Security management system including feedback and control

• US 7,472,422 B1
• Filed: 09/10/2003
• Issued: 12/30/2008
• Est. Priority Date: 09/10/2003
• Status: Expired due to Fees

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Agbabian, Paul M.
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Hoffman; Brandon S
• Application Number:
  US10/660,225
• Time in Patent Office: 1,938 Days
• Field of Search: 726/25
• US Class Current: 726/25
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system uses automatic feedback and control to secure a network infrastructure by iterative convergence of the network'"'"'s security structure to meet a security policy. Following initialization, a security feedback control system of the security management system makes dynamic adjustments to the system using bi-directional services that are controlled via policy decision components, without user intervention.

Claims

1. A system comprising:

a security management system comprising;

a processor; and

a memory coupled to said processor, said memory having stored therein a network security feedback and control system;

wherein said network security feedback and control system receives a plurality of normalized events and issues at least one normalized command in response to a predefined event in said plurality of normalized events;

a security management agent coupled to said security management system wherein said security management agent collects normalized events generated by one or more managed products and forwards said normalized events to said security management system, further wherein said security management agent receives normalized commands from said security management system and forwards said normalized commands to at least one managed product; and

at least one managed product coupled to said security management agent wherein said at least one managed product generates and transfers at least one normalized event to said security management agent.

2. The system of claim 1 wherein said network security feedback and control system comprises:

a feedback and control manager wherein said feedback and control manager processes said at least one normalized event and generates said at least one normalized command.

3. The security management system of claim 2 wherein said feedback and control manager includes at least one rules engine wherein said rules engine includes a rule having a condition object that uses information from said at least one normalized event.

4. The system of claim 1 further comprising:

a managed node coupled to said security management system.

5. The system of claim 4 wherein said managed node further comprises:

said security management agent executing on said managed node.

6. The system of claim 5 wherein said at least one managed product receives normalized commands from said security management agent.

7. A system comprising:

a processor; and

a memory coupled to said processor, said memory having stored therein an event subscription filter and a feedback and control manager coupled to said event subscription filter;

wherein said event subscription filter receives a plurality of normalized events, generated by one or more managed products, from a security management agent and passes normalized events, for which said system is registered, to said feedback and control manager; and

wherein said feedback and control manager processes at least one normalized event received from said event subscription filter and issues at least one normalized command to at least one security management agent for passing to at least one of said one or more managed products for use in dynamically implementing a predefined security policy.

8. The system of claim 7 further comprising:

a knowledge database coupled to said feedback and control manager.

9. The system of claim 7 further comprising:

a directory coupled to said feedback and control manager.

10. The system of claim 9 further comprising:

a configuration adapter connected between said feedback and control manager and said directory.

11. The system of claim 7 wherein said feedback and control system further comprises a rules engine coupled to said event subscription filter.

12. The system of claim 7 further comprising:

a security management agent coupled to said event subscription filter.

13. The system of claim 12 further comprising:

at least one managed product coupled to said security management agent.

14. A method comprising:

receiving a plurality of normalized events generated by managed products by a network security feedback and control system from a security management agent; and

using information in said plurality of normalized events by said network feedback and control system in dynamically implementing a predefined security policy by issuing at least one normalized command in response to a predefined event in said plurality of normalized events to a security management agent for passing to at least one managed product.

15. A computer-program product comprising a tangible computer-readable medium configured to store computer program code for a method comprising:

receiving a plurality of normalized events generated by managed products by a network security feedback and control system from a security management agent; and

using information in said plurality of normalized events by said network feedback and control system in dynamically implementing a predefined security policy by issuing at least one normalized command in response to a predefined event in said plurality of normalized events to a security management agent for passing to at least one managed product.

16. A computer system:

comprising;

a processor; and

a memory coupled to said processor, said memory having stored therein a security management system, said security management system comprising;

means for receiving a plurality of normalized events generated by managed products by a network security feedback and control system from a security management agent; and

means for using information in said plurality of normalized events by said network feedback and control system in dynamically implementing a predefined security policy by issuing at least one normalized command in response to a predefined event in said plurality of normalized events to a security management agent for passing to at least one managed;

product.