System and method for performing remote security assessment of firewalled computer
Methods and systems for scanning an endpoint terminal across an open computer network are disclosed. An exemplary method includes providing a scanner engine in a computer server in communication with an open computer network, and establishing a secure connection across the open computer network between the scanner engine and a scanner agent installed on the endpoint terminal in communication with the open computer network. Commands for collecting data regarding the endpoint terminal are sent from the scanner engine across the secure connection to the scanner agent. The scanner engine then receives the collected data from the scanner agent across the secure connection, analyzes the data to assess a current posture of the endpoint terminal, and determines any updates for the endpoint terminal from the analysis. Updates are sent across the secure connection to the scanner agent for installation on the endpoint terminal, and the secure connection may then be terminated.
1. A method comprising:
establishing a connection between a scanner engine associated with a scanner server and a scanner client associated with an endpoint device, wherein the scanner client communicates with an Internet application executable by the endpoint device, wherein the scanner server and the endpoint device are in communication with one or more networks, and wherein the scanner client comprises or is a first scanner client;
transmitting, from the scanner server to the scanner client, first update data for updating the scanner client;
transmitting, from the scanner engine to the scanner client and using the connection, commands for collecting, by the scanner client, data associated with the endpoint device;
receiving, at the scanner engine from the scanner client and using the connection, the data associated with the endpoint device, wherein the data associated with the endpoint device is collected using the scanner client;
analyzing the data associated with the endpoint device using the scanner engine to determine a security or vulnerability data or status of the endpoint device;
identifying second update data for the endpoint device based on analyzing the data associated with the endpoint device; and
transmitting the second update data from the scanner engine to the endpoint device, wherein the scanner server is located remotely from the endpoint device.
2. The method of claim 1 , wherein the identifying the second update data for the endpoint device is performed by the scanner engine.
3. The method of claim 1 , wherein the data associated with the endpoint device is analyzed using malware signature data to determine the security or vulnerability data or status of the endpoint device.
4. The method of claim 1 , wherein the first scanner client is or comprises a conduit that enables the scanner engine associated with the scanner server to remotely scan the endpoint device.
5. The method of claim 1 , wherein the endpoint device executes an Internet application, and wherein the Internet application comprises a web application or a browser application.
6. The method of claim 1 , wherein at least one of: a firewall is located between the endpoint device and the one or more networks, the first scanner client comprises or is a thin scanner client, the first scanner client is a substantially or partially non-intrusive scanner client, the first scanner client is updated or installed on the endpoint device without prompting a user of the endpoint device prior to an update or installation of the scanner client on the endpoint device, the data associated with the endpoint device is collected using the scanner client, the data associated with the endpoint device comprises at least one of system configuration data, file system data, and system service data associated with the endpoint device.
7. The method of claim 1 , wherein the scanner client accesses or receives operating system data associated with the endpoint device, and the scanner client, in response to accessing or receiving the operating system data associated with the endpoint device, collects the data associated with the endpoint device.
8. The method of claim 1 , wherein the first update data for updating the scanner client is transmitted from the scanner server to the scanner client without requiring authorization of, or prompting, the endpoint device or a user of the endpoint device.
9. The method of claim 1 , wherein the data associated with the endpoint device comprises at least one of system configuration data, file system data, or system service data associated with the endpoint device.
10. The method of claim 1 , wherein the second update data for the endpoint device comprises a scanner client update for the scanner client associated with the endpoint device.
11. The method of claim 1 , wherein at least one of:
the first update data or the second update data is transmitted using a first communication protocol,
the commands are transmitted using the first communication protocol or a second communication protocol,
the data associated with the endpoint device is received using the first communication protocol or the second communication protocol,
the scanner server receives a request from the scanner client to scan the endpoint device,
the scanner server receives scanner client data associated with the scanner client and determines that the scanner client needs to be updated, or
the scanner server receives operating system data associated with the endpoint device and determines that the scanner client needs to be updated or that the endpoint device needs to be scanned.
12. The method of claim 1 , wherein at least one of:
the connection between the scanner engine associated with the scanner server and the scanner client associated with the endpoint device is established using a network socket,
the connection between the scanner engine associated with the scanner server and the scanner client associated with the endpoint device comprises an open socket connection, or
the connection comprises one or more connections.
