Consolidated enterprise view of cybersecurity data from multiple sites

Patent metadata

Field	Value
Publication number	US-10826925-B2
Application number	US-201715582265-A
Country	US
Kind code	B2
Filing date	Apr 28, 2017
Priority date	Apr 28, 2017
Publication date	Nov 3, 2020
Grant date	Nov 3, 2020

Abstract

This disclosure provides an apparatus and method for a consolidated enterprise view of cybersecurity data from multiple sites, including but not limited to in industrial control systems and other systems. A method includes receiving, by a replicator system, cybersecurity data from a site risk manager (RM) database. The method includes transferring the cybersecurity data, by the replicator system, through a secure firewall to an enterprise RM database. The enterprise RM database consolidates data received from a plurality of replicator systems.

First claim

What is claimed is:

1. A method comprising:
receiving, by each of a plurality of replicator systems that are each at a different one of a plurality of sites, cybersecurity data from a corresponding one of a plurality of site risk manager (RM) databases, wherein the corresponding site RM database is situated at a same site as the receiving replicator system, wherein the site RM database is at a first network level and the cybersecurity data is collected from a second network level different from the first network level, wherein the first and second network levels each possess restricted access policies;
implementing a structure query language (SQL) agent to analyze the cybersecurity data using extraction, transformation, and load (ETL) packages for data warehousing;
transferring the cybersecurity data using a specific protocol and forced encryption, the encryption is based on at least one certificate or key pair to ensure the encryption and authentication of both the sender and receiver, by each of the plurality of replicator systems, using one-way communication through a secure firewall to an enterprise RM database, wherein the enterprise RM database consolidates data received from the plurality of replicator systems, wherein the consolidated data in the enterprise RM databases is accessible to users who are unable to access the first and second network levels;
detecting transactions from the replicator systems to the enterprise RM database using a listener, wherein the listener is configured to listen to a specific port of the secure firewall; and
collecting the transferred cybersecurity data and transfer the transferred cybersecurity data to the enterprise RM database.

2. The method of claim 1 , wherein the cybersecurity data is collected from a plurality of devices in an industrial control system and stores the cybersecurity data in the site RM database.

3. The method of claim 1 , wherein an enterprise RM system displays a dashboard according to the consolidated data received from the plurality of replicator systems.

4. The method of claim 1 , wherein each replicator system of the plurality of replicator systems is implemented by a site RM system.

5. The method of claim 1 , further comprising:
implementing, by each of the plurality of replicator systems, an extractor service that extracts data from the corresponding site RM database.

6. A replicator system comprising:
a controller; and
a memory operatively coupled to the controller, the controller configured to:
receive cybersecurity data from a site risk manager (RM) database, the site RM database is at a first network level and the cybersecurity data is collected from a second network level different from the first network level, wherein the first and second network levels each possess restricted access policies;
implement a structure query language (SQL) agent to analyze the cybersecurity data using extraction, transformation, and load (ETL) packages for data warehousing;
transfer the cybersecurity data using a specific protocol and forced encryption, the encryption is based on at least one certificate or key pair to ensure the encryption and authentication of both the sender and receiver, using one-way communication through a secure firewall to an enterprise RM database, wherein the enterprise RM database consolidates data received from a plurality of replicator systems, wherein the consolidated data in the enterprise RM databases is accessible to users who are unable to access the first and second network levels;
detect transactions from the replicator systems to the enterprise RM database using a listener, wherein the listener is configured to listen to a specific port of the secure firewall; and
collect the transferred cybersecurity data and transfer the transferred cybersecurity data to the enterprise RM database.

7. The replicator system of claim 6 , wherein the controller collects the cybersecurity data from a plurality of devices in an industrial control system and stores the cybersecurity data in the site RM database.

8. The replicator system of claim 6 , wherein an enterprise RM system displays a dashboard according to the consolidated data received from the plurality of replicator systems.

9. The replicator system of claim 6 , wherein the replicator system is implemented by a site RM system.

10. The replicator system of claim 6 , wherein the controller is further configured to implement an extractor service that extracts data from the site RM database, and transfers the extracted cybersecurity data through the secure firewall to the enterprise RM database.

11. A non-transitory machine-readable medium encoded with executable instructions that, when executed, cause one or more processors of a replicator system to:
maintain a data table associated with an identity-derived primary key (PK-i);
receive cybersecurity data from a site risk manager (RM) database, wherein the site RM database is at a first network level and the cybersecurity data is collected from a second network level different from the first network level, wherein the first and second network levels each possess restricted access policies;
implement a structure query language (SQL) agent to analyze the cybersecurity data using extraction, transformation, and load (ETL) packages for data warehousing;
transfer the cybersecurity data using a specific protocol and forced encryption, the encryption is based on at least one certificate or key pair to ensure the encryption and authentication of both the sender and receiver, using one-way communication through a secure firewall to an enterprise RM database, wherein the enterprise RM database consolidates data received from a plurality of replicator systems, wherein the consolidated data in the enterprise RM databases is accessible to users who are unable to access the first and second network levels;
detect transactions from the replicator systems to the enterprise RM database using a listener, wherein the listener is configured to listen to a specific port of the secure firewall; and
collect the transferred cybersecurity data and transfer the transferred cybersecurity data to the enterprise RM database.

12. The non-transitory machine-readable medium of claim 11 , wherein the cybersecurity data is collected from a plurality of devices in an industrial control system and stores the cybersecurity data in the site RM database.

13. The non-transitory machine-readable medium of claim 11 , wherein an enterprise RM system displays a dashboard according to the consolidated data received from the plurality of replicator systems.

14. The non-transitory machine-readable medium of claim 11 , wherein the replicator system is implemented by a site RM system.

Assignees

• Honeywell Int Inc

Inventors

• Mesic Thomas M
• Carpenter Seth G
• Woods Scott
• Knapp Eric D

Classifications

• G06F16/27

  Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor · CPC title

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title