Security measure status self-checking system

• US 8,321,945 B2
• Filed: 06/03/2008
• Issued: 11/27/2012
• Est. Priority Date: 06/05/2007
• Status: Expired due to Fees

• Current Assignee: Hitachi Solutions Limited (Hitachi, Ltd.)
• Original Assignee: Hitachi Solutions Limited (Hitachi, Ltd.)
• Inventors: Nakagawa, Katsuyuki
• Primary Examiner(s): Patel, Nirav B
• Application Number:
  US12/532,172
• Publication Number:
  US 20100064342A1
• Time in Patent Office: 1,638 Days
• Field of Search: 726/1, 726/2, 726 22- 25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2115 Third party

Abstract

A security measure status self-checking system which can determine the security measure status in a more simplified and effective manner by focusing on the information leakage measure in the security measures, managing the PC'"'"'s security measure status and the user'"'"'s take-out operation status in an integrated and unitary manner, and providing security policy samples. Accordingly, the client computer collects security inventory information and operation log information and transmits the information to the server computer. Further, the server computer stores the security inventory information and the operation log information transmitted from the client computer and determines whether or not the information conforms to the security policy which has been set in advance. The check result is displayed on the server computer and when a policy violation is detected, the manager and the client are notified of that effect.

Claims

1. A security measure status self-checking system applied to a system having a server computer and a plurality of client computers,

the client computer including:

collection means for collecting security inventory information which is information regarding local hardware and software resources, an IT environment use status which is information regarding setting environment of the local hardware and software resources, and operation log information which is history information regarding local user operations on the client computer; and

collected information transmission means for transmitting the collected information to the server computer; and

the server computer including;

storage means for storing the collected information including the security inventory information, the IT environment use status, and the operation log information transmitted from one or more of the client computers;

security policy storage means for storing a security policy which is data indicating a policy regarding the security measure status of the self-checking system;

policy conformance inspection means for reading the security inventory information, the IT environment use status, and the operation log information of each client computer stored in the storage means and determines whether or not a security policy violation has occurred by checking whether the security inventory information, the IT environment use status, and the operation log information of each client computer stored in the storage means conforms to the security policy stored in the security policy storage means;

information display means for displaying an inspection result by the policy conformance inspection means, when a number of client computers that violate a security policy exceeds a predetermined threshold, the information display means of the server computer displays a violation level warning indicating that the security policy has been violated; and

notification means for notifying the security policy violation to a manager of the self checking system when the security policy violation is detected by the policy conformance inspection means, wherein a method by which the manager is notified is pre-selected,

wherein the security policy includes (i) a computer measure status policy which is one or more conditions for checking the security inventory information and the IT environment use status; and

(ii) a take-out control measure status policy which is one or more conditions for checking the operation log information,

wherein the policy conformance inspection means determines that the security policy violation has occurred when a number of occurrences of violating the computer measure status policy is once or more during a predetermined period or when a number of occurrences of violating the take-out control measure status policy exceeds a threshold during the predetermined period,

wherein the one or more conditions of the computer measure status policy relate to the installation, execution or updating of software, and

wherein the one or more conditions of the take-out control measure status policy relate to the transfer of data to external media, CD or DVD, dedicated USB memory or printing of data with a watermark.

2. The security measure status self-checking system according to claim 1, wherein

the client computer further includes warning execution means for outputting a warning based on a warning instruction transmitted from the server computer, and

when the security policy violation is detected by the policy conformance inspection means, the server computer transmits a warning instruction to the client computer where the security policy violation is detected.

3. The security measure status self-checking system according to claim 2, wherein

when the number of security policy violations detected in the client computer exceeds a predetermined threshold, the means for transmitting the warning instruction of the server computer transmits the warning instruction to the client computer.

4. The security measure status self-checking system according to claim 1, wherein

the one or more conditions of the computer measure status policy include one or more of whether encryption software is installed, whether take-out control software is installed, whether illegal software has been executed, whether anti-virus software is installed, whether a pattern definition file is up to date, whether a virus scan is periodically executed, and whether a security patch has been installed, and

the one or more conditions of the take-out control measure status policy include one or more of whether data has been taken to external media without encryption, whether data has been taken to external media with encryption, whether data has been written to CD or DVD, whether data has been taken to a dedicated USB memory device, and whether printing has occurred with a watermark.

5. The security measure status self-checking system according to claim 2, wherein

the one or more conditions of the computer measure status policy include one or more of whether encryption software is installed, whether take-out control software is installed, whether illegal software has been executed, whether anti-virus software is installed, whether a pattern definition file is up to date, whether a virus scan is periodically executed, and whether a security patch has been installed, and

the one or more conditions of the take-out control measure status policy include one or more of whether data has been taken to external media without encryption, whether data has been taken to external media with encryption, whether data has been written to CD or DVD, whether data has been taken to a dedicated USB memory device, and whether printing has occurred with a watermark.