UNIFIED SCAN MANAGEMENT

• US 20130269028A1
• Filed: 04/10/2012
• Published: 10/10/2013
• Est. Priority Date: 04/10/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hugard, James Michael IV, Schrecker, Sven, Nakawatase, Ryan Tadashi
• Granted Patent: US 9,407,653 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A particular scan set to be performed on at least a portion of a computing environment is identified. A particular scan engine, in a plurality of scan engines, is identified that is adapted to perform at least one scan in the particular scan set, each scan engine in the plurality of scan engines adapted to perform one or more scans on one or more host devices in the computing environment. A request is sent to the particular scan engine to perform the at least one scan in the particular scan set and scan result data is received from the particular scan engine corresponding to the at least one scan in the particular scan set.

Claims

1. A method comprising:

identifying a particular scan set to be performed on at least a portion of a computing environment;

identifying a particular scan engine, in a plurality of scan engines, adapted to perform at least one scan in the particular scan set, wherein each scan engine in the plurality of scan engines is adapted to perform one or more scans on one or more host devices in the computing environment;

sending a request to the particular scan engine to perform the at least one scan in the particular scan set; and

receiving scan result data from the particular scan engine corresponding to the at least one scan in the particular scan set.

2. The method of claim 1, wherein the request is sent through an agent.

3. The method of claim 1, wherein the particular scan engine is a network-based scan engine adapted to perform external scans of the portion of the computing environment.

4. The method of claim 1, wherein the particular scan engine is a host-based scan engine hosted on a particular target device in the portion of the computing environment and adapted to perform internal scans of the particular target device.

5. The method of claim 1, wherein a particular computing language in a plurality of computing languages is capable of being identified from the request by the particular scan engine, and the scan engine is adapted to utilize a corresponding language interpreter in a plurality of language interpreters on the particular scan engine to perform the at least one scan in the particular scan set.

6. The method of claim 5, wherein the request causes the particular language interpreter to be activated on the particular scan engine during the at least one scan in the particular scan set.

7. The method of claim 1, further comprising:

identifying a second scan engine in the plurality of scan engines to perform another scan in the particular scan set;

sending a request to the second scan engine to perform the other scan in the particular scan set, wherein scan result data is also received from the second scan engine corresponding to the other scan in the particular scan set.

8. The method of claim 7, further comprising aggregating received scan result data corresponding to each scan in the particular scan set.

9. The method of claim 7, wherein the particular scan engine is a network-based scan engine adapted to perform external scans of the portion of the computing environment and the second scan engine is a host-based scan engine hosted on a particular target device in the portion of the computing environment and adapted to perform internal scans of the particular target device.

10. The method of claim 7, wherein the request to the second scan engine to perform the other scan is sent in response to the scan result data received from the particular scan set corresponding to the at least one scan in the particular scan set.

11. The method of claim 1, wherein the particular scan set is based, at least in part, on a security policy of the computing environment applicable to the portion of the computing environment.

12. The method of claim 11, wherein identifying the particular scan set includes generating the particular scan set based on the security policy.

13. The method of claim 11, wherein the security policy is one of device-centric policy, an organization-specific policy, and a regulatory policy.

14. The method of claim 1, wherein the portion of the computing environment includes the computing environment.

15. The method of claim 1, wherein the at least one scan is a first of at least two scans in the particular scan set, and a second scan in the at least two scans and different from the first scan is identified for the particular scan engine, the method further comprising:

sending a request to the particular scan engine to perform the second scan; and

receiving scan results data from the particular scan engine corresponding to the second scan.

16. The method of claim 15, wherein the second scan involves a different scan target than the first scan.

17. The method of claim 15, wherein the second scan is a different type of scan from the first scan.

18. The method of claim 17, wherein the second scan utilizes a different computing language than the first scan.

19. The method of claim 1, further comprising:

identifying a different second scan set to be performed on at least a portion of the computing environment;

identifying one or more scan engines in the plurality of scan engines to perform scans in the second scan set; and

requesting the one or more scan engines to perform the scans in the second scan set; and

receiving scan result data for the second scan set from the one or more scan engines.

20. The method of claim 19, wherein the particular scan engine is included in the one or more scan engines.

21. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

identifying a particular scan set to be performed on at least a portion of a computing environment;

identifying a particular scan engine, in a plurality of scan engines, adapted to perform at least one scan in the particular scan set, wherein each scan engine in the plurality of scan engines is adapted to perform one or more scans on one or more host devices in the computing environment;

sending a request to the particular scan engine to perform the at least one scan in the particular scan set; and

receiving scan result data from the particular scan engine corresponding to the at least one scan in the particular scan set.

22. A system comprising:

at least one processor device;

at least one memory element; and

an asset management system server, adapted when executed by the at least one processor device to;

identify a particular scan set to be performed on at least a portion of a computing environment;

identify a particular scan engine, in a plurality of scan engines, adapted to perform at least one scan in the particular scan set, wherein each scan engine in the plurality of scan engines is adapted to perform one or more scans on one or more host devices in the computing environment;

send a request to the particular scan engine to perform the at least one scan in the particular scan set; and

receive scan result data from the particular scan engine corresponding to the at least one scan in the particular scan set.

23. The system of claim 22, further comprising the plurality of scan engines, the plurality of scan engines including at least one network-based scan engine and at least one host-based scan engine.

24. The system of claim 23, wherein each scan engine in the plurality of scan engines is a unified scan engine adapted to make use of a respective library of language interpreters included on the respective unified scan engine.