Agent presence for self-healing
In one or more examples, there is disclosed a system and method of detecting agent presence for self-healing. An out-of-band monitoring process, such as Intel® AMT, or any process in firmware executing on a co-processor, may monitor one or more processes to determine if one goes down or otherwise meets a security criterion. Crashed processes may be reported to an enterprise security controller (ESC). The ESC may notice trends among affected machines and instruct the machines to take appropriate remedial action, such as booting from a remedial image.
1. A method implemented by a computing device including at least one of firmware, a co-processor, a trusted execution environment, or a secure memory area, the method comprising:
registering a plurality of applications executing on a network of a plurality of client devices to be monitored for classes of errors, the classes of errors including a malware error and a non-malware error;
receiving reports of a plurality of security events related to the plurality of applications, the plurality of security events indicative of similar classes of errors in the plurality of applications;
receiving instructions for taking a security action based on the plurality of security events occurring within a period of time, the period of time indicative that the security events correspond to the malware error; and
causing the plurality of client devices to take the security action to remedy the malware error.
2. The method of claim 1 , wherein the plurality of security events include detecting that a monitored process uses excessive system resources.
3. The method of claim 1 , wherein the plurality of security events indicate that a malfunction or crash of the plurality of applications has occurred.
4. The method of claim 1 , further comprising:
isolating the plurality of client devices if the plurality of security events are not healed by restarting the plurality of applications.
5. The method of claim 1 , wherein the plurality of applications are defined by a security policy.
6. The method of claim 1 , wherein at least one of the plurality of client devices receives an instruction to retrieve a remediation image.
7. A computing apparatus, comprising:
a memory; and
at least one of firmware, a co-processor, a trusted execution environment, or a secure memory area, the at least one of firmware, co-processor, trusted execution environment, or secure memory area including an out-of-band management engine operable for:
monitoring a plurality of registered applications executing on a network of a plurality of client devices for classes of errors, the classes of errors including a malware error and a non-malware error;
receiving reports of a plurality of security events related to the plurality of registered applications, the plurality of security events indicative of similar classes of errors in the plurality of registered applications; and
sending instructions to the plurality of client devices for taking a security action based on the plurality of security events occurring within a period of time, the period of time indicative that the security events correspond to the malware error, the instructions to cause the plurality of client devices to take the security action to remedy the malware error.
8. The computing apparatus of claim 7 , wherein the plurality of security events include detecting that a monitored process uses excessive system resources.
9. The computing apparatus of claim 7 , wherein the plurality of security events indicate that a malfunction or crash of the plurality of registered applications has occurred.
10. The computing apparatus of claim 7 , wherein the out-of-band management engine further is operable for isolating the plurality of client devices if the out-of-band management engine is not able to heal the plurality of security events by restarting the plurality of registered applications.
11. The computing apparatus of claim 7 , wherein the plurality of registered applications are defined by a security policy.
12. The computing apparatus of claim 7 , wherein at least one of the plurality of client devices receives an instruction to retrieve a remediation image.
13. A non-transitory, computer-readable medium comprising instructions to cause programmable circuitry to at least:
monitor a plurality of registered applications executing on a network of a plurality of client devices for classes of errors, the classes of errors including a malware error and a non-malware error;
receive reports of a plurality of security events related to the plurality of registered applications, the plurality of security events indicative of similar classes of errors in the plurality of registered applications;
sending instructions to the plurality of client devices for taking a security action based on the plurality of security events occurring within a period of time, the period of time indicative that the security events correspond to the malware error; and
causing the plurality of client devices to take the security action to remedy the malware error.
14. The computer-readable medium of claim 13 , wherein the plurality of security events include detecting that a monitored process uses excessive system resources.
15. The computer-readable medium of claim 13 , wherein the plurality of security events indicate that a malfunction or crash of the plurality of registered applications has occurred.
16. The computer-readable medium of claim 13 , the instructions are to cause the programmable circuitry to:
isolate the plurality of client devices if the plurality of security events are not healed by restarting the plurality of registered applications.
17. The computer-readable medium of claim 13 , wherein the instructions are to cause the programmable circuitry to at least send an instruction to the plurality of client devices to retrieve a remediation image.