Method and device for scanning a plurality of computerized devices connected to a network

• US 8,566,939 B2
• Filed: 04/04/2006
• Issued: 10/22/2013
• Est. Priority Date: 10/04/2004
• Status: Active Grant

• Current Assignee: Promiimer Ltd.
• Original Assignee: Promisec Ltd. (C MER Industries Limited)
• Inventors: Suchowski, Ron Shay, Kotler, Hilik
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Sanders, Stephen
• Application Number:
  US11/396,602
• Publication Number:
  US 20060184682A1
• Time in Patent Office: 2,758 Days
• Field of Search: 726/23
• US Class Current: 726/23
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols

Abstract

Some embodiments of the invention relate to a method and a device for scanning a plurality of computerized devices connected to a network. According to some embodiments of the invention, a plurality of computerize devices to be scanned may be provided. A plurality of threads of an agentless module may be provided for scanning the plurality of computerized devices. Each of the plurality of threads of the agentless module may be associated with at least one of the plurality of computerized devices. The plurality of threads of the agentless module may be utilized to configure a plurality of remote access processes to scan in parallel and without using agents at least two of the plurality of remote computerized devices.

Claims

1. A method of remotely enforcing a policy within a plurality of computerized devices in a network, the method implemented by a plurality of computer readable instructions encoded on a non-transitory computer readable storage device, said instructions executable by a computer, said method comprising:

designating a data item and an associated action for each of a plurality of computerized devices;

causing, in parallel, a plurality of threads of a remote access process to instruct, without using an agent, the plurality of computerized devices to carry out the designated action regardless of whether or not actual data which corresponds to the designated data item is present in each of the remote computerized devices; and

repeating said causing for at least a subset of said plurality of computerized devices and said data items irrespective of a result of a previous iteration of said causing.

2. The method according to claim 1, where said repeating is initiated substantially immediately after a previous iteration of said causing is complete.

3. The method according to claim 1, where said repeating is initiated after a predefined time interval after a previous iteration of said causing.

4. The method according to claim 1 wherein said designating a data item comprises providing, for each of the plurality of computerized devices, data with respect to said data item.

5. The method according to claim 1, wherein said step of causing comprises associating at least one of the threads with two or more computerized devices.

6. The method according to claim 1, wherein said step of causing comprises determining the number of threads to be used in accordance with a predefined criterion.

7. The method according to claim 6, wherein said step of determining comprises determining the number of threads to be provided in accordance with one or more of the following:

a number of computerized devices on which said enforcing is to be made, a network performance parameter, a target enforcing speed, a connection speed with respect to the computerized devices on which said enforcing is to be made, various characteristics of the computerized devices, geographical location of the computerized devices on which said enforcing is to be made, statistical data collected in respect of previous enforcements.

8. The method according to claim 7, wherein said method further comprises associating each thread of the remote access process with at least one of the plurality of computerized devices in accordance with one or more of the following:

parameters associated with a connection to the computerized device, characteristics of the computerized device, geographical location of the computerized device, organizational location of the computerized devices, statistical data collected in respect of previous enforcements.

9. The method according to claim 8, wherein said step of associating further comprises associating each thread of the remote access process with a data item to be remotely enforced within a computerized device associated with the thread.

10. The method according to claim 9, wherein said step of causing a plurality of threads of the remote access process comprises determining the number of threads to be configured in parallel in accordance with at least one or more of the following:

a severity of a data item or data items to be enforced, a number of data items to be enforced, a target enforcing speed, a connection speed with respect to the computerized devices on which said enforcing is to be made.

11. The method according to claim 9, wherein said step of associating each thread of the remote access process with a data item to be remotely enforced within a computerized device associated with the thread, comprises associating a first thread of the remote access process with a first data item to be remotely enforced within a first computerized device and associating a second thread of the remote access process with a second data item to be remotely enforced within the first computerized device.

12. The method according to claim 10, wherein two or more threads of the remote access process are configured in parallel for remotely enforcing without using an agent a remote computerized device with respect to two or more different data items.

13. The method according to claim 4, wherein the data with respect to a data item to be enforced includes one or more of the following:

a path to a location within a computerized device, data with respect to a severity of a security threat associated with the data item, data with respect to a remote access process to be used for enforcing within a remote computerized device for data in respect of the data item, a security setting associated with the data item, a type of the data item.

14. The method according to claim 1, wherein said designated action is updating data in respect of a respective data item within a computerized device in accordance with a security setting associated with the data item.

15. The method according to claim 1, wherein a data item is one from a group including:

a configuration, an application, a file, a process, a service, a registry key, a registry value within a remote computerized device.

16. The method according to claim 1, wherein said enforcing is insensitive to a new attachment of any of the plurality of computerized devices to the network.

17. The method according to claim 1, wherein said enforcing is performed automatically in response to one or more of the following:

a completion of a previous enforcement, an event occurring within a computerized device connected to the network, a predefined schedule.

18. The method according to claim 1, wherein said method enables a relatively short turnaround time between said causing and said repeating.

47. A non-transitory computer readable storage device, encoding the instructions for performing the method according to claim 1.

