Systems And Methods For Implementing Modular Computer System Security Solutions

• US 20150106873A1
• Filed: 10/10/2014
• Published: 04/16/2015
• Est. Priority Date: 10/11/2013
• Status: Active Grant

• Current Assignee: Ark Network Security Solutions, LLC
• Original Assignee: Ark Network Security Solutions, LLC
• Inventors: Marsh, Jacob J., Roney, Gregory D.
• Granted Patent: US 9,817,978 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities

Abstract

In some embodiments, an apparatus includes a control chain generation module is configured to receive, from a control database, a security guideline control to be implemented with respect to a hardware asset. The control chain generation module is configured to select, based on requirements to satisfy the security guideline and attributes of the hardware asset, a security implementation control. The control chain generation module is configured to select a control assessor to monitor the compliance of the hardware asset with the security guideline and is configured to define a control chain including the security guideline control, the security implementation control, and the control assessor. The control chain generation module is configured to send an instruction to apply the control chain to the hardware asset such that the control assessor monitors the hardware asset for compliance with the security guideline.

Claims

1. An apparatus, comprising:

a control chain generation module implemented in a memory or a processing device, the control chain generation module configured to receive, from a control database, a security guideline control to be implemented with respect to a hardware asset, the security guideline control including requirements to satisfy a security guideline associated with the security guideline control,

the control chain generation module configured to receive, from an asset database, an indication of a hardware asset in a network, the indication of the hardware asset including attributes of the hardware asset, the control chain generation module configured to select, based on the requirements to satisfy the security guideline and the attributes of the hardware asset, a security implementation control from a plurality of implementation controls and to be associated with the hardware asset,

the control chain generation module configured to select, based on the security implementation control and the requirements to satisfy the security guideline, a control assessor to monitor the compliance of the hardware asset with the security guideline, the control chain generation module configured to define a control chain including the security guideline control, the security implementation control, and the control assessor,

the control chain generation module configured to send an instruction to apply the control chain to the hardware asset such that the security implementation control is implemented at the hardware asset to improve a security function of the hardware asset and the control assessor monitors the hardware asset for compliance with the security guideline.

2. The apparatus of claim 1, wherein the control chain includes Plan of Action and Milestone (POAM) instructions, the code further comprising code to cause the processor to:

alter, based on the POAM instructions, a health evaluation score action performed by the control assessor for the security implementation control in the control chain.

3. The apparatus of claim 1, further comprising:

a control catalogue management module implemented in a memory or a processing device, the control catalogue management module is configured to;

store the control chain in an aggregated control catalogue;

receive a request, from a private control catalogue module including user-specific control chains, to receive a copy of the control chain; and

provide a representation of the copy of the control chain to the private control catalogue module.

4. The apparatus of claim 1, wherein the control chain generation module is configured to:

select the control assessor to monitor the hardware asset for compliance with the security guideline including performing a health evaluation score calculation for the security implementation control, and

modify the security implementation control when a health evaluation score value from the health evaluation score calculation does not meet a predetermined health evaluation criterion.

5. The apparatus of claim 1, wherein the security implementation control is a first security implementation control from the plurality of implementation controls, the control chain generation module is configured to:

select the control assessor to monitor the hardware asset for compliance with the security guideline including performing a health evaluation score calculation for the security implementation control, and

select at least a second security implementation control from the plurality of implementation controls and to include in the control chain when a health evaluation score value from the health evaluation score calculation does not meet a predetermined health evaluation score criterion.

6. The apparatus of claim 1, wherein the control chain generation module is configured to:

select the control assessor to monitor the hardware asset for compliance with the security guideline including performing a first health evaluation score calculation for the security implementation control at a first time, and

schedule a second health evaluation score calculation for the security implementation control at a second time when a health evaluation score value from the first health evaluation score calculation meets a predetermined health evaluation score criterion.

7. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive, from a control database, a guideline control to be implemented with respect to an asset, the guideline control including requirements to satisfy a guideline associated with the guideline control;

receive, from an asset database, an indication of the asset, the indication of the asset including attributes of the asset;

select, based on the requirements to satisfy the guideline and the attributes of the asset, an implementation control from a plurality of implementation controls and to be associated with the asset;

select, based on the implementation control and the requirements to satisfy the guideline, a control assessor to monitor the compliance of the asset with the guideline;

define a control chain including the guideline control, the implementation control, and the control assessor; and

send an instruction to apply the control chain to the asset such that the implementation control is implemented with respect to the asset and the control assessor monitors the asset for compliance with the guideline.

8. The non-transitory processor-readable medium of claim 7, wherein the control chain includes Plan of Action and Milestone (POAM) instructions, the code further comprising code to cause the processor to:

alter, based on the POAM instructions, a health evaluation score action performed by the control assessor for the implementation control in the control chain.

9. The non-transitory processor-readable medium of claim 7, wherein the control chain includes Plan of Action and Milestone (POAM) instructions, the code further comprising code to cause the processor to:

disable, based on the POAM instructions, a scheduled health evaluation score calculation for the implementation control.

10. The non-transitory processor-readable medium of claim 7, wherein the control chain includes Plan of Action and Milestone (POAM) instructions, the code further comprising code to cause the processor to:

disable, based on the POAM instructions, a scheduled health evaluation score modification by the control assessor, the health evaluation score modification is a modification of a control chain by the control assessor when the health evaluation score does not meet a pre-determined criterion.

11. The non-transitory processor-readable medium of claim 7, the code further comprising code to cause the processor to:

store the control chain in an aggregated control catalogue;

receiving a request, from a private control catalogue including user-specific control chains, to receive a copy of the control chain; and

providing a representation of the copy of the control chain to the private control catalogue.

