METHOD FOR OPERATURED A NETWORK AND COMPUTER PROGRAM PRODUCT

Description

[0001] The invention relates to a method for operating a network with at least one endpoint with at least one network resource or administering at least one network resource and a computer program product.

[0002] Networks in companies and manufacturing facilities are regularly exposed to numerous attacks from third parties. Therefore, ensuring IT security is of paramount importance. Documents US 8 874 685 B1, US 9 762 582 B1, US 2007 / 143851 A1, US 2016 / 373478 A1, and US 2014 / 046645 A1 are known from the prior art.

[0003] It is therefore an object of the invention to provide a method for operating a network which can be carried out securely and which has an option for automation.

[0004] The method according to the invention is a method according to claim 1 for operating a network with at least one endpoint with at least one network resource or administering at least one network resource. The method according to the invention comprises the following steps: Defining a rule set with at least one rule for the at least one endpoint, monitoring compliance of the at least one endpoint with the rule set, assigning a score depending on the compliance and determining at least one action depending on the score.

[0005] Ideally, the method according to the invention is a computer-implemented method.

[0006] Using the method according to the invention, the network can be advantageously operated in accordance with IT security requirements. The rule set expediently includes IT security rules, so that the method according to the invention can easily secure networks, for example, in companies or production facilities.

[0007] In the method according to the invention, the at least one measure preferably comprises limiting the privileges of the endpoint in the network depending on the score. For example, administration of the network resource can be restricted to a less security-critical subset of privileges.

[0008] In methods according to the invention, the at least one measure preferably comprises terminating the operation of the network. In the extreme case where continued operation of the network would be irresponsible, terminating the operation of the network may be considered.

[0009] In the method according to the invention, the at least one endpoint is preferably formed with at least one network resource and / or at least one piece of administrator hardware, preferably a client computer and / or authentication hardware, and / or at least one hardware interface, preferably a user account. Advantageously, the client computer or the authentication hardware, such as an electronically readable company ID card, can be linked to an administrator account, so that only a single administrator can connect to the endpoint.

[0010] In an advantageous development of the method according to the invention, the at least one network resource is formed with hardware, in particular a server, and / or with software, in particular an operating system and / or an application program for use by means of the network.

[0011] In an advantageous development of the method according to the invention, the endpoint forms an administrator interface.

[0012] Preferably, in the method according to the invention, the rule set specifies the regularity of an update of the software and / or a software on the hardware.

[0013] In an advantageous development of the method according to the invention, the measure comprises a limitation of administrative privileges and / or a change in the connection of the endpoint to the network, such as a separation of the endpoint from the network, and / or training for an administrator connecting to the endpoint.

[0014] In the latter case, the aforementioned training is appropriately assigned a score in at least two categories and the training is adapted, preferably by means of modules, depending on the score in the categories, preferably depending on the composition of the categories and / or the absolute and / or relative weight of the categories.

[0015] Suitably, in a further development of the invention, an administrator is only admitted to the network after training.

[0016] Preferably, in the method according to the invention, the score is awarded or maintained depending on a, preferably repeated, training and / or a, preferably repeated, review.

[0017] The computer program product according to claim 11 is designed for use in the method according to the invention as described above. The computer program product according to the invention is designed to store a rule set with at least one rule for the at least one endpoint, to receive observation data regarding the compliance of the at least one endpoint with the rule set, and to assign a score depending on the compliance.

[0018] The invention is explained in more detail below using an exemplary embodiment illustrated in the drawing. The sole drawing Figure 1 shows a schematic cross-section of a corporate network with network resources administered via the corporate network.

[0019] The Fig. 1The network 10 shown is a corporate network and has interconnected computers. Some of the computers in network 10 form distributed servers 30 for network resources. Other computers in network 10 are implemented as client computers 50 for administering the servers 30. Both the servers 30 and the client computers 50 form endpoints of network 10, which either feed content or services into network 10 as servers 30 or, as client computers 50, provide an interface to an administrator for administrative tasks. In the illustrated embodiment, network 10 is designed as a cloud network. In this cloud network, servers 30 are not separate computers isolated from one another with regard to their respective hardware, but rather each server 30 is present as a logical server 30 in the sense of a distributed database stored on a plurality of computers in network 10.In further embodiments not specifically shown, the network 10 can also be designed as another, conventional, for example hierarchical network 10, in which the servers 30 are present as separate, physically separated hardware servers.

[0020] The servers 30 are configured to run project coordination software via the network 10. Using the project coordination software, users can input project milestones into the system and coordinate with each other regarding their achievement, so that a user receives a quick overview of a project status and the fulfillment of their obligations regarding the project milestones.

[0021] The network also contains a central rights management server 60, which grants or denies access rights to the network resources.

