INFRASTRUCTURE MONITORING TOOL FOR COLLECTING INDUSTRIAL PROCESS CONTROL AND AUTOMATION SYSTEM RISK DATA

• US 20160234241A1
• Filed: 09/30/2015
• Published: 08/11/2016
• Est. Priority Date: 02/06/2015
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Talamanchi, Venkata Srinivasulu Reddy, Boice, Eric T., Kowalczyk, Andrew W., Gadhe, Ganesh P., Dietrich, Kenneth W.
• Granted Patent: US 10,021,125 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

This disclosure provides an infrastructure monitoring tool, and related systems and methods, for collecting industrial process control and automation system risk data, and other data. A method includes discovering multiple devices in a computing system by a risk manager system. The method includes grouping the multiple devices into multiple security zones by the risk manager system. The method includes, for each security zone, causing one or more devices in that security zone to provide information to the risk manager system identifying alerts and events associated with the one or more devices. The method includes storing the information, by the risk manager system, in association with unique identifier values, the unique identifier values identifying different types of information.

Claims

1. A method comprising:

discovering multiple devices in a computing system by a risk manager system;

grouping the multiple devices into multiple security zones by the risk manager system;

for each security zone, causing one or more devices in that security zone to provide information to the risk manager system identifying alerts and events associated with the one or more devices; and

storing the information, by the risk manager system, in association with unique identifier values, the unique identifier values identifying different types of information.

2. The method of claim 1, wherein the risk manager system uses the System Center Operations Manager (SCOM) infrastructure monitoring software tool from MICROSOFT CORPORATION.

3. The method of claim 1, further comprising sending configuration data to the one or more devices in each security zone that defines the alerts and events to be provided by each device.

4. The method of claim 1, wherein the one or more devices in that security zone provide information to the risk manager system at the time of discovery and also when additional events are later detected.

5. The method of claim 1, wherein the one or more devices in that security zone provide information to the risk manager system at preconfigured intervals.

6. The method of claim 1, further comprising calculating risks based on the stored information by performing queries using the unique identifier values.

7. The method of claim 1, further comprising categorizing the information collected from the one or more devices in each security zone to calculate risk values.

8. A risk manager system comprising:

a controller; and

a display, the risk manager system configured to

discover multiple devices in a computing system;

group the multiple devices into multiple security zones;

for each security zone, cause one or more devices in that security zone to provide information identifying alerts and events associated with the one or more devices; and

store the information in association with unique identifier values, the unique identifier values identifying different types of information.

9. The risk manager system of claim 8, wherein the risk manager system uses the System Center Operations Manager (SCOM) infrastructure monitoring software tool from MICROSOFT CORPORATION.

10. The risk manager system of claim 8, wherein the risk manager system sends configuration data to the one or more devices in each security zone that defines the alerts and events to be provided by each device.

11. The risk manager system of claim 8, wherein the one or more devices in that security zone provide information to the risk manager system at the time of discovery and also when additional events are later detected.

12. The risk manager system of claim 8, wherein the one or more devices in that security zone provide information to the risk manager system at preconfigured intervals.

13. The risk manager system of claim 8, wherein the risk manager system calculates risks based on the stored information by performing queries using the unique identifier values.

14. The risk manager system of claim 8, wherein the risk manager system also categorizes the information collected from the one or more devices in each security zone to calculate risk values.

15. A non-transitory machine-readable medium encoded with executable instructions that, when executed, cause one or more processors of a risk manager system to:

discover multiple devices in a computing system;

group the multiple devices into multiple security zones;

for each security zone, cause one or more devices in that security zone to provide information identifying alerts and events associated with the one or more devices; and

store the information in association with unique identifier values, the unique identifier values identifying different types of information.

16. The non-transitory machine-readable medium of claim 15, wherein the risk manager system uses the System Center Operations Manager (SCOM) infrastructure monitoring software tool from MICROSOFT CORPORATION.

17. The non-transitory machine-readable medium of claim 15, wherein the risk manager system sends configuration data to the one or more devices in each security zone that defines the alerts and events to be provided by each device.

18. The non-transitory machine-readable medium of claim 15, wherein the one or more devices in that security zone provide information to the risk manager system at the time of discovery and also when additional events are later detected.

19. The non-transitory machine-readable medium of claim 15, wherein the one or more devices in that security zone provide information to the risk manager system at preconfigured intervals.

20. The non-transitory machine-readable medium of claim 15, wherein the risk manager system calculates risks based on the stored information by performing queries using the unique identifier values.