NETWORK APPLIANCE FOR VULNERABILITY ASSESSMENT AUDITING OVER MULTIPLE NETWORKS

• US 20080060076A1
• Filed: 10/23/2007
• Published: 03/06/2008
• Est. Priority Date: 01/19/2005
• Status: Active Grant

• Current Assignee: Callahan Cellular LLC (Intellectual Ventures LLC)
• Original Assignee: Lockdown Networks Inc (McAfee, LLC)
• Inventors: Webb, Evan, Gilde, Robert, Boscolo, Christopher
• Granted Patent: US 8,554,903 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An apparatus, system, and method are directed towards enabling auditing of network vulnerabilities from multiple network vantage points virtually simultaneously. Multiple network vantage points may include, but are not limited to, remote/branch enterprise sites, devices on an enterprise perimeter, on either side of a security perimeter, and even through the security perimeter. In one embodiment, an auditor performs reflected audits thereby extending auditing of network vulnerabilities to provide a comprehensive 360 degree audit of internal, external, and remote enterprise network sites. In one embodiment, the present invention may be implemented employing a single auditing device, and one or more audit extension devices that are configured to extend the auditing device'"'"'s audit reach. The auditing device and one or more audit extension devices may communicate using an encrypted network channel through a security perimeter and/or across multiple networks.

Claims

1. A system for managing an audit of a computing asset over a network comprising:

an audit extension device comprising;

program code that is operative to perform actions, comprising;

receiving through a security perimeter an audit request to be performed on the computing asset;

reflecting the audit based on the request towards the computing asset; and

sending a result of the audit through the security perimeter; and

an audit device comprising;

program code that is operative to perform actions, comprising;

sending the request for the audit through the security perimeter to the audit extension device;

receiving the result of the audit from the audit extension device through the security perimeter; and

based at least in part on a security policy, performing a remediation action.

2. The system of claim 1, wherein the program code of the audit extension device is operative to perform actions, further comprising:

if it is detected that the audit device is in a failure condition, assuming operations of the failed audit device; and

if it is detected that the audit device is no longer in a failure condition, or another network device is assuming operations of the failed audit device, communicating with the audit device or other network device and relinquishing operations of the failed audit device.

3. The system of claim 1, wherein the computing asset is on a same side of the security perimeter as the audit extension device.

4. The system of claim 1, wherein the audit request further comprises at least one of a request for a configuration, a probe, or a request for a resource associated with the computing asset.

5. The system of claim 1, wherein performing a remediation action further comprises at least one of providing a recommendation on a configuration, control, security policy, or a procedure associated with the computing asset.

6. The system of claim 1, wherein at least one of the audit extension device or the audit device is configured as a network appliance.

7. The system of claim 1, wherein at least one of receiving the audit request or sending the result of the audit is performed through a secure network path.

8. A network device for managing an audit of a computing asset over a network, comprising:

a transceiver to send and receive data over the network; and

an audit extension component that is programmed to perform actions comprising;

receiving, from another device, through a security perimeter an audit request to be performed on the computing asset;

reflecting the audit based on the request towards the computing asset;

receiving a response to the audit; and

sending the response of the audit through the security perimeter towards the other device.

9. The network device of claim 8, wherein the network device is configured to operate as a slave device to the other device such that if a failure is detected of the other device, the network device is configured to assume at least one operation of the other device, including at least one of quarantining the computing asset, or performing a remediation action upon the computing asset based at least in part on the response of the audit.

10. A network device for managing an audit of a computing asset over a network, comprising:

a transceiver to send and receive data over the network; and

an audit component that is programmed to perform actions comprising;

sending an audit request through a security perimeter to an audit extension device that is configured to reflect the audit request towards the computing asset;

receiving the result of the audit from the audit extension device through the security perimeter; and

based at least in part on a security policy, performing a remediation action.

11. The network device of claim 10, wherein the computing asset is on a same networking side of the security perimeter as the audit extension device.

12. The network device of claim 10, wherein the computing asset is on a different networking side of the security perimeter as the audit extension device.

13. The network device of claim 10, wherein the actions further comprising:

configuring the computing asset such that it is on a quarantined network; and

if the result of the audit or the remediation action indicates that the computing asset satisfies the security policy, configuring the computing asset such that it is no longer on the quarantined network.

14. The network device of claim 10, wherein the actions further comprising:

employing the audit extension device to remotely perform at least one of quarantining the computing asset, or performing a remediation action upon the computing asset based at least in part on the response of the audit.

15. A method for managing an audit of a computing asset over a network, comprising:

sending through a security perimeter, to a network device, an audit request of the computing asset, wherein the computing asset is on a different side of the security perimeter as the network device; and

enabling the audit to be performed based on the request upon the computing asset, and using the network device to reflect the audit towards the computing asset.