[0022] The network 10 also has an observation unit 70, which monitors the security status of the network 10. The observation unit 70 checks an update status of the operating systems of the servers 30 at regular intervals or continuously, for example, the update status of Linux systems of the servers 30. In doing so, the observation unit 70 compares the currentness of the respective operating system with a target currentness of the operating system, which corresponds, for example, to a recommendation from a repository maintainer of a distribution of the Linux system.For example, if current patches to the Linux system have not been installed, a score is calculated and assigned to the respective server 30, depending on the period over which the Linux system was not updated despite a possible update, as well as the number and security criticality of the patches, which is derived, for example, from a classification by the developers or repository maintainers. For example, the score contains a sum of a value proportional to the above-mentioned period (for example, a specification of the period in hours with a proportionality factor) and a value that sums up a measure (e.g., a value of "5" for "highly critical," a value of "3" for "critical," and a value of "1" for "recommended") for the security criticality of each patch that was missed despite availability.In this way, each server 30 is assigned a score for the security of the operating system, which is higher the more or more serious security vulnerabilities the respective server 30 has.

[0023] A similar score is also assigned to the project coordination software depending on the patches or updates available for it.

[0024] The sum of the score for the project coordination software and the score for the operating system forms an overall score for server 30, which is assigned to server 30 as a certificate. If the overall score exceeds a first critical threshold, this overall score or information about the exceedance of this first threshold is transmitted to the rights management server 60, which, based on the exceedance of the first threshold, initiates a measure to increase the security of network 10. The measure may, for example, involve restricted operation of server 30 in an emergency mode or—if the threshold is significantly exceeded, for example by a factor of 50 percent—a shutdown of server 30 or network 10.

[0025] In addition, such an overall score is not assigned solely to server 30. Rather, an overall score is also assigned to the respective administrator (not explicitly shown in the drawing), who is responsible for updating server 30 and the project coordination software. This assignment is made either to a client computer 50 of the respective administrator or, in the case of a possible change of client computers 50 of the respective administrator, to an administrator account for the administrator's privileged access to network 10.

[0026] In the illustrated example, the assignment of an overall score to server 30 and the allocation of a score value to the administrator account are performed using a score account, each uniquely assigned to server 30 and the administrator account. The score accounts of server 30 and the administrators are maintained on the rights management server 60.

[0027] In the illustrated example, the assignment is made to an administrator account, which in the illustrated example is clearly assigned to a specific administrator. Only those score values ​​are assigned to the administrator account that are attributable to software under the responsibility of the administrator of the administrator account, i.e., for which the administrator of the administrator account actually performs update tasks. The rights management is outlined in Fig. 2:

[0028] To be authorized for an administrator role for a server 30 of network 10, an administrator must complete a cybersecurity training (CYTR), which provides information on a set of security-relevant rules that are binding for network 10. These security-relevant rules include, among other things, the requirement for timely and, if possible, complete patch application. Upon completion of the cybersecurity training (CYTR), the administrator is awarded an ISDL administrator certificate. Based on the ISDL administrator certificate, a cryptographic signature is added to the administrator account as an administrator signature, authorizing the administrator to act as the administrator of server 30.

[0029] At the same time, server 30 itself must also meet security requirements, which are summarized in a system target configuration (SYSOPC), which requires that all software installed on server 30, in this case the operating system and the project coordination software, is up-to-date. After checking whether server 30's configuration satisfies the system target configuration (SYSOPC), server 30 is granted ISLP server authorization for network 10. Based on the ISLP server authorization for network 10, server 30 is assigned a further cryptographic signature in the form of a server signature, which identifies server 30 as at least initially satisfying the system target configuration (SYSOPC). Using the server signature, server 30 is authorized for integration into network 10. In the illustrated embodiment, an administrator logs in to the network 10 to administer a server 30 as follows:

[0030] First, an administrator authenticates himself to network 10 in a conventional manner using UACREQ. To do so, he transmits a unique identifier to network 10 using his administrator account. The rights management server 60 checks whether the administrator has an administrator certificate based on the administrator signature assigned to the identifier. If so, an administrator account is determined based on the administrator signature and the score account assigned to this administrator account is identified. The score value recorded in the score account is checked to see if it exceeds the first threshold. If the score value is below the first threshold, the administrator's login to network 10 is continued. If the score value is above the first threshold, the administrator is rejected from network 10.

[0031] The administrator then selects a server 30 on which the project coordination software runs and which they will administer. Server 30 checks whether the administrator has previously been registered with UREGSYS to administer server 30. If this is not the case, the administrator is rejected by server 30. If the administrator is registered to administer server 30, the administrator's login continues.

[0032] Finally, the rights management server 60 checks the server signature of server 30 to determine whether it currently complies with the system target configuration SYSOPC. If this is the case, the administrator receives permission OPALL to administer server 30. If, however, server 30 does not currently comply with the system target configuration SYSOPC, the server authorization ISLP is revoked.

