Computerized system for complying with certain critical infrastructure protection requirements
View Patent ↗A computerized system for complying with critical infrastructure protection (“CIP”) standards concerning system configuration changes. The system can be used to automatically identify and track changes to computers on the network, improving system security and CIP compliance reporting. In certain embodiments, the system collects system information on servers and workstations using built-in commands. The configuration profiles of these computers/devices can be archived for audit purposes.
1. One or more non-transitory, computer-readable storage media comprising a plurality of instructions that in response to being executed cause a computing device to:
collect system information by communicating with a plurality of devices over an electronic communications network to execute a plurality of command line operations on the plurality of devices, wherein the command line operations are selected to target extraction of profile elements based on one or more critical infrastructure protection (“CIP”) standards in one or more of the following: CIP-003 R6, CIP-007 R1, CIP-007 R2, CIP-007 R3, CIP-007 R4, and/or CIP-007 R5;
compare the collected system information for the plurality of devices with baseline system configurations to determine whether any changes have been made that could indicate a potential threat;
remediate one or more items based on a determination that one or more changes have been made that could indicate a potential threat; and
set the collected system information as the baseline system configurations for the plurality of devices based on a determination that no changes have been made that could indicate a potential threat.
2. The one or more non-transitory, computer-readable storage media as recited in claim 1 , wherein to collect system information comprises collecting at least a portion of the system information by running commands built into the device for which system information is being collected to gather one or more of local audit policy settings, local user groups, hardware manufacturer, model, hard drive space, operating system, service pack level, patches to a device, network adapter information, TCP ports and services, UDP ports and services, antivirus definition version information, installed applications and/or local password policy.
3. The one or more non-transitory, computer-readable storage media as recited in claim 1 , wherein a plurality of profile elements for respective devices are combined into respective profile configurations for each device.
4. The one or more non-transitory, computer-readable storage media as recited in claim 1 , further comprising one or more instructions to archive the collected system information indexed by date collected.
5. The one or more non-transitory, computer-readable storage media as recited in claim 1 , wherein at least a portion of the devices for which system information is collected are non-critical cyber assets.
6. The one or more non-transitory, computer-readable storage media as recited in claim 1 , wherein the devices for which system information is collected includes: servers, workstations, network devices, installed applications, network ports, and services.
7. The one or more non-transitory, computer-readable storage media as recited in claim 1 , further comprising one or more instructions to identify changes to system information since the baseline system configuration.
8. The one or more non-transitory, computer-readable storage media as recited in claim 1 , further comprising one or more instructions to automatically send a periodic report identifying whether any changes have been made that could indicate a potential threat on at least a daily basis.
9. One or more non-transitory, computer-readable storage media comprising a plurality of instructions that in response to being executed cause a computing device to:
collect system information by communicating with a plurality of devices over an electronic communications network to execute a plurality of command line operations on the plurality of devices to gather one or more of local audit policy settings, local user groups, hardware manufacturer, model, hard drive space, operating system, service pack level, patches to a device, network adapter information, TCP ports and services, UDP ports and services, antivirus definition version information, installed applications and/or local password policy, wherein the command line operations are selected to target extraction of profile elements based on one or more critical infrastructure protection (“CIP”) standards in one or more of the following: CIP-003 R6, CIP-007 R1, CIP-007 R2, CIP-007 R3, CIP-007 R4, and/or CIP-007 R5;
compare the collected system information for the plurality of devices with baseline system configurations to determine whether any changes have been made that could indicate a potential threat;
remediate one or more items based on a determination that one or more changes have been made that could indicate a potential threat; and
set the collected system information as the baseline system configurations for the plurality of devices based on a determination that no changes have been made that could indicate a potential threat; and
wherein the devices for which system information is collected includes: servers, workstations, network devices, installed applications, network ports, and/or services.
10. The one or more non-transitory, computer-readable storage media as recited in claim 9 , wherein a plurality of profile elements for respective devices are combined into respective profile configurations for each device.
11. The one or more non-transitory, computer-readable storage media as recited in claim 9 , further comprising one or more instructions to archive the collected system information indexed by date collected.
12. The one or more non-transitory, computer-readable storage media as recited in claim 9 , wherein at least a portion of the devices for which system information is collected are non-critical cyber assets.
13. The one or more non-transitory, computer-readable storage media as recited in claim 9 , further comprising one or more instructions to identify changes to system information since the baseline system configuration.
14. The one or more non-transitory, computer-readable storage media as recited in claim 9 , further comprising one or more instructions to automatically send a periodic report identifying whether any changes have been made that could indicate a potential threat on at least a daily basis.
15. A method of detecting a potential threat to one or more critical cyber assets, the method comprising:
collecting, by a computing device, system information by communicating with a plurality of devices over an electronic communications network to execute a plurality of command line operations on the plurality of devices to gather one or more of local audit policy settings, local user groups, hardware manufacturer, model, hard drive space, operating system, service pack level, patches to a device, network adapter information, TCP ports and services, UDP ports and services, antivirus definition version information, installed applications and/or local password policy, wherein the command line operations are selected to target extraction of profile elements based on one or more critical infrastructure protection (“CIP”) standards in one or more of the following: CIP-003 R6, CIP-007 R1, CIP-007 R2, CIP-007 R3, CIP-007 R4, and/or CIP-007 R5;
comparing, by the computing device, the collected system information for the plurality of devices with baseline system configurations to determine whether any changes have been made that could indicate a potential threat;
remediating, by the computing device, one or more items based on a determination that one or more changes have been made that could indicate a potential threat; and
setting, by the computing device, the collected system information as the baseline system configurations for the plurality of devices based on a determination that no changes have been made that could indicate a potential threat; and
wherein the devices for which system information is collected includes: servers, workstations, network devices, installed applications, network ports, and/or services.
16. The method as recited in claim 15 , wherein a plurality of profile elements for respective devices are combined into respective profile configurations for each device.
17. The method as recited in claim 15 , further comprising the step of archiving the collected system information indexed by date collected.
18. The method as recited in claim 15 , wherein at least a portion of the devices for which system information is collected are non-critical cyber assets.
19. The method as recited in claim 15 , further the step of identifying changes to system information since the baseline system configuration.
20. The method as recited in claim 15 , further comprising the step of automatically sending a periodic report identifying whether any changes have been made that could indicate a potential threat on at least a daily basis.