Patent Application
20150312276
1. Field of the Invention
The present application relates to controlling a computer.
2. Description of the Related Technology
It is known to perform bench marking to ensure computer systems are secure. The US government, the Australian Government and Microsoft consider that four security controls mitigate against a large proportion of software intrusions. The four controls are
1) apply Operating System patches;
2) apply third party software patches;
3) allow only applications on a “white list” (i.e. a list of allowed software), to run; and
4) limit administrator privileges.
A network of computers may have tens, or even hundreds or more, of computers and each computer may have a large number of programs installed on it. Also many users may have administrator rights granted for their computer. Some users may install software on their computers independently of the network management system. Also computers, for example laptop computers join and leave the network at random. To manually apply the controls to an existing network is a very difficult if not impossible task. The number of different application programs and different versions of the same program installed on a network is often very large. There is a need to provide software tools for facilitating the production of a list of allowed software and of controlling what software is allowed to run.
In accordance with a first embodiment of the present invention, there is provided a method of controlling a first computer, the first computer having an operating system having a kernel, the operating system being configured to prevent running of software not identified in a list of approved software, the first computer being connected to a second computer via a communications network, the method comprising running on the first computer a monitoring program which provides to the second computer data relating to the software installed on the first computer, running on the second computer a comparison program which compares the identities of software present on the computer with software identified in the list, and a risk determination program which determines for each software not on the list whether the software complies with a plurality of risk criteria, and automatically adds to the list the identity of any software determined to be of low risk; and supplying the list of the first computer whereby the operating system of the first computer prevents the running of software absent from the list.
According to a second embodiment of the invention, there is provided a computer program having instructions for controlling a first computer having an operating system having a kernel, the operating system being configured to prevent running of software not identified in a list of approved software, the program having a module for receiving from the first computer data relating to software installed on the first computer, a comparison module configured to compare the identities of software present on the computer with software identified in the list, a risk determination module configured to determine for each software not on the list whether the software complies with a plurality of risk criteria, and automatically add to the list the identity of any software determined to be of low risk; and a module for sending the list to the first computer.
Further features and advantages of the invention will become apparent from the following description of illustrative examples of the invention, given by way of example only, which is made with reference to the accompanying drawings.
The network of
Each computer 10 has at least an operating system, applications software and a CFM agent. The CFM agent communicates with the CFM 2 informing the CFM 2 in known manner of software installed on the computer. Software may be installed on a computer 10 using the network management system, for example using Microsoft Installer. Software may also be installed on a computer 10 by the user if the user has administrator rights which allow that. The Configuration Manager CFM 2 stores data relating to the computers 10 and the software installed on them including data identifying the computers, data identifying the software, including patches, installed on them, and other data as will be described in more detail below. Each computer 10 stores a local list of allowed software hereinafter referred to as a “white list”.
A computer 14, which may be a server, is connected to the network. The server 14 produces the local white lists for storage in the local computers 10. The server 14 automatically creates and updates each white list based on a metric calculation as will be described with reference to
The network of
The kernel of the operating system of each local computer 10 interacts with the local white list and with the GAD server in known manner to prevent running of software absent from the combination of the local and global white lists.
The network of
The network may also have one or more workstations 16 used by one or more network managers.
Referring to
Assume as shown at S2 in
Has the software i) a producer name, ii) a product name, iii) a version name and iv) a date, (in all four cases i) to iv) established at compile time);
Is the software i) tied to the CFM or ii) was it installed independently of the CFM and/or the installer;
Where is the software running from? For example it may run from i) the program files memory (main memory) of a computer 10 or ii) from a user temp directory or iii) from the network.
Item b) may be omitted from some implementations. It is described in more detail with respect to
A risk metric is calculated in step S10. The metric applies to each of the criteria of a)i) to c)iii) a confidence factor which may be weighted. For example the metric M may be
M=w1a)i)+w2a)ii)+w3a)iii)+w4a)iv)+w5b)i)−w6b)ii+w7c)i)−w8c)ii−w8c)iii)
Where w1 to w8 are weighting factors, which could be one, and a)i) to c)iii) are confidence values relating to the like numbered criteria set out above. In this example, the greater the metric, the lower the risk of running the software.
As indicated at S12 software which has a metric greater than a predetermined value is automatically added to the white list.
The white list is provided by the server 14 to the local computer 10 at step S4. The kernel of operating system of the computer allows S16 only software listed in the local white list and in the global list to run. In one example, if the software is not on the combination of local and global white lists, a message is automatically generated informing the user that the software is not on the white lists and the software is prevented from running.
A message identifying software having a higher risk is provided to the network manager for review as at step S14. The message may also include the calculated risk factor. In one example if the risk is deemed medium, the message is sent to one manager or group of managers authorized to review and take decisions on medium risk software and if the risk is deemed high, the message is sent to another manager or group of managers authorized to review and take decisions on high risk software.
The relevant manager may request information from the user of the medium or high risk software. For example the manager may ask the user to provide license information. If the user has downloaded the software from a website, the manager may ask for the URL of the website.
If a manager is deems software referred to him is allowable the manager adds it to the local white list at step S14.
The steps S2 to S14 may be repeated continuously or regularly or at suitable intervals to maintain the white lists as software installed on the computer 10 changes over time.
Step S8 lists criteria a)i) to c) iii). However other criteria may be used instead of those or in addition to those. Examples of other criteria which may be used include
Has the software a certificate issued by a trusted certificate authority?
Has the software a product code applied by an installer, for example Microsoft Installer?
The server 12 having the global active directory stores a global white list. Referring to
The CFM database also has an installation package table 220. The installation package table 220 stores data relating to ‘packages’ used for installing software on domain systems. Administrative staff create these Packages over time. The database holds metadata for each package such as the Name 221, Manufacturer 222, version, GUID (unique identifier) 223 and command lines 224 for installing or uninstalling the software.
The software for determining whether an application is tied to the CFM_compares the fields from the two package tables of the database and assigns confidence levels (low, medium and high) on the number of matches from fields in the Application and fields in all the Packages. If all fields match exactly there is high confidence, if only a couple match there is medium confidence and no matches means low confidence.
Examples as described herein may be implemented by a suite of computer programs which when run on one or more computer devices of the network. For example, a computer program run on a server computer device may implement the method of
The term “software” as used herein refers to any tool, function or program that is implemented by way of computer program code other than core operating system code. In use, an executable form of the computer program code is loaded into memory (e.g. RAM) and is processed by one or more processors. “Software” includes, without limitation: non-core operating system code; application programs; patches for, and updates of, software already installed on the network; and new software packages.
The above embodiments are to be understood as illustrative examples of the invention. Further embodiments of the invention are envisaged. Whilst for example the configuration manager, Global Active Directory and the global assessment have been described as implemented by computers 2, 12 and 14 respectively, they may be implemented by one or more other computers. Applications automatically added to the white list because they are deemed to be of low risk may be reviewed by network managers and subsequently removed if the managers decide they are of higher risk. It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without departing from the scope of the invention, which is defined in the accompanying claims.
