Method and device for questioning a plurality of computerized devices

• US 20060075128A1
• Filed: 09/15/2005
• Published: 04/06/2006
• Est. Priority Date: 10/04/2004
• Status: Active Grant

• Current Assignee: Promiimer Ltd.
• Original Assignee: Promisec Ltd. (C MER Industries Limited)
• Inventors: Suchowski, Ron Shay, Kotler, Hilik
• Granted Patent: US 7,752,671 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols

Abstract

Some embodiments of the present invention may relate to a device and a method of questioning computerized devices within an organization'"'"'s network. The device, in accordance with some embodiments of the present invention, may include a questioning module and an agentless module. The questioning module may be adapted to receive data specifying a plurality of computerized devices to be questioned, and to receive data indicating which one or more questioning subjects are selected to be questioned on the specified computerized devices. The agentless module may be adapted to invoke and configure at least a remote access process, to question at least a registry of a remote computerized device. In accordance with some embodiments of the present invention, the questioning module may be adapted to utilize multiple threads of the agentless module to invoke and configure a plurality of remote access processes to question in parallel and without using agents at least a registry of the specified computerized devices, in accordance with the selected questioning subjects.

Claims

1. A device for questioning computerized devices within an organization'"'"'s network, said device comprising:

a questioning module adapted to receive data specifying a plurality of computerized devices to be questioned, and to receive data indicating which one or more questioning subjects are selected to be questioned on the specified computerized devices; and

an agentless module adapted to invoke and configure at least a remote access process, to question at least a registry of a remote computerized device;

wherein said questioning module is adapted to utilize multiple threads of said agentless module to invoke and configure a plurality of remote access processes to question in parallel and without using agents at least a registry of the specified computerized devices, in accordance with the selected questioning subjects.

2. The device according to claim 1, wherein the questioning subjects are associated with security threats.

3. The device according to claim 2, wherein the questioning subjects are associated with one or more specific locations within at least the registry of a computerized device, where an indication of a security threat may be found during questioning.

4. The device according to claim 1, wherein said questioning module is adapted to utilize in parallel a substantially large number of threads of said agentless module.

5. The device according to claim 1, wherein said questioning module is adapted to select which one or more of the questioning subjects are to be questioned on each of the computerized devices.

6. The device according to claim 5, further comprising a user interface to enable a user to select, either directly or indirectly, one or more of the computerized devices to be questioned.

7. The device according to claim 6, wherein said user interface may further enable a user to select, either directly or indirectly, which one or more questioning subjects are to be questioned on one or more of the specified computerized devices to be questioned.

8. The device according to claim 1, wherein said questioning module is adapted to determine the number of threads of said agentless module to be utilized to question the specified computerized devices.

9. The device according to claim 8, wherein said questioning module is adapted to determine the number of threads of the said agentless module to be utilized in accordance with one or more of the following:

the number of computerized devices to be questioned, the desired scanning speed, one or more network performance parameters, the subjects to be questioned and/or the threat'"'"'s severity.

10. The device according to claim 1, wherein said questioning module is adapted to assign to each thread of said agentless module one or more of the specified computerized devices.

11. The device according to claim 10, wherein said questioning module is adapted to assign to each thread of said agentless module-one or more questioning subjects selected to be questioned on one or more of the specified computerized devices assigned to that thread of said agentless module.

12. The device according to claim 11, wherein each thread of said agentless module is adapted to configure each of the invoked remote access processes to question one or more specific locations within the computerized devices assigned to that thread, in accordance with the questioning subject selected to be questioned on the computerized devices.

13. The device according to claim 12, wherein each thread of said agentless module is adapted to configure each of the invoked remote access processes to question one or more specific locations within at least a registry of the computerized devices assigned to that thread, in accordance with the questioning subject selected for each of the computerized devices and which have been assigned to that thread.

14. The device according to claim 12, wherein said questioning module is adapted to assign to one or more threads of said agentless module predefined data corresponding to certain data which may be found in one or more of the specified locations associated with one or more of the questioning subjects assigned to that or these thread or threads.

15. The device according to claim 14, wherein one or more of said agentless modules is adapted to configure one or more of the invoked remote access processes to compare the actual data found in one or more specific locations within the computerized devices associated with one or more of the questioning subjects assigned to that or these threads against the predefined data associated with the one or more of the questioning subjects, which corresponds to the data which may be found in one or more of the specified locations.

16. The device according to claim 7, further comprising one or more databases including prestored data corresponding to one or more computerized devices, and wherein as part of specifying the computerized devices to be questioned, prestored data corresponding to computerized devices may be obtained from said database.

17. The device according to claim 7, further comprising one or more databases including prestored data corresponding to one or more questioning subjects, and wherein as part of selecting one or more questioning subjects to be questioned on the specified computerized devices, prestored data corresponding to one or more questioning subjects may be obtained from said database.

18. The device according to claim 1, further comprising a results analysis module adapted to process the results received in response to the questioning of at least the registry of the specified computerized devices, and to generate a report corresponding to the results.

19. The device according to claim 18, wherein as part of processing the results said results analysis module may be adapted to compare one or more of the results relating to the actual data found as part of the questioning of one or more of the specified computerized devices against predefined data.

20. The device according to claim 19, wherein said results analysis module is adapted to execute one or more predefined actions or procedures based on one or more of the received results.

21. The device according to claim 20, wherein said results analysis module is adapted to utilize one or more threads of the agentless module to invoke and configure one or more remote access processes to modify or delete certain data on one or more of the remote computerized devices which were questioned.

22. A method of questioning computerized devices within an organization'"'"'s network, said method comprising:

specifying a plurality of computerized devices to be questioned;

selecting one or more questioning subjects to be questioned on the specified computerized devices to be questioned; and

invoking in parallel and configuring a plurality of remote access processes to question in parallel and without using agents, at least a registry of the specified computerized devices, in accordance with the selected questioning subjects.

23. The method according to claim 22, wherein said selecting one or more questioning subjects further comprises, selecting which one or more of the questioning subjects is to be questioned on each of the specified computerized devices.

24. The method according to claim 23, further comprising utilizing in parallel a plurality of threads of an agentless module, each of the threads being adapted to invoke and configure at least one of the remote access processes to question at least a registry of a remote computerized device.

25. The method according to claim 24, wherein said utilizing further comprises assigning to each of the plurality of threads of the agentless module one or more of the specified computerized devices, and one or more of the questioning subjects to be questioned on the one or more computerized devices.

26. The method according to claim 25, further comprising determining the number of remote access processes to be invoked in parallel, in accordance with one or more of the following:

the number of computerized devices to be questioned, the desired scanning speed, one or more network performance parameters, the subjects to be questioned and/or the threat'"'"'s severity.

27. The method according to claim 25, wherein said assigning further comprises assigning to one or more of the of threads of the agentless module data corresponding to one or more specific locations within the computerized devices assigned to that or these threads, in accordance with one or more of the questioning subjects selected to be questioned on the computerized devices.

28. The method according to claim 22, further comprising:

receiving results in response to the questioning of at least the registry of the specified computerized devices; and

generating a report corresponding to the results received in response to the questioning of the specified computerized devices.

29. The method according to claim 28, further comprising executing one or more predefined actions or procedures based on one or more of the received results.

30. The method according to claim 29, further comprising utilizing one or more threads of the agentless module to invoke and configure one or more remote access processes to modify or delete certain data on one or more of the remote computerized devices which were questioned.