Holdings Incorporated (Singapore Telecommunications Limited)
• Inventors: Delikate, Kate, Kolton, Doron, Wexler, Asaf, Zahavi, Yoram, Gavrieli, Netta, Mizrahi, Rami, Efron, Galit, Overcash, Kevin
• Granted Patent: US 7,934,253 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for protection of Web based applications are described. The techniques described provide an enterprise wide approach to preventing attacks of Web based applications. Individual computer networks within the enterprise monitor network traffic to identify anomalous traffic. The anomalous traffic can be identified by comparing the traffic to a profile of acceptable user traffic when interacting with the application. The anomalous traffic, or security events, identified at the individual computer networks are communicated to a central security manager. The central security manager correlates the security events at the individual computer networks to determine if there is an enterprise wide security threat. The central security manager can then communicate instructions to the individual computer networks so as to provide an enterprise wide solution to the threat

Claims

1. A plurality of networks comprising:

a security module in one or more of the plurality of networks comprising,

a network traffic port adapted to receiving network traffic;

a processor adapted to verify the traffic against a profile of acceptable behavior for a user of the network, identify anomalous user traffic, and to analyze the anomalous traffic by at least one threat-detection engine, wherein results from the at least one threat-detection engine are correlated to determine if there is a threat to the network;

an output configured to communicate security events to a central security manager;

an input configured to receive instructions from the central security manager, wherein the security module responds in accordance with the instructions;

a centralized security manager comprising,

an input adapted to receive security events from the security module within one of the plurality of networks;

a processor adapted to analyze the security events from the plurality of networks to identify security threats across the networks and to determine an appropriate response to the threat by the plurality of networks based upon a security policy, wherein the analysis of the security events includes correlating information from the plurality of networks against a profile of acceptable behavior for a user of the network; and

an output adapted to communicate instructions for responding to the security threat to the security module in network.

2. The plurality of networks as defined in claim 1, wherein there is a security module included in each of the plurality of networks.

3. The plurality of networks as defined in claim 1, further comprising a centralized database that includes security policy information for the plurality of computer networks.

4. The plurality of networks as defined in claim 3, wherein policy information for the plurality of networks is updated by updating the centralized database.

5. The plurality of networks as defined in claim 1, further comprising a centralized database that includes security procedure information for the plurality of computer networks.

6. The plurality of networks as defined in claim 5, wherein procedure information for the plurality of networks is updated by updating the centralized database.

7. The plurality of networks as defined in claim 1, wherein the appropriate response to the threat is coordinated across the plurality of computer networks.

8. The plurality of networks as defined in claim 1, wherein the security module monitors network traffic out-of-line.

9. The plurality of networks as defined in claim 1, wherein the security events comprise validation of parameters in network traffic.

10. The plurality of networks as defined in claim 1, further comprising at least one agent.

11. The plurality of networks as defined in claim 10, wherein the at least one agent in included within a server in at least one of the plurality of networks.

12. The plurality of networks as defined in claim 1, wherein the profile of acceptable behavior is updated by an adaptation module.

13. The plurality of networks as defined in claim 12, wherein the profile is updated automatically.

14. The plurality of networks as defined in claim 12, wherein the profile is updated in response to an application change.

15. A centralized security manager within an enterprise, the security manager comprising:

an input adapted to receive information about security events from a plurality of networks;

a processor adapted to analyze the information about security events from the plurality of networks to identify security threats across the enterprise and to determine an appropriate response to the threat by the plurality of networks based upon a security policy, wherein the analysis of the security events includes correlating information from the plurality of networks against a profile of acceptable behavior for a user of the network; and

an output adapted to communicate instructions for responding to the security threat to the plurality of networks.

16. The centralized security manager as defined in claim 15, further comprising a centralized database that includes security policy information for the plurality of networks.

17. The centralized security manager as defined in claim 16, wherein policy information for the plurality of networks is updated by updating the centralized database.

18. The centralized security manager as defined in claim 15, further comprising a centralized database that includes security procedure information for the plurality of networks.

