Deployment assurance checks for monitoring industrial control systems

Patent metadata

Field	Value
Publication number	US-10181038-B2
Application number	US-201514943876-A
Country	US
Kind code	B2
Filing date	Nov 17, 2015
Priority date	Nov 17, 2015
Publication date	Jan 15, 2019
Grant date	Jan 15, 2019

Abstract

This disclosure provides an apparatus and method for deployment assurance checks for monitoring industrial control systems and other systems. A method includes identifying, by a risk manager system, a plurality of connected devices that are vulnerable to cyber-security risks. The method includes determining devices to be monitored from the plurality of connected devices. The method includes evaluating system resource usage, by the risk manager system, on each device to be monitored. The method includes providing recommendations to a user as to whether or not the user should proceed with the monitoring, based on the evaluation.

First claim

What is claimed is:

1. A method for deployment assurance checks for monitoring an industrial control systems, comprising:
identifying, by a risk manager system, a plurality of connected devices that are vulnerable to cyber-security risks;
determining, by the risk manager system, devices to be monitored from the plurality of connected device;
verifying any relevant software or hardware prerequisites on the devices to be monitored;
validating whether an appropriate software version is present on each device to be monitored through a remote Windows Management Infrastructure (WMI) query by a user;
evaluating system resource usage, by the risk manager system, on each device to be monitored;
evaluating, by the risk manager system, security prerequisites on the connected devices, the evaluating security prerequisites includes:
checking firewall setting on each device,
validating that monitoring process is running from an account that is recognized, and
receiving credentials from a user and sending credentials to the connected devices; and
providing recommendations to the user, by the risk manager system, as to whether or not the user should proceed with the monitoring, based on the evaluation and on whether the monitoring would increase the system resource usage beyond a predetermined threshold and recommendations as to whether or not to install a monitoring agent on each of the connected devices and providing a level of enforcement of the recommendations, the level of enforcement includes at least one of “No” enforcement “Soft” enforcement or “Hard” enforcement.

2. The method of claim 1 , wherein identifying the plurality of connected devices includes performing an automatic discovery process by the risk manager system.

3. The method of claim 1 , wherein the system resource usage includes processor usage, memory usage, and disk space usage.

4. The method of claim 1 , further comprising selectively enforcing the recommendations on each of the plurality of devices.

5. The method of claim 1 , wherein identifying the plurality of connected devices includes receiving device information by the risk manager system from the user.

6. A risk manager system comprising:
a controller; and
a memory, the risk manager system configured to:
identify a plurality of connected devices that are vulnerable to cyber-security risks;
determine devices to be monitored from the plurality of connected devices;
verify any relevant software or hardware prerequisites on the devices to be monitored;
validate whether an appropriate software version is present on each device to be monitored through a remote Windows Management Infrastructure (WMI) query by a user:
evaluate system resource usage on each device to be monitored;
evaluate evaluating security prerequisites on the connected devices, the evaluation of security prerequisites includes:
check firewall setting on each device,
validate that monitoring process is running from an account that is recognized, and
receive credentials from the user and send credentials to the connected devices; and
provide recommendations to the user as to whether or not the user should proceed with the monitoring, based on the evaluation and on whether the monitoring would increase the system resource usage beyond a predetermined threshold and recommendations as to whether or not to install a monitoring agent on each of the connected devices and provide a level of enforcement of the recommendations, the level of enforcement includes at least one of “No” enforcement, “Soft” enforcement or “Hard” enforcement.

7. The risk manager system of claim 6 , wherein the risk manager system is configured to identify the plurality of connected devices by performing an automatic discovery process.

8. The risk manager system of claim 6 , wherein the system resource usage includes processor usage, memory usage, and disk space usage.

9. The risk manager system of claim 6 , wherein the risk manager system is further configured to selectively enforce the recommendations on each of the plurality of devices.

10. The risk manager system of claim 6 , wherein the risk manager system is configured to identify the plurality of connected devices by receiving device information by the risk manager system from the user.

11. A non-transitory machine-readable medium encoded with executable instructions that, when executed, cause one or more processors of a risk manager system to:
identify a plurality of connected devices that are vulnerable to cyber-security risks;
determine devices to be monitored from the plurality of connected devices;
verify any relevant software or hardware prerequisites on the devices to be monitored;
validate whether an appropriate software version is present on each device to be monitored through a remote Windows Management Infrastructure (WMI) query by a user:
evaluate system resource usage on each device to be monitored;
evaluate security prerequisites on the connected devices, the evaluation of security prerequisites includes:
check firewall setting on each device,
validate that monitoring process is running from an account that is recognized, and
receive credentials from the user and send credentials to the connected devices; and
provide recommendations to the user as to whether or not the user should proceed with the monitoring, based on the evaluation and on whether the monitoring would increase the system resource usage beyond a predetermined threshold and recommendations as to whether or not to install a monitoring agent on each of the connected devices and provide a level of enforcement of the recommendations, the level of enforcement includes at least one of “No” enforcement, “Soft” enforcement or “Hard” enforcement.

12. The non-transitory machine-readable medium of claim 11 , wherein the instructions to identify the plurality of connected devices includes instructions to perform an automatic discovery process by the risk manager system.

13. The non-transitory machine-readable medium of claim 11 , wherein the system resource usage includes processor usage, memory usage, and disk space usage.

14. The non-transitory machine-readable medium of claim 11 , wherein the non-transitory machine-readable medium is further encoded with instructions to selectively enforce the recommendations on each of the plurality of devices.

Assignees

• Honeywell Int Inc

Inventors

• Carpenter Seth G
• Knapp Eric D

Classifications

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G05B19/00

  Program-control systems · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06Q10/06

  Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling · CPC title

• G05B23/0208

  characterized by the configuration of the monitoring system · CPC title