Network security data management system and method

Abstract

A system for compiling security data from an information network includes at least two network components, each providing data. A data partner is coupled to the network components. The data parser has access to two parser scripts that correspond to the network's component data. Categorized data can be produced by applying the parser scripts to the data received from the network components.

Description

[0001] The present application claims the benefit of prior filed U.S. patent application, Ser. No. 09 / 444,937 filed Nov. 22, 1999, to which the present application is a regular U.S. national application.TECHNICAL FIELD OF THE INVENTION [0002] The present invention relates in general to monitoring data networks and more particularly to a data management system and method for compiling and displaying network security data. BACKGROUND OF THE INVENTION [0003] Network providers want the advantages of accessing outside resources, such as those available on the Internet, but do not want those contacts to result in threats of unauthorized information release, modification of internal records, or network downtime. They also need to protect the network from unauthorized actions performed by internal users. In order to counter those problems, a typical information technology network may include many network components that collect security data or perform functions safeguarding the confidentia...

AI Technical Summary

Benefits of technology

Enables real-time access to security information, reduces the need for extensive personnel monitoring, allows automated event detection, and facilitates updates, ensuring consistent and accessible security data across network components.

Problems solved by technology

Network providers want the advantages of accessing outside resources, such as those available on the Internet, but do not want those contacts to result in threats of unauthorized information release, modification of internal records, or network downtime.

Collecting and using the security data available in a typical network may be difficult and time consuming.

As a result of the dissimilar organization and formats of the security data and the resulting time and effort that would be required to transform it into a usable form and to maintain that transformation as the data category or format changes, the network components that make up a typical network may not be configured to compile and store this data.

Later, if a confidentiality, integrity or availability problem is suspected of having occurred, this data would not be available to confirm this.

The data from each network component is typically analyzed separately, though even the data from a single network component may be difficult to analyze because of an upgrade or change in software that changed the data output format.

Thus, network security personnel typically do not have the resources to monitor the contemporary security data available from their networks.

Images