SYSTEM AND METHOD FOR PERFORMING REMOTE SECURITY ASSESSMENT OF FIREWALLED COMPUTER

• US 20170180409A1
• Filed: 08/29/2016
• Published: 06/22/2017
• Est. Priority Date: 08/15/2008
• Status: Active Grant

• Current Assignee: Qualys Incorporated
• Original Assignee: Qualys Incorporated
• Inventors: ALI-AHMAD, Wissam, KANDEK, Wolfgang, KRUSE, Holger, DEWAN, Vikas, MAZBOUDI, Khair-ed-dine, JAMPANI, Ganesh, OKUMURA, Kenneth K.
• Granted Patent: US 10,015,187 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 3/048 Interaction techniques based on graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Methods and systems for scanning an endpoint terminal across an open computer network are disclosed. An exemplary method includes providing a scanner engine in a computer server in communication with an open computer network, and establishing a secure connection across the open computer network between the scanner engine and a scanner agent installed on the endpoint terminal in communication with the open computer network. Commands for collecting data regarding the endpoint terminal are sent from the scanner engine across the secure connection to the scanner agent. The scanner engine then receives the collected data from the scanner agent across the secure connection, analyzes the data to assess a current posture of the endpoint terminal, and determines any updates for the endpoint terminal from the analysis. Updates are sent across the secure connection to the scanner agent for installation on the endpoint terminal, and the secure connection may then be terminated.

Claims

1-32. -32. (cancelled)

33. A method comprising:

providing an endpoint device comprising a web browser in communication with a network;

providing a scanner server in communication with the network, wherein the scanner server comprises a scanner engine;

establishing a secure layer connection between the scanner engine of the scanner server and a plug-in of the web browser of the endpoint device;

transmitting commands for collecting data associated with the endpoint device from the scanner engine to the web browser plug-in via the secure layer connection;

receiving data associated with the endpoint device at the scanner engine and from the web browser plug-in via the secure layer connection, wherein the received data was collected using the web browser plug-in;

analyzing the received data using the scanner engine to assess a current security vulnerability posture of the endpoint system;

identifying, using the scanner engine, an update for the endpoint device based on analyzing the received data; and

transmitting the update from the scanner engine to the endpoint device.

34. The method of claim 33, wherein the endpoint device is protected from the network with a firewall.

35. The method of claim 33, wherein the web browser further comprises a graphical user interface for use by a user of the endpoint device in initiating the collection of the received data.

36. The method of claim 33, wherein the secure layer connection encrypts at least one of the commands for collecting data associated with the endpoint device, the received data associated with the endpoint device, and the update for the endpoint device.

37. The method of claim 33, wherein the update comprises virus definition updates.

38. The method of claim 33, wherein the scanner server is coupled to the network through a proxy server.

39. The method of claim 33, wherein the secure layer connection is established without requiring credentialed access.

40. A scanning server comprising:

at least one computer readable storage including instructions; and

at least one processing device configured to execute the instructions, wherein executing the instructions causes the at least one processing device to perform the operations of;

establishing a secure layer connection between a scanner engine comprised in the scanner server and a web browser plug-in of an endpoint device, wherein each of the scanning server and the endpoint device are in communication with a network;

transmitting commands for collecting data associated with the endpoint device from the scanner engine to the web browser plug-in via the secure layer connection;

receiving data associated with the endpoint device at the scanner engine and from the web browser plug-in via the secure layer connection, wherein the received data was collected using the web browser plug-in;

analyzing the received data using the scanner engine to assess a current security vulnerability posture of the endpoint system;

identifying, using the scanner engine, an update for the endpoint device based on analyzing the received data; and

transmitting the update from the scanner engine to the endpoint device.

41. The scanning server of claim 40, wherein the endpoint device is protected from the network with a firewall.

42. The scanning server of claim 40, wherein the endpoint device comprises a web browser, and wherein the web browser comprises a graphical user interface for use by a user of the endpoint device in initiating the collection of the received data.

43. The scanning server of claim 40, wherein the secure layer connection encrypts at least one of the commands for collecting data associated with the endpoint device, the received data associated with the endpoint device, and the update for the endpoint device.

44. The scanning server of claim 40, wherein the update comprises virus definition updates.

45. The scanning server of claim 40, wherein the scanner server is coupled to the network through a proxy server.

46. The method of claim 40, wherein the secure layer connection is established without requiring credentialed access.

47. A system comprising:

an endpoint device comprising a web browser in communication with a network;

a scanner server in communication with the network, wherein the scanner server comprises a scanning engine for conducting scans of the endpoint device, wherein conducting scans of the endpoint device comprises;

establishing a secure layer connection between the scanner engine of the scanner server and a plug-in of the web browser of the endpoint device;

transmitting commands for collecting data associated with the endpoint device from the scanner engine to the web browser plug-in via the secure layer connection;

receiving data associated with the endpoint device at the scanner engine and from the web browser plug-in via the secure layer connection, wherein the received data was collected using the web browser plug-in;

analyzing the received data using the scanner engine to assess a current security vulnerability posture of the endpoint system;

identifying, using the scanner engine, an update for the endpoint device based on analyzing the received data; and

transmitting the update from the scanner engine to the endpoint device.

48. The system of claim 47, wherein the endpoint device is protected from the network with a firewall.

49. The system of claim 47, wherein the web browser further comprises a graphical user interface for use by a user of the endpoint device in initiating the collection of the received data.

50. The system of claim 47, wherein the secure layer connection encrypts at least one of the commands for collecting data associated with the endpoint device, the received data associated with the endpoint device, and the update for the endpoint device.

51. The system of claim 47, wherein the update comprises virus definition updates.

52. The system of claim 47, wherein the scanner server is coupled to the network through a proxy server.