DEPLOYMENT ASSURANCE CHECKS FOR MONITORING INDUSTRIAL CONTROL SYSTEMS

• US 20170140154A1
• Filed: 11/17/2015
• Published: 05/18/2017
• Est. Priority Date: 11/17/2015
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Knapp, Eric D., Carpenter, Seth G.
• Granted Patent: US 10,181,038 B2
• Time in Patent Office: Days
• CPC Class Codes: G05B 19/00 Programme-control systems
• CPC Class Codes: G05B 23/0208 characterized by the configuration of the monitoring system
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling

Abstract

This disclosure provides an apparatus and method for deployment assurance checks for monitoring industrial control systems and other systems. A method includes identifying, by a risk manager system, a plurality of connected devices that are vulnerable to cyber-security risks. The method includes determining devices to be monitored from the plurality of connected devices. The method includes evaluating system resource usage, by the risk manager system, on each device to be monitored. The method includes providing recommendations to a user as to whether or not the user should proceed with the monitoring, based on the evaluation.

Claims

1. A method comprising:

identifying, by a risk manager system, a plurality of connected devices that are vulnerable to cyber-security risks;

determining, by the risk manager system, devices to be monitored from the plurality of connected devices;

evaluating system resource usage, by the risk manager system, on each device to be monitored; and

providing recommendations to a user, by the risk manager system, as to whether or not the user should proceed with the monitoring, based on the evaluation.

2. The method of claim 1, further comprising verifying any software or hardware prerequisites on the devices to be monitored.

3. The method of claim 1, further comprising evaluating security prerequisites on the connected devices.

4. The method of claim 1, wherein identifying the plurality of connected devices includes performing an automatic discovery process by the risk manager system.

5. The method of claim 1, wherein the system resource usage includes processor usage, memory usage, and disk space usage.

6. The method of claim 1, further comprising enforcing the recommendations.

7. The method of claim 1, wherein identifying the plurality of connected devices includes receiving device information by the risk manager system from the user.

8. A risk manager system comprising:

a controller; and

a memory, the risk manager system configured to;

identify a plurality of connected devices that are vulnerable to cyber-security risks;

determine devices to be monitored from the plurality of connected devices;

evaluate system resource usage on each device to be monitored; and

provide recommendations to a user as to whether or not the user should proceed with the monitoring, based on the evaluation.

9. The risk manager system of claim 8, wherein the risk manager system is further configured to verify any software or hardware prerequisites on the devices to be monitored.

10. The risk manager system of claim 8, wherein the risk manager system is further configured to evaluate security prerequisites on the connected devices.

11. The risk manager system of claim 8, wherein the risk manager system is configured to identify the plurality of connected devices by performing an automatic discovery process.

12. The risk manager system of claim 8, wherein the system resource usage includes processor usage, memory usage, and disk space usage.

13. The risk manager system of claim 8, wherein the risk manager system is further configured to enforce the recommendations.

14. The risk manager system of claim 8, wherein the risk manager system is configured to identify the plurality of connected devices by receiving device information by the risk manager system from the user.

15. A non-transitory machine-readable medium encoded with executable instructions that, when executed, cause one or more processors of a risk manager system to:

identify a plurality of connected devices that are vulnerable to cyber-security risks;

identify cyber-security risks in the connected devices;

for each identified cyber-security risk, identify at least one possible cause, at least one recommended action, and at least one potential impact; and

display a user interface that includes a summary of the identified cyber-security to risks.

16. The non-transitory machine-readable medium of claim 15, wherein the non-transitory machine-readable medium is further encoded with instructions to verify any software or hardware prerequisites on the devices to be monitored.

17. The non-transitory machine-readable medium of claim 15, wherein the non-transitory machine-readable medium is further encoded with instructions to evaluate security prerequisites on the connected devices.

18. The non-transitory machine-readable medium of claim 15, wherein the instructions to identify the plurality of connected devices includes instructions to perform an automatic discovery process by the risk manager system.

19. The non-transitory machine-readable medium of claim 15, wherein the system resource usage includes processor usage, memory usage, and disk space usage.

20. The non-transitory machine-readable medium of claim 15, wherein the non-transitory machine-readable medium is further encoded with instructions to enforce the recommendations.