13. The method of claim 1 , wherein the connection between the scanner engine associated with the scanner server and the scanner client associated with the endpoint device comprises a direct connection, wherein the direct connection is at least one of used for: the transmitting the commands to the endpoint device, the receiving the data associated with the endpoint device, the transmitting the first update data, or the transmitting the second update data.
14. The method of claim 1 , further comprising terminating the connection between the scanner engine associated with the scanner server and the scanner client associated with the endpoint device after the transmitting the second update data from the scanner engine to the endpoint device.
15. An apparatus comprising:
at least one computer readable storage including instructions; and
at least one processing device configured to execute the instructions, wherein executing the instructions causes the at least one processing device to perform operations of:
establishing a connection between a scanner engine associated with the apparatus and a scanner client associated with an endpoint device, wherein the apparatus and the endpoint device are in communication with one or more networks, wherein the scanner client comprises or is a first scanner client;
transmitting, from the apparatus to the scanner client, first update data for updating the scanner client;
transmitting, from the scanner engine to the scanner client using the connection, commands for collecting, by the scanner client, data associated with the endpoint device;
receiving, at the scanner engine and from the scanner client using the connection, the data associated with the endpoint device, wherein the data associated with the endpoint device is collected using the scanner client;
analyzing the data associated with the endpoint device using the scanner engine to determine a security or vulnerability data or status of the endpoint device;
identifying second update data for the endpoint device based on analyzing the data associated with the endpoint device; and
transmitting the second update data from the scanner engine to the endpoint device,
wherein the apparatus is located remotely from the endpoint device.
16. The apparatus of claim 15 , wherein at least one of the data associated with the endpoint device, the commands for collecting the data associated with the endpoint device, or the second update data for the endpoint device is encrypted; or wherein the second update data comprises at least one of a virus definition update, a worm definition update, or a spyware definition update.
17. The apparatus of claim 15 , wherein the first scanner client comprises or is a thin scanner client.
18. The apparatus of claim 15 , wherein the scanner client and the scanner engine are in communication using a tunnel.
19. The apparatus of claim 18 , wherein the tunnel enables bi-directional communication between the scanner client and the scanner engine.
20. The apparatus of claim 15 , wherein the apparatus is in communication with the one or more networks via a proxy, and wherein the proxy takes over the connection in response to the scanner client associated with the endpoint device not being in communication with the scanner engine associated with the apparatus.
21. An apparatus comprising:
a scanner server in communication with one or more networks, wherein the scanner server is associated with a scanner engine for conducting a scan of an endpoint device, wherein the endpoint device executes an Internet application and is in communication with the one or more networks, and wherein conducting the scan of the endpoint device comprises:
establishing a connection between the scanner engine associated with the scanner server and a scanner client associated with the endpoint device, or between the scanner server and the endpoint device;
transmitting, from the scanner server to the scanner client, first update data for updating the scanner client;
transmitting, from the scanner server to the endpoint device using the connection, commands for collecting, by the scanner client, data associated with the endpoint device;
receiving, at the scanner server and from the endpoint device using the connection, the data associated with the endpoint device;
analyzing the data associated with the endpoint device using the scanner server to determine a security or vulnerability data or status of the endpoint device;
identifying second update data for the endpoint device based on analyzing the data associated with the endpoint device; and
transmitting the second update data from the scanner server to the endpoint device,
wherein the scanner server is located remotely from the endpoint device.
22. The apparatus of claim 21 , wherein the transmitting, from the scanner server to the scanner client, the first update data for updating the scanner client is performed based on, or in response to, determining the scanner client needs to be updated.
23. The apparatus of claim 21 , wherein the transmitting, from the scanner server to the endpoint device using the connection, the commands for collecting the data associated with the endpoint device comprises transmitting, from the scanner server to the scanner client associated with the endpoint device using the connection, the commands for collecting the data associated with the endpoint device, and wherein the receiving, at the scanner server and from the endpoint device using the connection, the data associated with the endpoint device comprises receiving, at the scanner server and from the scanner client associated with the endpoint device using the connection, the data associated with the endpoint device.
24. The apparatus of claim 21 , wherein the analyzing the data associated with the endpoint device using the scanner server to determine the security or vulnerability data or status of the endpoint device comprises analyzing, based on signature data, the data associated with the endpoint device using the scanner server to determine the security or vulnerability data or status of the endpoint device.
25. The apparatus of claim 21 , wherein the scanner client comprises or is a thin scanner client.