19. The centralized security manager as defined in claim 18, wherein procedure information for the plurality of networks is updated by updating the centralized database.

20. The centralized security manager as defined in claim 16, wherein the appropriate response to the threat is coordinated across the plurality of networks.

21. The centralized security manager as defined in claim 16, wherein information about security events is received from security modules in the plurality of networks.

22. The centralized security manager as defined in claim 21, wherein the security modules monitor network traffic out-of-line.

23. The centralized security manager as defined in claim 16, wherein the security events comprise validation of parameters in network traffic.

24. The centralized security manager as defined in claim 16, wherein the profile of acceptable behavior is updated by an adaptation module.

25. The centralized security manager as defined in claim 23, wherein the profile is updated automatically.

26. The centralized security manager as defined in claim 23, wherein the profile is updated in response to an application change.

27. The centralized security manager as defined in claim 16, wherein the plurality of networks further comprise an agent adapted to respond to the security threat in accordance with the instructions from the security manager.

28. A method of securing networks within an enterprise, the method comprising:

receiving information about security events from a plurality of networks within the enterprise;

analyzing the information about security events from the plurality of networks to identify security threats across the enterprise and determining an appropriate response to the threat by the plurality of networks based upon an enterprise security policy, wherein the analysis includes correlating information from the plurality of networks against a profile of acceptable behavior for a user of the network; and

communicating instructions for responding to a security threat to the plurality of computer networks.

29. The method as defined in claim 28, further comprising storing security policy information for the plurality of networks within a centralized database.

30. The method as defined in claim 29, wherein policy information for the plurality of networks is updated by updating the centralized database.

31. The method as defined in claim 28, further comprising storing security procedure information for the plurality of networks within a centralized database.

32. The method manager as defined in claim 31, wherein policy information for the plurality of networks is updated by updating the centralized database.

33. The method as defined in claim 28, wherein determining the appropriate response to the threat is coordinated across the plurality of networks.

34. The method as defined in claim 28, wherein information about security events is received from security modules in the plurality of networks.

35. The method as defined in claim 28, wherein the security modules monitor network traffic out-of-line.

36. The method as defined in claim 28, wherein the security events comprise validation of parameters in network traffic.

37. The method as defined in claim 28, further comprising adapting the profile of acceptable user behavior as network usage changes.

38. The method as defined in claim 37, wherein the profile is updated automatically.

39. The method as defined in claim 37, wherein the profile is updated in response to a change in an application.

40. A security module within an enterprise, the security module comprising:

a network traffic port adapted to receiving network traffic;

a processor adapted to verify the traffic against a profile of acceptable behavior for a user of the network, identify anomalous user traffic, and to analyze the anomalous traffic by at least one threat-detection engine, wherein results from the at least one threat-detection engine are correlated to determine if there is a threat to the network;

an output configured to communicate security events to a central security manager; and

an input configured to receive instructions from the central security manager, wherein the security module responds in accordance with the instructions.

41. The security module as defined in claim 40, further comprising an agent configured to block network traffic.

42. The security module as defined in claim 40, further comprising an agent configured to log out a user.

43. An enterprise wide network security system comprising:

a plurality of networks adapted to identify security events; and

a central security manager adapted to receive information about security events from the plurality of networks, to analyze the information about security events and identify security threats across the enterprise, to determine an appropriate response to the threat by the plurality of networks based upon an enterprise security policy, wherein the analysis includes correlating information from the plurality of networks against a profile of acceptable behavior for a user of the network, and to communicate instructions for responding to the security threat to the plurality of computer networks.

44. The security system as defined in claim 43, wherein the plurality of networks comprise a security module adapted to monitor traffic on the network.

45. The security system as defined in claim 44, wherein the security module monitors network traffic out-of-line.

46. The security system as defined in claim 43, further comprising an agent.

47. The security system as defined in claim 46, wherein the agent is adapted to verify network traffic against a profile of acceptable behavior for a user and to identify anomalous user traffic.