Security control verification and monitoring subsystem for use in a computer information database system

• US 20060218639A1
• Filed: 03/23/2006
• Published: 09/28/2006
• Est. Priority Date: 03/23/2005
• Status: Active Grant

• Current Assignee: Belarc, Inc.
• Original Assignee: Belarc, Inc.
• Inventors: Newman, Gary H., DeFuria, Richard M.
• Granted Patent: US 8,225,409 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A security control verification and monitoring subsystem of a managed computer system performs security control verification operations regularly and for each security control verification operation determines the applicable security benchmark level for use by a given computer. The subsystem assigns security risk categories to groups of computers based, for example, on overall system or group administrator supplied potential impact settings and/or system type and business or information type selections. The subsystem further associates the security risk categories with security benchmark levels based on mapping information supplied by the overall system or group administrator. The subsystem then directs the computer to benchmark definition files based on the assigned security risk category, the associated security benchmark level and attributes of the computer. The subsystem performs the security control verification operations whenever the computer performs computer profile data update operations, and thus, monitors essentially continuously the security control compliance of the computer. The subsystem stores the results of the security verification operations and includes the results in reports for the system, group or computer.

Claims

1. A security control verification and monitoring subsystem for use with a managed computer system, the security control verification and monitoring subsystem including:

A. a security control manager for

assigning respective security risk categories to groups of computers,

associating benchmark security levels with the risk categories for the respective groups, and

directing a computer within a given group as to the benchmark security level the computer should use for security compliance testing; and

B. a security verifier associated with a given computer for

retrieving benchmark definition files that correspond to the benchmark security level specified by the security control manager and selected attributes of the computer,

performing a security verification operation using the retrieved benchmark definition files, and

reporting the results of the security control verification operation to the security control manager.

2. The subsystem of claim 1 wherein the security manager further produces reports that detail or summarize the results of the security verification operations for the given computer, the group of computers of which the given computer is a member, or a plurality of groups of computers.

3. The subsystem of claim 2 further including

a client profiler that is associated with the given computer, the client profiler periodically providing computer profile data for use by the security control manager, and

the security including computer profile data in the reports.

4. The subsystem of claim 3 wherein the subsystem monitors the compliance of respective computers with the associated benchmarks by performing security verification operations and reporting the results to the security control manager whenever the client profiler provides profile data to the security control manager, the subsystem retaining the results in a computer information database that also contains the computer profile data.

5. The subsystem of claim 4 wherein the security control manager and the security verifier operate together to perform the security verification operations, the security control manager directing the security verifier to the benchmark definition files based on the associated benchmark security level and selected attributes determined from the computer profile data contained in the database, and the security verifier using the benchmark definition file information to determine if security control settings on the computer comply with or fail to comply with the associated benchmark settings.

6. The subsystem of claim 1 wherein the security control manager constructs a user interface for use by the overall system administrator or the group administrator to select for the respective groups mappings of the benchmark security levels to the security risk categories.

7. The subsystem of claim 6 wherein the security control manager further

constructs a user interface for use by an overall system administrator or the group administrators to selectively set system type and business or information type settings and potential impact settings for the respective groups, and

uses one or more of the submitted settings to assign the risk categories to the respective groups.

8. The subsystem of claim 1 wherein the security control manager informs the security verifier of the applicable benchmark security level each time a security verification operation is performed.

9. The subsystem of claim 5 wherein the security control manager directs the security verifier to the benchmark definition files each time a security verification operation is performed.

10. The subsystem of claim 1 wherein the benchmark security levels include one or more custom levels, and one or more of the benchmark definition files correspond to the one or more custom benchmark security levels.

11. A method for monitoring security control verification in a managed computer system, the method including:

A. assigning security risk categories to groups of computers;

B. for the respective groups mapping benchmark security levels to the risk categories;

C. associating a given computer with the benchmark security level associated with the group to which the computer belongs;

D. selecting benchmark definition files that correspond to the associated benchmark security level and selected attributes of the given computer;

D. comparing the security control settings of the given computer with the settings of the selected benchmark; and

E. reporting the results of the comparisons.

12. The method of claim 11 further including continuously monitoring the security control and verification by repeating steps A-E as part of periodic computer profile updating operations.

13. The method of claim 12 wherein the step of associating security benchmark levels includes using overall system or group administrator selected mappings.

14. The method of claim 13 wherein the step of assigning security risk categories includes using one or more overall system or group administrator selected settings of potential impact, system type and business or information type.

15. The method of claim 11 wherein the step of reporting includes providing a summary of system, group or computer security control compliance results.

16. The method of claim 11 wherein the step of reporting includes storing the results in a computer information database and including the results in a summary of system, group or computer profile data.

17. The method of claim 16 wherein the step of selecting benchmark definition files for a given computer includes utilizing computer profile data provided by the computer as part of profile data updating operations to determine the attributes of the computer and directing the computer to the appropriate benchmark definition files.

18. A security control manager for controlling security verification operations in a managed computer system, the security control manager including:

A. means for

i. assigning security risk categories to respective groups of computers,

ii. for the respective groups associating the risk categories with benchmark security levels, and

iii. selecting the benchmark security level for use by a given computer based on the security risk category assigned to the group of which the computer is a member and the benchmark security level associated with the assigned risk category for the group; and

B. means for allowing an overall system or a group administrator to select a mapping of security risk categories to benchmark security levels.

19. The security control manager of claim 18 further including means for allowing the overall system or group administrator to select system type and business or information type settings and potential impact settings on which the risk category assignments are based.

20. The security control manager of claim 18 further including means for

entering a computer information database to retrieve the computer attributes and

directing a given computer to appropriate benchmark definition files.

21. The security control manager of claim 20 further including means for storing results of the security verification operations as pass or fail data in the computer information database.

22. The security control manager of claim 21 wherein the means for selecting the benchmark security level selects the benchmark security level as part of each security verification operation.

23. The security control manager of claim 22 wherein the security control manager monitors the security control compliance of the respective computers by participating in security verification operations each time the respective computers update the computer profile data.