US 8,302,198 B2 · System and method for enabling remote registry service security audits

Abstract

The system and method for enabling remote registry service security audits described herein may include scanning a network to construct a model or topology of the network. In particular, the model or topology of the network may include characteristics describing various devices in the network, which may be analyzed to determine whether a remote registry service has been enabled on the devices. For example, the security audits may include performing one or more credentialed policy scans to enable the remote registry service for certain devices that have disabled the remote registry service, auditing the devices in response to enabling the remote registry service, and then disabling the remote registry service on the devices. Thus, the system and method described herein may enable remotely scanning information contained in device registries during a security audit without exposing the device registries to malicious activity.

Claims20

Dependent claims

A system for enabling remote registry service security audits, comprising:

a vulnerability management system that maintains a model of a network, wherein the model of the network includes a plurality of devices discovered in the network that have a remote registry service;
and
an active vulnerability scanner that actively scans the network to detect one or more vulnerabilities in the network, wherein the active vulnerability scanner is configured to:
identify one or more of the plurality of devices discovered in the network that have disabled the remote registry service;
communicate one or more activation messages to the devices that have disabled the remote registry service, wherein the activation messages enable the remote registry service on the identified devices;
interact with the enabled remote registry service on the identified devices to obtain registry information from the identified devices;
and
communicate one or more deactivation messages to the identified devices in response to obtaining the registry information from the identified devices, wherein the deactivation messages disable the remote registry service on the identified devices.

5 more elements

A method for enabling remote registry service security audits, comprising:

maintaining a model of a network in a vulnerability management system, wherein the model of the network includes a plurality of devices discovered in the network that have a remote registry service;
identifying, by an active vulnerability scanner that actively scans the network, one or more of the plurality of devices discovered in the network that have disabled the remote registry service;
communicating one or more activation messages from the active vulnerability scanner to the devices that have disabled the remote registry service, wherein the activation messages enable the remote registry service on the identified devices;
interacting with the enabled remote registry service on the identified devices, wherein the active vulnerability scanner interacts with the enabled remote registry service on the identified devices to obtain registry information from the identified devices;
and
communicating one or more deactivation messages from the active vulnerability scanner to the identified devices in response to the active vulnerability scanner obtaining the registry information from the identified devices, wherein the deactivation messages disable the remote registry service on the identified devices.

3 more elements

Dependencies are inferred from the claim text.

System and method for enabling remote registry service security audits

Life of this patent

System and method for enabling remote registry service security audits

Life of this patent

Abstract

Claims20