Assessing network security risk using best practices

• US 8,176,561 B1
• Filed: 04/15/2009
• Issued: 05/08/2012
• Est. Priority Date: 12/14/2006
• Status: Active Grant

• Current Assignee: SolarWinds Worldwide LLC (SolarWinds Corp.)
• Original Assignee: Athena Security, Inc. (SolarWinds Corp.)
• Inventors: Hurst, David, Swamy, Sowmitri, Reddy, Chandrasekhara, Gurnani, Anjali
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US12/424,316
• Time in Patent Office: 1,119 Days
• Field of Search: 726/25, 726/1, 726/11, 726/14, 716/11, 716/14
• US Class Current: 726/25
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A method and appertaining system for implementing the method are provided that utilize predefined Best Practice Templates that are rules/criteria for assessing the security of a particular network and devices on the network. A value is determined for each object and connection within a network as to whether it passes or fails one of the Best Practice criteria, and a pass ratio is determined for a particular Best Practice. Numerous Best Practice tests may be run, and an overall total value based on the collective sum of the Best Practice measurements is determined. This value can be utilized to provide a user with information that relates to the overall security of a network and can be used in compliance determinations and network architecture design.

Claims

1. A method on a computer for assessing network security in a network topology using best practice templates (BPTs), comprising:

providing a BPT catalog comprising a plurality of BPTs, wherein each BPT comprises a best practice (BP) that comprises;

an identification predicate returning identification results over a network related object set having one or more objects and object values, and

an evaluation predicate returning a Boolean result of TRUE or FALSE or that can be evaluated to PASS or FAIL;

identifying one or more targets for the assessment using the BP;

for each target, evaluating compliance of the target using evaluation criteria that are a part of the BP evaluation predicate as PASS or FAIL;

a processor of the computer determining a composite compliance result across all targets as being PASS if all targets evaluated to PASS; and

displaying or storing the compliance result.

2. The method according to claim 1, wherein the targets are selected from the group consisting of network paths in the topology, networks in the topology, devices in the topology, other structural portions of the topology, and functional portions of the topology.

3. The method according to claim 1, wherein the identification predicates are selected from the group consisting of packet flow predicates, device predicates, network predicates, tool preference predicates, and topology node predicates.

4. The method according to claim 3, wherein:

the packet flow predicate comprises two parameters for identifying paths;

a property or value to identify topology nodes that could be an originating node of the path, and a property or value to identify a destination nodes for this path;

the device predicate comprises a single parameter to identify devices using a defined set of properties;

the network predicate comprises a single parameter to identify networks using a defined set of properties;

the tool preference predicate comprises a single parameter to identify tools using a defined set of properties; and

the topology node predicate comprises a single parameter to identify topology nodes using a defined set of properties.

5. The method according to claim 1, wherein the evaluation predicates are selected from the group consisting of policy filter predicates, device property predicates, network property predicates, topology node property predicates, anti-spoof predicates, tool preference predicates, path content predicates, and rule analysis predicates.

6. The method according to claim 5, wherein:

the policy filter predicate specifies service and action parameters that are used in the evaluating for one or more given topology paths;

the device property predicate specifies device properties indicating device features or device behaviors that are checked and associated values for the evaluating step;

the network property predicate specifies network properties indicating network features or network behaviors that are checked and associated values for the evaluating step;

the topology node property predicate specifies a list of properties associated with a topology node that are checked for the evaluating step;

the anti-spoof predicate specifies properties or values relating to firewall and security devices that are checked for the evaluating step;

the tool preference predicate specifies properties that permit looking at preferences configured with in the software used in support and maintenance of the network;

the path content predicate specifies properties permitting evaluation of the content type of the given paths; and

the rule analysis predicate specifies properties permitting evaluation of the rules present in a device, including various match criteria and actions that can be matched against rules of a device.

7. The method according to claim 1, further comprising saving a proof of compliance with the BP for the target.

8. The method according to claim 7, wherein the proof of compliance is selected from the group consisting of a rule trail, a configuration setting, recording details of the evaluation criteria for the target, and displaying details of the evaluation criteria for the target.

9. The method according to claim 7, wherein the determining of the composite compliance further includes determining a score related to a target pass rate.

10. The method according to claim 1, wherein the determining of the composite compliance further comprises:

assembling the compliance proofs into an aggregated compliance proof; and

displaying or storing the aggregated compliance proof.

11. The method according to claim 1, further comprising combining a plurality of compatible predicates into an expression that can be evaluated as true of false, using Boolean logic operators.

12. The method according to claim 1, wherein the composite compliance result is expressed as a percentage of compliances for each target evaluated as a PASS over the total of all targets evaluated.

13. The method according to claim 1, wherein the BPT catalog comprises BPs that ensure compliance to a regulatory framework, the method further comprising:

identifying BPs necessary to comply with the regulatory framework; and

providing an indication of regulatory framework compliance only if all identified BPs necessary to comply with the regulatory framework are met.

14. The method according to claim 13, wherein regulatory framework is selected from the group consisting of PCI, HIPAA, GLBA, ISO27001, and CoBIT.

15. The method according to claim 14, wherein each regulatory framework is associated with a separate set of BPs in a BPT catalog for a particular regulatory framework.

16. The method according to claim 1, wherein the BP further comprises a category designation for the BP.

17. The method according to claim 16, wherein the category designations are selected from the group consisting of device configuration, access policy, and network architecture.

18. The method according to claim 1, wherein the BP further comprises a criticality designation for the BP.

19. The method according to claim 1, wherein displaying the compliance result comprises displaying a graphic indicator on a monitor of a user interface device related to a measure of a degree of compliance.

20. A system for assessing network security in a network topology using BPTs, comprising:

a processor;

a memory for storing algorithms that execute on the processor;

a BPT catalog residing on a storage element of the system comprising a plurality of BPTs, wherein each BPT comprises a best practice (BP) that comprises;

an identification predicate returning identification results over a network related object set having one or more objects and object values, and

an evaluation predicate returning a Boolean result of TRUE or FALSE or that can be evaluated to PASS or FAIL;

an algorithm for identifying one or more targets for the assessment using the BP, and that, for each target, evaluates compliance of the target using evaluation criteria that are a part of the BP evaluation predicate as PASS or FAIL;

an algorithm for determining a composite compliance result across all targets as being PASS if all targets evaluated to PASS; and

at least one of a user interface for displaying the composite compliance result, and a data storage for storing the composite compliance result.