Method and system for configuring and scheduling security audits of a computer network

• US 7,712,138 B2
• Filed: 06/21/2007
• Issued: 05/04/2010
• Est. Priority Date: 01/31/2001
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Zobel, Robert David, Singer, Christopher S., Millar, Sharon A., Dodd, Timothy David, Nesfeder, David Gerald Jr.
• Primary Examiner(s): Orgad; Edan
• Assistant Examiner(s): SHAW, YIN CHEN
• Application Number:
  US11/821,194
• Publication Number:
  US 20070250935A1
• Time in Patent Office: 1,048 Days
• Field of Search: 726 22- 25, 713/188, 709224-225
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Managing the selection and scheduling of security audits run on a computing network. The computer network is surveyed by a security audit system to determine the function and relative importance of the elements in the network. Based on function and priority, a more thorough type of security audit is selected to run against each of the network elements by the security audit system. The security audit can also be automatically scheduled based on the information gathered from the survey. Once the system runs the security audit, a vulnerability assessment can be calculated for each element in the network. The vulnerability assessment can be presented in a format that facilitates interpretation and response by someone operating the system. The vulnerability assessment can also be used to configure and schedule future security audits.

Claims

1. A computer-implemented method for configuring and scheduling a security audit of a computer network comprising the steps of:

a security audit system conducting a discovery scan to identify a first host of the computer network and assigning an asset value for the first host, wherein the asset value is based on information collected during the discovery scan and indicates the importance of the first host in the network;

the security audit system comprising an active scan engine, the active scan engine configuring an audit scan to perform on the first host by selecting a first scan policy based on the asset value and a first scan frequency based on the asset value, wherein the audit scan is more thorough than the discovery scan;

the active scan engine scheduling a time to perform the audit scan on the first host;

the security audit system running the audit scan according to the first scan policy and the first scan frequency at the scheduled time on the first host; and

the active scan engine calculating a security score for the first host based on the audit scan by summing one or more vulnerabilities associated with the first host.

2. The method of claim 1, further comprising the step of the active scan engine receiving a blackout time during which no audit scan can be scheduled.

3. The method of claim 1, wherein the step of the security audit system conducting a discovery scan further comprises identifying at least one function or at least one vulnerability associated with the first host.

18. The computer-implemented method of claim 1, wherein the security audit system runs the audit scan on a second host at the same time as the first host, the second host also associated with the first scan policy and the first scan frequency.

19. The computer-implemented method of claim 1, wherein the step of the security audit system assigning an asset value for the first host comprises selecting the greatest of an operating system asset value, a service asset value, and a vulnerability asset value.

4. A method for assessing the security of a network comprising the steps of:

a security audit system receiving an initial scan identifying a first network host and the function of the first network host and assigning an asset value for the first network host, wherein the asset value is based on information collected during the initial scan and indicates the importance of the first network host in the network;

the security audit system comprising an active scan engine, the active scan engine selecting an audit scan to perform on the first network host, the audit scan comprising a first scan policy based on the asset value and a first scan frequency based on the asset value, wherein the audit scan is more thorough than the initial scan;

the active scan engine scheduling the audit scan to perform on the first network host;

the security audit system performing the audit scan according to the first scan policy and the first scan frequency on the first network host at the scheduled time;

the active scan engine receiving data from the selected audit scan of the first network host; and

the active scan engine computing a security score for the first network host from the selected audit scan by summing one or more vulnerabilities associated with the first network host.

5. The method of claim 4, further comprising the active scan engine modifying the selected audit scan;

said modification based on the data received from the selected audit scan.

6. The method of claim 4, wherein the step of the security audit system receiving an initial scan comprises:

identifying an operating system for the first network host;

identifying a service for the first network host, the service indicating the first network host'"'"'s function; and

identifying a vulnerability associated with the first network host.

20. The method of claim 4, wherein the security audit system performs the audit scan on a second network host at the same time as the first network host, the second network host also associated with the first scan policy and the first scan frequency.

21. The method of claim 4, wherein the step of the security audit system assigning an asset value for the first network host comprises selecting the greatest of an operating system asset value, a service asset value, and a vulnerability asset value.

7. A computer program product for assessing the security of a network, the computer program product comprising:

a computer readable storage device;

first program instructions for receiving an initial scan identifying a network host and assigning an asset value for the network host, wherein the asset value is based on information collected during the initial scan and indicates the importance of the network host;

second program instructions for selecting an audit scan to perform on the network host, the audit scan comprising a first scan policy based on the asset value and a first scan frequency based on the asset value, wherein the audit scan is more thorough than the initial scan;

third program instructions for performing the selected audit scan on the network in accordance with the first scan policy and the first scan frequency;

fourth program instructions for receiving data from the selected audit scan of the network host; and

fifth program instructions for computing a security score for the network host from the selected audit scan by summing one or more vulnerabilities associated with the network host;

wherein the first, second third, fourth, and fifth program instructions are stored on the computer readable storage device.

8. The computer program product of claim 7, further comprising sixth program instructions for scheduling the selected audit scan, said scheduling based on the initial scan.

9. The computer program product of claim 7, further comprising seventh program instructions for modifying the selected audit scan, said modification based on the data received from the selected audit scan.

10. The computer program product of claim 7, wherein the first program instructions for receiving an initial scan further comprise:

program instructions for identifying an operating system and a service for the network host; and

program instructions for identifying a vulnerability associated with the network host.

11. A system for configuring and scheduling a security audit of a computer network comprising:

a security audit system comprising first program instructions for conducting a discovery scan to identify a host of a computer network and assigning an asset value for the host, wherein the asset value is based on information collected from the discovery scan and indicates the importance of the host in the network,

the security audit system comprising an active scan engine, the active scan engine comprising second program instructions for configuring and scheduling an audit scan of the host, the audit scan comprising a scan policy based on the asset value and a scan frequency based on the asset value wherein the audit scan is more thorough than the discovery scan, and computing a security score for the host from the selected audit scan by summing one or more vulnerabilities associated with the host;

a console comprising third program instructions for receiving information from the security audit system and transmitting information to the security audit system about the discovery scan and the audit scan; and

a computer readable storage device on which the first, second, and third program instructions are stored.

12. The system of claim 11, wherein the first program instructions of the security audit system are further operable for conducting a discovery scan to:

identify a function for the host; and

identify a vulnerability for the host.

13. The system of claim 11, wherein the first program instructions of the security audit system check a blackout schedule before scheduling an audit scan.

14. The system of claim 11, wherein the security audit system further comprises a system scanning engine comprising fourth program instructions for detecting a particular vulnerability on the host.

15. The system of claim 11, wherein the security audit system further comprises an Internet scanning engine comprising fifth program instructions for performing a discovery scan on the network.

16. The system of claim 11, wherein the security audit system further comprises a database scanning engine comprising sixth program instructions for detecting vulnerabilities associated with database hosts within the network.

17. The system of claim 11, wherein the security audit system further comprises an active scan engine comprising seventh program instructions for selecting, coordinating, and scheduling various discovery and audit scans to be performed on the computer network.