Scalable system for monitoring network system and components and methodology therefore

• US 20020078382A1
• Filed: 05/15/2001
• Published: 06/20/2002
• Est. Priority Date: 11/29/2000
• Status: Abandoned Application

• Current Assignee: Security and Intrusion Detection Research Labs LL
• Original Assignee: Security and Intrusion Detection Research Labs LL
• Inventors: Sheikh, Ali, Jordan, Jason, Tabone, Brian
• Application Number:
  US09/858,085
• Publication Number:
  US 20020078382A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0866 Checking the configuration
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present invention is a security software methodology and system that takes an internal approach to mitigating security risks from authorized and unauthorized users. The security software system uses the methodology of monitoring, in great detail, any configuration changes made to information systems within a network. These systems and applications include web servers, firewalls, proxy servers, log servers, intrusion detection software systems, routers and any other device or application which can be considered a part of the enterprise information system infrastructure.

Claims

1. A method of monitoring a plurality of security parameters for a networked system having a first server and at least one second server, the networked system having a transport communication layer, the transport communication layer having a master transport located on the first server, the method comprising the steps of:

comparing a data set located within a resident program located on the at least one second server against a rule set generated by a user;

generating a result forwardable to the master transport based on the step of comparing;

collecting the results in the first server; and

reporting the results from the first server to the user.

2. The method of claim 1 wherein the first server concurrently performs other networking tasks during the steps of comparing, generating, collecting, or reporting.

3. The method of claim 1 wherein the step of comparing is performed by an agent transport located on the at least one second server.

4. The method of claim 3 wherein at least one second server concurrently performs other networking tasks during the steps of comparing, generating, collecting, or reporting.

5. The method of claim 3 further comprising:

providing a list of one or more sensor programs for comparing data sets in a task list resident in the agent transport.

6. The method of claim 5 further comprising:

accessing, by the agent transport, the task list; and

selecting a resident program to monitor.

7. The method of claim 3 further comprising

selectively accessing, by the transport agent, a sensor program on the second server.

8. The method of claim 7, the step of comparing performed at least in part by the sensor program.

9. The method of claim 8 further comprising:

reordering the task list.

10. The method of claim 8 wherein the sensor program is responsible for monitoring an as yet unmonitored program resident on the second server.

11. The method of claim 8 wherein the comparing by two or more sensor programs generates reportable results.

12. The method of claim 9, the step of reordering comprising adding a sensor program.

13. The method of claim 11 wherein the reportable results are combined into a single transportable packet.

14. The method of claim 13 wherein the agent transport encrypts the forwardable result.

15. The method of claim 14 wherein the master transport decrypts the forwardable result.

18. The method of claim 17 further comprising the steps of:

monitoring information on an administrator of a networking policy change;

collecting information on the administrator of the networking policy changes;

archiving one or more sets of information on the administrator; and

compiling the one or more sets of information on the administrator of the networking policy changes, the user able to view the compiled information in a format determinable by the user.

19. The method of claim 18 further comprising the steps of:

monitoring the time of the administrator'"'"'s networking policy changes;

collecting the time of the administrator'"'"'s networking policy changes;

archiving one or more sets of times of the administrator'"'"'s networking policy changes; and

compiling the one or more sets of time of the administrator'"'"'s networking policy changes, the user able to view the compiled time in a format determinable by the user.

20. The method of claim 19 further comprising the steps of:

collecting the firewall policy change that is pushed to the firewall policy;

archiving one or more sets of firewall policy information that is pushed to the firewall policy; and

compiling the one or more sets of firewall policy information that is pushed to the firewall policy, the user able to view the compiled firewall policy information that is pushed in a format determinable by the user.

21. The method of claim 20 further comprising the step of:

establishing one or more baselines by an administrator for a system on the network;

monitoring the one or more baselines established by an administrator;

collecting information on changes to the one or more baselines into a baseline report;

archiving a one or more baseline reports of the changes; and

compiling the one or more baseline reports, the user able to view the compiled information in a format determinable by the user.

22. The method of claim 21 further comprising the step of:

monitoring one or more operating system'"'"'s file integrity on the network;

collecting information on changes to the one or more operating system'"'"'s file integrity into a file integrity report;

archiving the one or more file integrity reports; and

compiling the one or more file integrity reports, the user able to view the compiled information in a format determinable by the user.

23. The method of claim 22 further comprising the step of:

monitoring a Web server'"'"'s configuration file;

collecting information on changes to the Web server'"'"'s configuration file into a Web Server'"'"'s configuration report;

archiving the one or more Web Server'"'"'s configuration reports; and

compiling the one or more Web Server'"'"'s configuration reports, the user able to view the compiled information in a format determinable by the user.

24. The method of claim 23 further comprising the step of:

monitoring a proxy server'"'"'s configuration file;

collecting information on changes to the proxy server'"'"'s configuration file into a proxy server'"'"'s configuration file report;

archiving the one or more proxy server'"'"'s configuration file reports; and

compiling the one or more proxy server'"'"'s configuration file reports, the user able to view the compiled information in a format determinable by the user.

25. The method of claim 24 further comprising the step of:

monitoring a user'"'"'s password strength;

collecting information on the password'"'"'s strength into a password strength report;

archiving the one or more password strength report; and

compiling the one or more password strength report, the user able to view the compiled information in a format determinable by the user.

26. The method of claim 25 further comprising the step of:

establishing a one or more events that triggers an alert;

monitoring for the one or more alert triggering events;

providing an alert notice upon the occurrence of the one or more alert triggering event.

27. The method of claim 26 further comprising the steps of:

collecting information on the one or more alert triggering event into a alert report;

archiving the one or more alerts reports; and

compiling the one or more alert reports, the user able to view the compiled information in a format determinable by the user.

16. A method for monitoring a security parameter for a network, the network having a first and a second server, the first server having a transport mechanism communicatively connected to the second server, the method comprising the steps of:

monitoring at one or more times for changes to a firewall policy;

collecting on the first server the changes to the firewall policy;

storing the changes to the firewall policy on the first server; and

compiling a history of the changes to the firewall policy on the first server;

reporting the history of the firewall policy changes; and

the second server performing other networking tasks concurrently with the steps of collecting, storing, compiling, or reporting.

17. The method of step 16, further comprising the steps of:

monitoring whether a change is an approved change;

archiving changes into a first report, the report identifying approved changes.

28. The method of step 27 further comprising the step of:

monitoring encrypted secure connections between the first and the one or more second servers.