[0033] In the illustrated embodiment, the ISLP server authorization of server 30 and the ISDL administrator certificate for administering server 30 are not only validated for the initial authorization of the administrators and server 30 to network 10. Rather, the maintenance of the ISDL administrator certificate is made dependent on the score value of the score account of the administrator account associated with the administrator, and the ISLP server authorization is made dependent on the score value of the score account of server 30. Thus, the monitoring unit 70 regularly or continuously checks the update status of the operating systems of the servers 30. If the score value of the score account of the administrator account associated with the administrator exceeds the first threshold, the administrator is excluded from further administration of server 30 by the rights management server 60. Furthermore, the server 30 is also disconnected from network 10.In further embodiments not specifically illustrated, the administrator is not excluded from further administration of server 30, but rather a corresponding message is sent to a security officer of network 10, indicating that the first threshold has been exceeded. Furthermore, server 30 is not disconnected from network 10, but rather a message is sent to the security officer of network 10 so that he or she can investigate the situation further.

[0034] If an administrator of a server 30 of network 10 exceeds the score account assigned to them, the rights management server 60 can impose training on them, after which they will be reissued the ISDL administrator certificate. In particular, the score value can be determined in several dimensions, for example, in each case related to the software of the server 30 configured by them, in this case, for example, the project coordination software and an operating system of the server 30. If, upon exceeding the first threshold of the score value of the score account assigned to the administrator via the administrator account, it is determined that the exceedance is largely due to a defective update of the operating system of the server 30, the training can automatically provide a higher weighting for content related to the operating system of the server 30.For this purpose, the score values ​​are expediently recorded in those dimensions, i.e. categories, for which modularized training content is available. In the illustrated embodiment, the training content is modularized into 5 to 10 categories, which are then included in a training course for administrators when the categories have entries when the score value is exceeded. Those categories to which no score value other than zero is assigned are either completely ignored when weighting the training or are taken into account with standard content which differs from follow-up training content, which is then included in the training for the administrator when the category has a score value other than zero. In the illustrated embodiment, the training modules are compiled automatically using software from the rights management server 60.

Claims

1. Method for operating a network (10) having at least one endpoint (50) which administers at least one network resource (30), comprising the following steps: - defining a rule set having at least one rule for the at least one endpoint (50), - monitoring compliance of the at least one endpoint (50) with the rule set, - allocating a score depending on the compliance, and - determining at least one measure depending on the score, - characterized in that the endpoint (50) forms an administrator interface, and - wherein the rule set having the at least one rule is a rule set for administration of the at least one network resource (30) by the at least one endpoint (50), and - the at least one network resource (30) is present in each case in a manner physically separated from the at least one endpoint (50) which administers this network resource, and - the network resource (30) can not just be accessed by the at least one endpoint (50) which administers this network resource (30), but rather can be accessed by one or more further endpoints of the network, and wherein - the at least one network resource (30) is formed with hardware, in particular a server, and / or with software, in particular an operating system and / or an application program for application by means of the network (10), and - the rule set defines the regularity and / or timeliness of an update of the software and / or of software on the hardware, and - the score is dependent on a period of time over which at least one update is missed, and / or dependent on a number and / or a criticality regarding IT security of missed updates.

2. Method according to the preceding claim, wherein the at least one measure comprises limiting privileges of the endpoint (50) in the network (10) depending on the score.

3. Method according to Claim 2, wherein limiting the privileges is limiting the privileges for administering the network resource (30).

4. Method according to any of the preceding claims, wherein the at least one measure comprises a termination of the operation of the network (10).

5. Method according to any of the preceding claims, wherein the at least one endpoint (50) is formed with in each case at least one network resource (30) and / or at least one item of administrator hardware, preferably a client computer and / or authentication hardware, and / or at least one hardware interface, preferably a user account.

6. Method according to any of the preceding claims, wherein the measure comprises a change or limitation of administrative privileges.

7. Method according to any of the preceding claims, wherein the measure comprises a linking or change of the linking of the endpoint (50) to the network (10).

8. Method according to any of the preceding claims, wherein the measure comprises training for an administrator connecting to the endpoint (50).

9. Method according to any of the preceding claims, wherein the score is allocated in at least two categories and the training, preferably by means of modules, is adapted depending on the score in the categories, preferably on the occupancy of the categories and / or the absolute and / or relative weight of the categories, and / or wherein an administrator is authorized with respect to the network (10) only after training.

10. Method according to any of the preceding claims, wherein the score is assigned or maintained or changed depending on training, preferably repeated training, and / or checking, preferably repeated checking.

11. Computer program product, designed for carrying out the method according to any of the preceding claims, furthermore designed for storing a rule set having at least one rule for the at least one endpoint (50), for receiving monitoring data concerning the compliance of the at least one endpoint (50) with the rule set, and for allocating a score depending on the compliance.