METHOD AND DEVICE FOR QUESTIONING A PLURALITY OF COMPUTERIZED DEVICES

• US 20100235920A1
• Filed: 05/21/2010
• Published: 09/16/2010
• Est. Priority Date: 10/04/2004
• Status: Active Grant

• Current Assignee: Promiimer Ltd.
• Original Assignee: Promisec Ltd. (C MER Industries Limited)
• Inventors: KOTLER, Hilik, Suchowski, Ron Shay
• Granted Patent: US 8,544,099 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols

Abstract

Some embodiments of the present invention may relate to a device and a method of questioning computerized devices within an organization'"'"'s network. The device, in accordance with some embodiments of the present invention, may include a questioning module and an agentless module. The questioning module may be adapted to receive data specifying a plurality of computerized devices to be questioned, and to receive data indicating which one or more questioning subjects are selected to be questioned on the specified computerized devices. The agentless module may be adapted to invoke and configure at least a remote access process, to question at least a registry of a remote computerized device. In accordance with some embodiments of the present invention, the questioning module may be adapted to utilize multiple threads of the agentless module to invoke and configure a plurality of remote access processes to question in parallel and without using agents at least a registry of the specified computerized devices, in accordance with the selected questioning subjects.

Claims

1. A device for questioning a plurality of computerized devices in an organization'"'"'s network, said device comprising:

a microprocessor coupled to a computer-readable medium encoded with a computer program,

wherein the microprocessor is programmed to;

receive data specifying the plurality of computerized devices to be questioned;

receive data indicating which one or more questioning subjects are to be questioned within the plurality of computerized devices, at least one of the questioning subjects is associated with one or more specific locations within a computerized device; and

invoke and configure a plurality of threads of a remote access process running locally within the device to remotely question in parallel and without using agents a plurality of the specified computerized devices according to respective questioning subjects.

2. The device according to claim 1, wherein the questioning subjects are associated with security threats.

3. The device according to claim 2, wherein the questioning subjects are associated specific locations within at least the registry of a computerized device, where an indication of a security threat may be found during questioning.

4. The device according to claim 1, wherein said microprocessor is programmed to invoke and configure a substantially large number of the remote access process to thereby remotely question without using agents and in parallel a substantially large number of the specified plurality of computerized devices.

5. The device according to claim 1, wherein said microprocessor is programmed to select which one or more of the questioning subjects are to be questioned on each one of the specified plurality of computerized devices.

6. The device according to claim 5, further comprising a user interface to enable a user to select, either directly or indirectly, one or more of the specified plurality of computerized devices.

7. The device according to claim 6, wherein said user interface may further enable a user to select, either directly or indirectly, which one or more questioning subjects are to be questioned on one or more of the specified plurality of computerized devices.

8. The device according to claim 1, wherein said microprocessor is programmed to determine a number of threads of the remote access process to be invoked and configured to remotely question the specified plurality of computerized devices.

9. The device according to claim 8, wherein said microprocessor is programmed to determine the number of threads of the remote access process to be invoked and configured in accordance with one or more of the following:

a number of computerized devices to be questioned in parallel, a desired questioning speed, one or more network performance parameters, subjects to be questioned, and a subject'"'"'s severity.

10. The device according to claim 1, wherein said microprocessor is programmed to assign to each thread of the remote access process one or more of the specified plurality of computerized devices.

11. The device according to claim 10, wherein said microprocessor is programmed to assign to each thread of said remote access process one or more questioning subjects selected to be questioned on one or more of the specified plurality of computerized devices that have been assigned to that thread of said remote access process.

12. The device according to claim 11, wherein said microprocessor is programmed to configure each invoked thread of said remote access process to question one or more specific locations within the computerized devices assigned to that thread, in accordance with the respective one or more questioning subjects selected for each of the computerized devices and which have been assigned to that thread.

13. The device according to claim 12, wherein said microprocessor is programmed to configure each invoked thread of said remote access process to question one or more specific locations within at least a registry of the computerized devices assigned to that thread, in accordance with the respective one or more questioning subjects selected for each of the computerized devices and which have been assigned to that thread.

