Automated information handling system hardening optimization systems and methods

Patent metadata

Field	Value
Publication number	US-12547730-B2
Application number	US-202218045635-A
Country	US
Kind code	B2
Filing date	Oct 11, 2022
Priority date	Oct 11, 2022
Publication date	Feb 10, 2026
Grant date	Feb 10, 2026

Abstract

Automating Information Handling System (IHS) hardening optimization includes retrieving, from a plurality of IHS hardening configurations, an initial IHS hardening configuration and hardening an IHS based on the initial hardening configuration. An IHS hardening verification tool is then run to verify that the IHS is in compliance with a compliance checklist, if it is, end-to-end tests are run on the IHS, and upon passing the end-to-end tests the initial hardening option is determined to be the best hardening option for the IHS. However, in response to the IHS not passing the end-to-end tests, a next IHS hardening configuration is retrieved and the IHS is hardened based on the next hardening configuration. Running the hardening verification tool and end-to-end tests on the IHS and retrieving a further IHS hardening configuration and hardening the IHS based on the further hardening configuration is repeated, until the IHS passes the end-to-end tests.

First claim

The invention claimed is:

1 . A method for automating information handling system hardening optimization, the method comprising:
retrieving, from a plurality of information handling system hardening configuration options, an initial information handling system hardening configuration option; hardening an information handling system based, at least in part, on the initial hardening configuration option; running an information handling system hardening verification tool to verify that the information handling system is in compliance with a compliance checklist; running, in response to verification that the information handling system is in compliance with the compliance checklist, end-to-end tests on the information handling system; determining, in response to passing of the end-to-end tests, the initial hardening option is a best hardening option for the information handling system; retrieving, in response to the information handling system not passing the end-to-end tests, a next information handling system hardening configuration option from the plurality of information handling system hardening configuration options; hardening the information handling system based, at least in part, on the next hardening configuration option; and repeating, until the information handling system passes the end-to-end tests:
running the information handling system hardening verification tool to verify that the information handling system is in compliance with the compliance checklist;
running, in response to verification that the information handling system is in compliance with the compliance checklist, the end-to-end tests on the information handling system;
determining, in response to passing of the end-to-end tests, the next hardening option is the best hardening option for the information handling system;
retrieving, in response to the information handling system not passing the end-to-end tests, a further information handling system hardening configuration option from the plurality of information handling system hardening configuration options; and
hardening the information handling system based, at least in part, on the further hardening configuration option.

2 . The method of claim 1 , further comprising:
retrieving the next information handling system hardening configuration option from the plurality of information handling system hardening configuration options, in response to the information handling system not being in compliance with the compliance checklist following hardening the information handling system based, at least in part, on the initial hardening configuration option; and retrieving the further information handling system hardening configuration option from the plurality of information handling system hardening configuration options, in response to the information handling system not being in compliance with the compliance checklist following hardening the information handling system based, at least in part, on the next hardening configuration option.

3 . The method of claim 2 , wherein retrieving, in response to the information handling system not passing the end-to-end tests, the next information handling system hardening configuration option from the plurality of information handling system hardening configuration options, retrieving, in response to the information handling system not passing the end-to-end tests, the further information handling system hardening configuration option from the plurality of information handling system hardening configuration options, retrieving the next information handling system hardening configuration option from the plurality of information handling system hardening configuration options, in response to the information handling system not being in compliance with the compliance checklist following hardening the information handling system based, at least in part, on the initial hardening configuration option, and/or retrieving the further information handling system hardening configuration option from the plurality of information handling system hardening configuration options, in response to the information handling system not being in compliance with the compliance checklist following hardening the information handling system based, at least in part, on the next hardening configuration option further comprises using machine learning to choose a next best or further best information handling system hardening configuration option compared to the initial information handling system hardening configuration option or next information handling system hardening configuration option, respectively.

4 . The method of claim 1 , further comprising checking stability of the information handling system after running the end-to-end tests on the information handling system.

5 . The method of claim 1 , wherein the compliance checklist comprises a United States Department of Commerce National Institute for Standards and Testing National Checklist Program checklist that conforms to a Security Content Automation Protocol.

6 . The method of claim 1 , further comprising creating the information handling system hardening verification tool.

7 . The method of claim 1 , further comprising creating the compliance checklist.

8 . A non-transitory computer-readable storage medium storing program instructions, thereupon, that upon execution by an information handling system causes the information handling system to:
retrieve an initial information handling system hardening configuration option, from a plurality of information handling system hardening configuration options; harden a subject information handling system based, at least in part, on the initial hardening configuration option; run an information handling system hardening verification tool to verify that the subject information handling system is in compliance with a compliance checklist; run end-to-end tests on the subject information handling system, in response to verification that the subject information handling system is in compliance with the compliance checklist; determine that the initial hardening option is a best hardening option for the subject information handling system, in response to passing of the end-to-end tests; and repeat, in response to the subject information handling system not passing the end-to-end tests, and until a determination of a hardening option of the plurality of information handling system hardening configuration options is best hardening option for the subject information handling system:
retrieve a next information handling system hardening configuration option from the plurality of information handling system hardening configuration options;
harden the subject information handling system based, at least in part, on the next hardening configuration option;
run the information handling system hardening verification tool to verify that the subject information handling system is in compliance with the compliance checklist;
run the end-to-end tests on the subject information handling system, in response to verification that the subject information handling system is in compliance with the compliance checklist; and
determine the next hardening option is the best hardening option for the subject information handling system, in response to passing of the end-to-end tests.

9 . The non-transitory computer-readable storage medium of claim 8 , wherein, upon execution by the information handling system, the program instructions cause the information handling system to:
repeat, in response to the subject information handling system not being in compliance with the compliance checklist following hardening the subject information handling system based, at least in part, on the initial hardening

Assignees

• Dell Products Lp

Inventors

• Shachar Tomer
• Balin Maxim
• Gehtman Yevgeni

Classifications

• G06F11/3668

  Testing of software · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G05B13/0245 Primary

  not using a perturbation signal · CPC title