Security control verification and monitoring subsystem for use in a computer information database system

• US 8,225,409 B2
• Filed: 03/23/2006
• Issued: 07/17/2012
• Est. Priority Date: 03/23/2005
• Status: Active Grant

• Current Assignee: Belarc, Inc.
• Original Assignee: Belarc, Inc.
• Inventors: Newman, Gary H., DeFuria, Richard M.
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): OLION, BRIAN L
• Application Number:
  US11/387,424
• Publication Number:
  US 20060218639A1
• Time in Patent Office: 2,308 Days
• Field of Search: 726/25, 726/26, 709/224
• US Class Current: 726/25
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A security control verification and monitoring subsystem of a managed computer system performs security control verification operations regularly and for each security control verification operation determines the applicable security benchmark level for use by a given computer. The subsystem assigns security risk categories to groups of computers based, for example, on overall system or group administrator supplied potential impact settings and/or system type and business or information type selections. The subsystem further associates the security risk categories with security benchmark levels based on mapping information supplied by the overall system or group administrator. The subsystem then directs the computer to benchmark definition files based on the assigned security risk category, the associated security benchmark level and attributes of the computer. The subsystem performs the security control verification operations whenever the computer performs computer profile data update operations, and thus, monitors essentially continuously the security control compliance of the computer. The subsystem stores the results of the security verification operations and includes the results in reports for the system, group or computer.

Claims

1. A security control verification and monitoring subsystem for use with a managed computer system, the security control verification and monitoring subsystem including:

A. a security control manager for

assigning respective security risk categories to groups of computers,

consisting of two or more computers, for all computers in the managed computer system,

associating benchmark security levels with the risk categories for;

respective groups of computers;

directing a computer within a given group as to the benchmark security level the computer should use for security compliance testing;

B. client profilers associated with respective computers in a group of computers, the client profilers periodically uploading the computer profile data to an associated computer information database, and

C. a security verifier associated with a given computer in a given group for retrieving benchmark definition files that correspond to the benchmark security level specified by the security control manager and selected attributes of the computer that are based upon the computer profile data of the computers that are contained within the database, the security verifier automatically changing which benchmark definition files are retrieved to correspond to changes in the selected attributes of the computer without user modification of benchmark tests and settings per computer;

performing a security verification operation using the retrieved benchmark definition files periodically, and

reporting the results of the security control verification operation to the security control manager.

2. The subsystem of claim 1 wherein the security manager further produces reports that detail or summarize the results of the security verification operations for the given computer, the group of computers of which the given computer is a member, or a plurality of groups of computers.

3. The subsystem of claim 2 wherein

the security control manager includes computer profile data in the reports.

4. The subsystem of claim 3 wherein the subsystem monitors the compliance of respective computers with the associated benchmarks by performing security verification operations and reporting the results to the security control manager whenever the client profiler provides profile data to the security control manager, the subsystem retaining the results in a computer information database that also contains the computer profile data.

5. The subsystem of claim 4 wherein the security control manager and the security verifier operate together to perform the security verification operations, the security control manager directing the security verifier to the benchmark definition files based on the associated benchmark security level and selected attributes determined from the computer profile data contained in the database, and the security verifier using the benchmark definition files to determine if security control settings on the computer comply with or fail to comply with the associated benchmark security level.

6. The subsystem of claim 1 wherein the security control manager constructs a user interface for use by the overall system administrator or the group administrator, to select for the respective groups, mappings of the benchmark security levels to the security risk categories.

7. The subsystem of claim 6 wherein the security control manager further

constructs a user interface for use by said overall system administrator or the group administrators to selectively set system type and business or information type settings and potential impact settings for the respective groups, and

uses one or more of the submitted settings to assign the risk categories to the respective groups.

8. The subsystem of claim 6 wherein the security control manager informs the security verifier of the applicable benchmark security level each time a security verification operation is performed.

9. The subsystem of claim 5 wherein the security control manager directs the security verifier to the benchmark definition files each time a security verification operation is performed.

10. The subsystem of claim 1 wherein the benchmark security levels include one or more custom levels, and one or more of the benchmark definition files correspond to the one or more custom benchmark security levels.

