Method and system for configuring and scheduling security audits of a computer network

• US 20070250935A1
• Filed: 06/21/2007
• Published: 10/25/2007
• Est. Priority Date: 01/31/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Zobel, Robert, Singer, Christopher, Millar, Sharon, Dodd, Timothy, Nesfeder, David
• Granted Patent: US 7,712,138 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Managing the selection and scheduling of security audits run on a computing network. The computer network is surveyed by a security audit system to determine the function and relative importance of the elements in the network. Based on function and priority, a more thorough type of security audit is selected to run against each of the network elements by the security audit system. The security audit can also be automatically scheduled based on the information gathered from the survey. Once the system runs the security audit, a vulnerability assessment can be calculated for each element in the network. The vulnerability assessment can be presented in a format that facilitates interpretation and response by someone operating the system. The vulnerability assessment can also be used to configure and schedule future security audits.

Claims

1-12. -12. (canceled)

13. A computer-implemented method for configuring and scheduling a security audit of a computer network comprising the steps of:

conducting a discovery scan to identify an element of the computer network and assigning an asset value for the element, wherein the asset value indicates the relative importance of the element in the network;

configuring an audit scan to perform on the element;

scheduling a time to perform the audit scan on the element;

running the audit scan at the scheduled time on the element; and

calculating a security score for the element based on the audit scan by summing one or more vulnerabilities associated with the element.

15. The method of claim 13, further comprising the step of scheduling another time to perform the audit scan on the element.

16. The method of claim 13, further comprising the step of receiving a blackout time during which no audit scan can be scheduled.

17. The method of claim 13, wherein the step of conducting a discovery scan further comprises identifying at least one function or at least one vulnerability associated with the element.

19. The method of claim 13, wherein the step of configuring an audit scan comprises:

retrieving an asset value based on the discovery scan;

retrieving a scan frequency associated with the asset value; and

assigning a role and a policy based on the discovery scan.

20. The method of claim 13, wherein the step of configuring an audit scan comprises manually selecting the type of audit scan.

14. (canceled)

18. (canceled)

21. (canceled)

22. A method for assessing the security of a network comprising the steps of:

receiving an initial scan identifying a network element and the function of the network element and assigning an asset value for the network element, wherein the asset value indicates the relative importance of the network element in the network;

selecting an audit scan to perform on the network element, the selection based on the initial scan, wherein the audit scan is broader than the initial scan;

scheduling the audit scan to perform on the network element;

performing the audit scan on the network element at the scheduled time;

receiving data from the selected audit scan of the network element; and

computing a security score for the network element from the selected audit scan by summing one or more vulnerabilities associated with the network element.

23. The method of claim 22, further comprising modifying the selected audit scan;

said modification based on the data received from the selected audit scan.

24. The method of claim 22, wherein the step of receiving an initial scan comprises:

identifying an operating system for the network element;

identifying a service for the network element, the service indicating the element'"'"'s function; and

identifying a vulnerability associated with the network element.

26. The method of claim 22, wherein the step of selecting an audit scan is based further on a manual input.

27. The method of claim 22, wherein the step of scheduling the audit scan comprises checking a blackout schedule.

25. (canceled)

28. (canceled)

29. (canceled)

30. A method for assessing the security of a network comprising the steps of:

receiving an initial scan identifying a network element and assigning an asset value for the network element, wherein the asset value indicates the relative importance of the network element;

selecting an audit scan to perform on the network element, said selection based on the initial scan;

performing the selected audit scan on the network;

receiving data from the selected audit scan of the network element; and

computing a security score for the network element from the selected audit scan by summing one or more vulnerabilities associated with the network element.

31. The method of claim 30, further comprising the step of scheduling the selected audit scan, said scheduling based on the initial scan.

32. The method of claim 30, further comprising modifying the selected audit scan, said modification based on the data received from the selected audit scan.

33. The method of claim 30, wherein the step of receiving an initial scan comprises:

identifying an operating system and a service for the network element; and

identifying a vulnerability associated with the network element.

35. The method of claim 30, wherein the step of selecting an audit scan is based further on a manual input.

36. The method of claim 30, wherein the step of scheduling the audit scan comprises checking a blackout schedule.

34. (canceled)

37. (canceled)

38. (canceled)

39. A system for configuring and scheduling a security audit of a computer network comprising:

the computer network;

a security audit system operable for conducting a discovery scan to identify an element of the computer network and assigning an asset value for the element, wherein the asset value indicates the relative importance of the element in the network, configuring and scheduling an audit scan of the element, and computing a security score for the network element from the selected audit scan by summing one or more vulnerabilities associated with the network element; and

a console operable for receiving information from the security audit system and transmitting information to the security audit system about the discovery scan and the audit scan.

40. The system of claim 39, wherein the security audit system is further operable for conducting a discovery scan to:

identify a function for the element; and

identify a vulnerability for the element.

41. The system of claim 39, wherein the security audit system checks a blackout schedule before scheduling an audit scan.

42. The system of claim 39, wherein the security audit system further comprises a system scanning engine operable for detecting a particular vulnerability on the network element.

43. The system of claim 39, wherein the security audit system further comprises an Internet scanning engine operable for performing a discovery scan on the network.

44. The system of claim 39, wherein the security audit system further comprises a database scanning engine operable for detecting vulnerabilities associated with database elements within the network.

45. The system of claim 39, wherein the security audit system further comprises an active scan engine operable for selecting, coordinating, and scheduling various discovery and audit scans to be performed on the computer network.