Policy exceptions for assessment of network system assets
A method for authenticated asset assessment is provided. The method involves executing a scan assistant on an asset to allow a remote scan engine to execute one or more scan operations on the asset for determining a state of the asset. The scan assistant may verify the identity of the scan engine by checking that a certificate received from the scan engine is signed with a private key associated with the scan engine. In some embodiments, the authentication may be performed as part of a TLS handshake process that establishes a TLS connection between the scan engine and the scan assistant. Once the scan engine is authenticated, the scan engine may communicate with the scan assistant according to a communication protocol to collect data about the asset. Advantageously, the disclosed technique reduces security risks associated with authenticated scans and improves the performance of authenticated scans.
1. A method comprising:
performing, by an asset comprising at least one computing resource in a network:
deploying a scan assistant on the asset, wherein the scan assistant is associated with a scan engine outside the network configured to perform scans of the asset to collect information about the asset, and the asset is subject to one or more policy benchmarks of the network that prevents scans of the asset from outside the network;
executing the scan assistant on the asset to perform a scan of the asset, including:
authenticating the scan engine based on a scan engine certificate obtained from the scan engine;
after authenticating the scan engine, establishing a connection with the scan engine;
receiving a request to perform a scan of the asset from the scan engine over the connections wherein the scan includes one or more scan operations that uses an administrative credential of the asset; and
executing the scan on the asset, wherein the execution bypasses the one or more policy benchmarks so that the one or more scan operations are performed to bypass requiring a remote authentication of the administrative credential and to bypass the need for applying a policy exception to the one or more policy benchmarks.
2. The method of claim 1 , further comprising the scan assistant performing a two-way certificate authentication with the scan engine prior to establishing the connection.
3. The method of claim 1 , wherein the connection is established by the scan assistant sending a request for connection to the scan engine.
4. The method of claim 1 , wherein the scan engine is implemented in a platform-as-a-service provider network accessible to the network via Internet.
5. The method of claim 1 , wherein:
the connection is a transport layer security (TLS) connection; and
the one or more scan operations are received according to a communication protocol implemented by the scan assistant and the scan engine; and
the method further comprises the scan assistant sending scan results of the scan back to the scan engine over the connection and according to the communication protocol.
6. The method of claim 1 , wherein the one or more policy benchmarks prohibits remote access to one or more services running the asset.
7. The method of claim 1 , wherein the one or more policy benchmarks are implemented by a gateway of the network and the execution of the scan assistant includes instructing the gateway to bypass the one or more security benchmarks for a duration of the one or more scan operations.
8. The method of claim 1 , wherein the one or more policy benchmarks restricts permissions of remote connections to the asset, and the restriction prevents the one or more scan operations from executing.
9. The method of claim 1 , wherein the one or more scan operations comprise at least one of a command or a script executable on the asset.
10. A system comprising:
one or more computing devices that implement an asset in a network, configured to:
deploy a scan assistant on the asset, wherein the scan assistant is associated with a scan engine outside the network configured to perform scans of the asset to collect information about the asset, and the asset is subject to one or more policy benchmarks of the network that prevents scans of the asset from outside the network;
execute the scan assistant on the asset to perform a scan of the asset, including to:
authenticate the scan engine based on a scan engine certificate obtained from the scan engine;
after the scan engine is authenticated, establish a connection with the scan engine;
receive a request to perform a scan of the asset from the scan engine over the connections wherein the scan includes one or more scan operations that uses an administrative credential of the asset; and
execute the scan on the asset, wherein the execution bypasses the one or more policy benchmarks so that the one or more scan operations are performed to bypass requiring a remote authentication of the administrative credential and to bypass the need for applying a policy exception to the one or more policy benchmarks.
11. The system of claim 10 , wherein the scan assistant is configured to perform a two-way certificate authentication with the scan engine prior to establishing the connection.
12. The system of claim 10 , wherein the scan assistant is configured to send a request for connection to the scan engine to establish the connection.
13. The system of claim 10 , wherein the scan engine is implemented in a platform-as-a-service provider network accessible to the network via Internet.
14. The system of claim 10 , wherein:
the connection is a transport layer security (TLS) connection; and
the one or more scan operations are received according to a communication protocol implemented by the scan assistant and the scan engine; and
the scan assistant is configured to send scan results of the scan back to the scan engine over the connection and according to the communication protocol.
15. The system of claim 10 , wherein the one or more policy benchmarks prohibits remote access to one or more services running the asset.
16. The system of claim 10 , wherein the one or more policy benchmarks are implemented by a gateway of the network and the execution of the scan assistant includes to instruct the gateway to bypass the one or more security benchmarks for a duration of the one or more scan operations.
17. The system of claim 10 , wherein the one or more policy benchmarks restricts permissions of remote connections to the asset, and the restriction prevents the one or more scan operations from executing.
18. One or more non-transitory computer readable media storing program instructions that when executed on one or more processors implement an asset in a network and cause the asset to:
deploy a scan assistant on the asset, wherein the scan assistant is associated with a scan engine outside the network configured to perform scans of the asset to collect information about the asset, and the asset is subject to one or more policy benchmarks of the network that prevents scans of the asset from outside the network;
execute the scan assistant on the asset to perform a scan of the asset, including to:
authenticate the scan engine based on a scan engine certificate obtained from the scan engine;
after the scan engine is authenticated, establish a connection with the scan engine;
receive a request to perform a scan of the asset from the scan engine over the connection, wherein the scan includes one or more scan operations that uses an administrative credential of the asset; and
execute the scan on the asset, wherein the execution bypasses the one or more policy benchmarks so that the one or more scan operations are performed to bypass requiring a remote authentication of the administrative credential and to bypass the need for applying a policy exception to the one or more policy benchmarks.
19. The one or more non-transitory computer readable media of claim 18 , wherein the program instructions when executed on one or more processors causes the scan assistant to perform a two-way certificate authentication with the scan engine prior to establishing the connection.
20. The one or more non-transitory computer readable media of claim 18 , wherein the program instructions when executed on one or more processors causes the scan assistant to send scan results of the scan back to the scan engine over the connection.