23. The security control verification and monitoring subsystem for use with a managed computer system as defined in claim 1, wherein a new computer that is added to the system is verified and monitored as soon as the computer is assigned to a group, and is automatically assigned a benchmark security level belonging to the group, or a benchmark security level that differs from the group based upon one or more selected attributes of the new computer.

11. A method for monitoring security control verification in a managed computer system, the method including:

assigning security risk categories to groups of computers, groups being two or more computers;

for the respective groups, mapping benchmark security levels to the risk categories;

associating a given computer with the benchmark security level associated with the group to which the computer belongs, an administrator overriding the mapping of the respective security risk category for a group, a subset of a group or a respective computer with a new mapping;

associating a given computer with a client profiler that is configured to periodically upload computer profile data about the computer to an associated database;

selecting benchmark definition files that correspond to the associated benchmark security level and selected attributes of the given computer, the attributes being selected information of the computer based upon said computer profile data of the computer;

automatically changing which benchmark security definition files are retrieved to correspond to changes in the selected attributes of a computer without user modification of benchmark tests and settings of the computer;

comparing the security control settings of the given computer with the settings of the selected benchmark;

continuously monitoring the security control verification system and implementing changes in the security risk categories and benchmark definition files, based upon the new mapping, including associating a given computer with the benchmark security level associated with the group to which the computer belongs, automatically changing which benchmark definition files are retrieved to correspond to changes in selected attributes of a computer, and comparing the security control settings of the given computer with the settings of the selected benchmark as part of periodic computer profile updating operations; and

reporting the results of the comparisons, the computer profile data being included in the reports.

12. The method of claim 11 wherein the step of associating security benchmark levels includes using overall system or group administrator selected mappings.

13. The method of claim 12 wherein the step of assigning security risk categories includes using one or more overall system or group administrator selected settings of potential impact, system type and business or information type.

14. The method of claim 11 wherein the step of reporting includes providing a summary of system, group or computer security control compliance results.

15. The method of claim 11 wherein the step of reporting includes storing the results in a computer information database and including the results in a summary of system, group or computer profile data.

16. The method of claim 15 wherein the step of selecting benchmark definition files for a given computer includes utilizing computer profile data provided by the computer as part of profile data updating operations to determine the attributes of the computer and directing the computer to the appropriate benchmark definition files.

17. A security control manager for controlling security verification operations in a managed computer system, the security control manager including:

one or more processors configured to assign security risk categories to respective groups of computers, groups being two or more computers, and for the respective groups associating the risk categories with benchmark security levels;

the one or more processors further configured to select the benchmark security level for use by a given computer based on the security risk category assigned to the group of which the computer is a member and the benchmark security level associated with the assigned risk category for the group;

the one or more processors further configured to communication with an associated database that is periodically updated by the uploading of computer profile data to by client profilers;

the one or more processors further configured to monitor the security control verification system and implementing changes in the security risk categories and benchmark definition files;

the one or more processors further configured to provide one or more interfaces though which an overall system administrator or a group administrator selects a mapping of security risk categories to benchmark security levels for one or both of respective groups and respective computers within a given group;

the one or more processors further configured to provide one or more interfaces through which an administrator overrides said respective security risk categories and said benchmark security level settings for a group of computers, a subset of a group of computers, and an individual computer; and

the one or more processors further configured automatically apply the mapping to those computers without user modification of benchmark tests and settings per computer.

18. The security control manager of claim 17 wherein the one or more processors are further configured to provide one or more interfaces through which the overall system or group administrator to selects system type and business or information type settings and potential impact settings on which the risk category assignments are based.

19. The security control manager of claim 17 wherein the one or more processors are further configured to enter a computer information database to retrieve the computer attributes and direct a given computer to appropriate benchmark definition files.

20. The security control manager of claim 19 wherein the one or more processors are further configured to communication with the computer information database to store results of the security verification operations as pass or fail data in the computer information database.

21. The security control manager of claim 20 wherein the one or more processors are further configured to selects the benchmark security level as part of each security verification operation.

22. The security control manager of claim 21 wherein the security control manager monitors the security control compliance of the respective computers by participating in security verification operations each time the respective computers update the computer profile data.