12. The non-transitory processor-readable medium of claim 7, wherein the implementation control is a first implementation control from the plurality of implementation controls, the code further comprising code to cause the processor to:

receive an indication of a modification of the requirements in the guideline control;

select, based on the indication, a second implementation control from the plurality of implementation controls and to be associated with the asset; and

modify the control chain to include the second implementation control.

13. The non-transitory processor-readable medium of claim 7, wherein the implementation control is a first implementation control from the plurality of implementation controls, the code further comprising code to cause the processor to:

receive an indication of a modification of the requirements in the guideline control;

select, based on the indication, at least a second implementation control from the plurality of implementation controls and to be associated with the asset; and

modify the control chain to include the second implementation control but not the first implementation control.

14. The non-transitory processor-readable medium of claim 7, wherein the control assessor is configured to monitor the compliance of the asset with the guideline including performing a health evaluation score calculation for the implementation control, the code further comprising code to cause the processor to:

perform, using the control assessor, a control chain modification action in response to the health evaluation score calculation.

15. The non-transitory processor-readable medium of claim 7, wherein the control assessor is configured to monitor the compliance of the asset with the guideline including performing a health evaluation score calculation for the implementation control, the code further comprising code to cause the processor to:

modify the implementation control when a health evaluation score value from the health evaluation score calculation does not meet a predetermined health evaluation score criterion.

16. The non-transitory processor-readable medium of claim 7, wherein the implementation control is a first implementation control from the plurality of implementation controls, the control assessor is configured to monitor the compliance of the asset with the guideline including performing a health evaluation score calculation for the first implementation control, the code further comprising code to cause the processor to:

select at least a second implementation control to include in the control chain when a health evaluation score value from the health evaluation score calculation does not meet a predetermined health evaluation score criterion.

17. The non-transitory processor-readable medium of claim 7, wherein the control assessor is configured to monitor the compliance of the asset with the guideline including performing a health evaluation score calculation for the implementation control at a first time, the code further comprising code to cause the processor to:

schedule a second health evaluation score calculation for the implementation control at a second time when a health evaluation score value from the health evaluation score calculation meets a predetermined health evaluation score criterion.

18. The non-transitory processor-readable medium of claim 7, wherein the implementation control is a first implementation control from the plurality of implementation controls, the code further comprising code to cause the processor to:

select, based on the requirements to satisfy the guideline and the attributes of the asset, a second implementation control from the plurality of implementation controls and to be associated with the asset;

select, based on the second implementation control, a second control assessor; and

define a modified control chain including the guideline control, the first implementation control, the second implementation control, the first control assessor, and the second control assessor.

19. The non-transitory processor-readable medium of claim 7, wherein the implementation control is selected in part based on a comparison of control attributes in the guideline control, and control attributes in the implementation control,

the control assessor is selected in part based on a comparison of the control attributes in the implementation control, and control attributes in the control assessor.

20. The non-transitory processor-readable medium of claim 7, the code further comprising code to cause the processor to:

receive a request from a user to receive a control chain report;

retrieve control chain attribute data from a database in response to the request;

generate the control chain report based on the control chain attribute data; and

provide a representation of the control chain report to the user,

the control chain attribute data includes at least one of a control chain performance indicator;

a control chain health evaluation score;

a control chain asset mapping;

asset attributes associated with an asset in the control chain asset mapping;

or control attributes associated with each of the guideline control, implementation control, and control assessor.

21. An apparatus, comprising:

a translation module implemented in a memory or a processing device, the translation module configured to receive an indication of a guideline, the translation module configured to translate the indication of the guideline into a guideline control;

an implementation control module configured to receive, from a first user, an implementation control used to satisfy the guideline, the implementation control module configured to associate the implementation control with the guideline control;

an assessor control module configured to receive, from a second user, an assessor control used to monitor an asset'"'"'s compliance with the guideline, the assessor control module configured to associate the assessor control with the implementation control and the guideline control to define a control chain; and

a distribution module configured to receive, from a third user, a request for a solution associated with the guideline, the distribution module configured to provide the control chain to the third user such that the third user can implement the control chain.

22. The apparatus of claim 21, further comprising:

a data storage module coupled to the assessor control module, the data storage module configured to store the control chain in a database.

23. The apparatus of claim 21, wherein the distribution module is configured to provide a plurality of control chains for a selection by the third user, each control chain from the plurality of control chains includes a control chain ranking for that control chain from at least one of the first user and the second user.

24. A method, comprising:

receiving from a user interface a selection of a representation of an asset in the user interface and corresponding to an asset;

retrieving from a database an asset hierarchy associated with the asset and including at least one sub-asset associated with the asset;

displaying a representation of the at least one sub-asset associated with the asset in the user interface, the representation of the at least one sub-asset is displayed in an orbit surrounding the representation of the asset;

retrieving from the database attribute data associated with the at least one sub-asset, the attribute data including a health evaluation score of the at least one sub-asset; and

provide a representation of the attribute data associated with the at least one sub-asset in proximity to the representation of the asset in the user interface.

25. The method of claim 24, further comprising:

receiving an indication of a cursor over the representation of the asset;

retrieving from the database asset-specific attribute data in response to the indication, the asset-specific attribute data including a health evaluation score of the asset; and

providing the asset-specific attribute data to the user interface for display.

26. The method of claim 24, wherein the representation of the asset is a representation of an entity, the at least one sub-asset is an asset owned by the entity.

27. The method of claim 24, wherein the at least one sub-asset is a department in an organization, the department in the organization is further associated with a plurality of sub-sub-assets corresponding to assets of the department, a representation of each sub-sub-asset from the plurality of sub-sub-assets being displayed in an orbit surrounding the representation of the at least one sub-asset.