48. The device according to claim 1, wherein the designated data items and corresponding actions are either stored in a database on the computer implementing the enforcement policy, or they can be entered in by the operator.

19. A device for enforcing a policy within a plurality of computerized devices in a network, said device comprising:

an enforcement module adapted to receive data designating a data item and an associated action for each of a plurality of computerized devices; and

an agentless module adapted to cause, in parallel, a plurality of threads of a remote access process to instruct, without using an agent, the plurality of computerized devices to perform the designated action within the plurality of remote computerized devices regardless of whether or not actual data which corresponds to the designated data item is present in each of the remote computerized devices.

20. The device according to claim 19 wherein said agentless module is further adapted to repeat said configure for at least a subset of said plurality of computerized devices and said data items irrespective of a result of a previous iteration of said configure.

21. The device according to claim 20, where said repeat is initiated substantially immediately after a previous iteration of said causing is complete.

22. The device according to claim 20, wherein said repeat is initiated after a predefined time interval after a previous iteration of said configure.

23. The device according to claim 19, wherein the agentless module is adapted to associate at least one of the threads with two or more computerized devices.

24. The device according to claim 19, wherein the agentless module is adapted to determine the number of threads to be configured in parallel.

25. The device according to claim 19, wherein the number of threads to be configured in parallel is manually selected by an operator.

26. The device according to claim 24, wherein the number of threads is determined in accordance with a predefined criterion.

27. The device according to claim 19, wherein said agentless module is adapted to cause a thread of the remote access processes to perform in parallel enforcement within at least two of the plurality of remote computerized devices based on one or more respective data items.

28. The device according to claim 27, wherein said agentless module is adapted to associate each thread of the remote access process with a data item to be enforced on a computerized device associated with that thread.

29. The device according to claim 27, wherein the agentless module is adapted to utilize the plurality of threads of the remote access process to update data within a computerized device in respect of a respective data item in accordance with a security setting associated with the data item.

30. The device according to claim 19, wherein a data item is selected from a group including:

a configuration, a file, a process, a service, a registry key, a registry value, a registry value within a remote computerized device.

31. The device according to claim 19, wherein the agentless module is adapted to initiate enforcement within the plurality of computerized devices, and wherein the initiation of the enforcement within the plurality of computerized devices is insensitive to a new attachment to the network of any one of the plurality of computerized devices.

32. The device according to claim 19, wherein the agentless module is adapted to automatically initiate enforcement within said computerized devices in response to one or more of the following:

a completion of a previous enforcement, an event occurring within a computerized device connected to the network, a predefined schedule.

49. The device according to claim 19, wherein the designated data items and corresponding actions are either stored in a database on the computer implementing the enforcement policy, or they can be entered in by the operator.

33. A system enabling a policy enforcement within a plurality of computerized devices in a network, said system comprising:

a plurality of computerized devices;

an operator'"'"'s computer, said operator'"'"'s computer comprising;

an enforcement module adapted to receive data designating a data item and an associated action for each of the plurality of computerized devices; and

an agentless module to cause, in parallel, a plurality of threads of a remote access process to instruct, without using an agent, the plurality of computerized devices to perform the designated action within the plurality of remote computerized devices, regardless of whether or not actual data which corresponds to the designated data item is present in each of the computerized devices.

34. The system according to claim 33 wherein said agentless module is further adapted to repeat said causing for at least a subset of said plurality of computerized devices and said data items irrespective of a result of a previous iteration of said causing.

35. The device according to claim 34, where said repeat is initiated substantially immediately after a previous iteration of said causing is complete.

36. The device according to claim 34, wherein said repeat is initiated after a predefined time interval after a previous iteration of said causing.

37. The device according to claim 33, wherein the agentless module is adapted to associate at least one of the threads with two or more computerized devices.

38. The device according to claim 33, wherein the agentless module is adapted to determine the number of threads.

39. The device according to claim 33, wherein the number of threads is manually selected by an operator.

40. The device according to claim 38, wherein the number of threads is determined in accordance with a predefined criterion.

41. The device according to claim 33, wherein said agentless module is adapted to cause a thread of the remote access processes to perform in parallel enforcement within at least two of the plurality of remote computerized devices based on one or more respective data items.

42. The device according to claim 41, wherein said agentless module is adapted to associate each thread of the remote access process with a data item to be enforced on a computerized device associated with that thread.

43. The device according to claim 41, wherein the agentless module is adapted to utilize the plurality of threads of the remote access process to update data within a computerized device in respect of a respective data item in accordance with a security setting associated with the data item.

44. The device according to claim 33, wherein a data item is selected from a group including:

a configuration, a file, a process, a service, a registry key, a registry value, a registry value within a remote computerized device.

45. The device according to claim 33, wherein the agentless module is adapted to initiate enforcement within the plurality of computerized devices, and wherein the initiation of the enforcement within the plurality of computerized devices is insensitive to a new attachment to the network of any one of the plurality of computerized devices.

46. The device according to claim 33, wherein the agentless module is adapted to automatically initiate enforcement within said computerized devices in response to one or more of the following:

a completion of a previous enforcement, an event occurring within a computerized device connected to the network, a predefined schedule.