14. The device according to claim 12, wherein said microprocessor is programmed to assign to one or more threads of said remote access process predefined data corresponding to certain data which may be found in one or more of the specified locations associated with one or more of the questioning subjects assigned to that or these thread or threads.

15. The device according to claim 14, wherein said microprocessor is programmed to configure one or more of the invoked threads of the remote access process to compare actual data associated with one or more of the questioning subjects that was found within the computerized devices assigned to that or these threads against the predefined data associated with the respective questioning subjects.

16. The device according to claim 7, further comprising one or more databases including prestored data corresponding to one or more computerized devices, and wherein as part of specifying the computerized devices to be questioned, prestored data corresponding to computerized devices may be obtained from said database.

17. The device according to claim 7, further comprising one or more databases including prestored data corresponding to one or more questioning subjects, and wherein as part of selecting one or more questioning subjects to be questioned on the specified computerized devices, prestored data corresponding to one or more questioning subjects may be obtained from said database.

18. The device according to claim 1, wherein said microprocessor is programmed to process results received in response to the questioning of one or more of the specified plurality of computerized devices, and to generate a report corresponding to the results.

19. The device according to claim 18, wherein said microprocessor is programmed to compare one or more results relating to actual data found as part of the questioning of one or more of the specified plurality of computerized devices against predefined data.

20. The device according to claim 1, wherein said microprocessor is programmed to utilize one or more threads of the remote access process to modify or delete certain data on one or more of the specified plurality of remote computerized devices which were questioned.

21. A method of questioning a plurality of computerized devices in an organization'"'"'s network, said method comprising:

specifying a plurality of computerized devices to be questioned;

selecting one or more questioning subjects to be questioned on the specified plurality of computerized devices; and

invoking and configuring a plurality of threads of a remote access process running locally within a questioning device to remotely question in parallel and without using agents a plurality of the specified computerized devices, in accordance with respective questioning subjects.

22. The method according to claim 21, wherein said selecting one or more questioning subjects further comprises, selecting which one or more of the questioning subjects is to be questioned on each of the specified plurality of computerized devices.

23. The method according to claim 21, wherein said invoking and configuring further comprises assigning to each of the plurality of threads of the remote access process one or more of the specified plurality of computerized devices, and one or more of questioning subjects to be questioned on the one or more computerized devices.

24. The method according to claim 21, further comprising determining a number of threads of the remote access process to be invoked, in accordance with one or more of the following:

a number of computerized devices to be questioned in parallel, a desired questioning speed, one or more network performance parameters, subjects to be questioned, and a subject'"'"'s severity.

25. The method according to claim 23, wherein said assigning further comprises assigning to one or more of the of threads of the remote access process data corresponding to one or more specific locations within the computerized devices assigned to that or these threads, in accordance with one or more of respective questioning subjects selected to be questioned on the computerized devices.

26. The method according to claim 25, further comprising assigning to one or more threads of said remote access process predefined data corresponding to certain data which may be found in one or more of the specified locations associated with one or more of the questioning subjects assigned to that or these thread or threads.

27. The method according to claim 26, further comprising configuring one or more of the invoked threads of the remote access process to compare actual data associated with one or more of the questioning subjects that was found within the computerized devices assigned to that or these threads against the predefined data associated with the respective questioning subjects.

28. The method according to claim 21, further comprising:

receiving results in response to the questioning of at least one of the specified plurality of computerized devices; and

generating a report corresponding to the results received in response to the questioning of the specified plurality of computerized devices.

29. The method according to claim 21, further comprising utilizing one or more threads of the remote access process to modify or delete certain data on one or more of the remote computerized devices which were questioned.

30. A non-transitory program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform a method of internally questioning a plurality of computerized devices in an organization'"'"'s network, said method comprising:

specifying a plurality of computerized devices to be questioned;

selecting one or more questioning subjects to be questioned on the specified plurality of computerized devices, at least one of the questioning subjects being associated with one or more specific locations within a computerized device; and

invoking and configuring a plurality of threads of a remote access process running locally within a questioning device to remotely question, in parallel and without using agents, a plurality of the specialized computerized devices in accordance with respective questioning subjects.