IT CONFORMITY ANALYSIS DEVICE FOR A SET OF DISTINCT INFORMATION SYSTEMS

Abstract

The invention relates to a device for analyzing the IT compliance of a set of separate information systems (38-40), each information system (38-40) comprising a set of devices (41-44) on which an agent (30) is installed; the analysis device comprising: - a general server (50) on which several collectors (25-26) are stored, each collector (25-26) corresponding to a computer program executable by an agent (30) on a device (41-44) with a specific hardware and / or software configuration in order to automate the search for several IT compliance information according to the parameters applied to the collector (25-26);and at least one centralization unit (20) for each information system (38-40), each centralization unit (20) being connected to the various agents (30) of its information system (38-40) and to the general server (50), the centralization unit (20) being configured to detect new devices (41-44), search for collectors (5) and command the agents (30). Figure for abbreviation: figure 1.;

Description

Title of the invention: DEVICE FOR ANALYZING THE COMPUTER CONFORMITY OF A SET OF DISTINCT INFORMATION SYSTEMS Scope of the invention

[0001] The invention relates to the field of computer security and, more particularly, aims at the analysis of the level of computer security of a set of information systems in order to enable operators to implement any necessary security patches.

[0002] For the purposes of the invention, an “information system” is an organized set of resources that enables the collection, storage, processing and distribution of information, through a network of devices, for example computers.

[0003] An operator may correspond to an information systems security manager, or CISO, also called Chief Information Security Officer in Anglo-Saxon literature, or any other person in charge of the security of an information system.

[0004] Information systems security is becoming increasingly important with the development of digital technology and dematerialization. Therefore, the issue of analyzing the conformity of information system peripherals now concerns all sectors. For example, the invention can be used to analyze the conformity of IT equipment within a company's or local authority's information system. Prior art

[0005] There are several solutions for analyzing the compliance of the devices of an information system with security objectives.

[0006] Some solutions use malicious software to test the resistance of computers in an information system to intrusion attempts, in a manner analogous to practices that might be used by a hacker.

[0007] To achieve this, document EP 3643036 proposes using an agent installed on each computer in an information system. The agent is used to launch pre-programmed attacks on the various computers in order to obtain a vulnerability score based on the flaws detected during these attacks. For example, an attack consists of launching a malicious program to collect administrator passwords from devices.

[0008] However, these solutions using attack simulations are unreliable for analyzing the resistance of an information system to attacks that may be carried out by Hackers need to adapt their attack strategies because they are constantly evolving. Furthermore, these solutions must employ very different algorithms from one operating system to another.

[0009] However, in an information system, several operating systems can coexist, often with different versions. For example, a company network might allow access to phones running Google or Apple operating systems, while computers and servers might have Microsoft operating systems with several distinct versions. Under these conditions, an agent performing simulated attacks on these different operating systems would be very complex to implement because it would have to integrate the inspection capabilities of all systems, or it would have to be different from one system to another. In any case, it would be necessary to update the agent with each change to the hardware and / or software components.

[0010] Another solution involves detecting modifications made by users or malicious software present on the computers of an information system. To do this, each operating system of the information system is duplicated as a reference configuration stored on a server. An agent installed on the computers of the information system is configured to periodically compare the configuration of the computer on which it is installed with the reference configuration to detect potential security vulnerabilities. This solution is described, for example, in US patent 10,412,120.

[0011] This solution still poses the problem of the interoperability of the solution because it is necessary to use a large number of reference configurations and to update them regularly in order to be able to detect possible security flaws of a set of devices presenting different operating systems and / or versions.

[0012] In all cases, with these first two solutions, security vulnerabilities can be exploited when a computer is connected to the network without the agent being installed.

[0013] To solve this problem, another solution is to analyze all the information transmitted by an information system's network to detect communications that may originate from malware. Indeed, malware is often configured to communicate with a remote hacker. To do this, network communications typically generate network traffic at unexpected times, to or from suspicious network addresses. For example, when significant network traffic is observed between 11 p.m. and midnight while the computer user is not present in a company, this traffic can be considered to originate from malware if the network address is The destination of this traffic does not correspond to a known address, typically the address of an update server. Such a solution is described, for example, in US document 10,686,825.

[0014] However, this solution only allows the use of a security vulnerability to be detected over time, but it does not allow the causes of this security vulnerability to be addressed.

[0015] Nowadays, the most effective solution for addressing the causes of security vulnerabilities is still to conduct a compliance analysis of all the devices in an information system against a set of security recommendations. These recommendations are typically provided in a reference document, which may take the form of a standard or a guide published by an accredited body, for example, in France, the National Authority for Information Systems Security and Defense (ANSSI).

[0016] ANSSI proposes 40 main measures aimed at guaranteeing the security of an information system, as well as two optional measures. The "RAISE AWARENESS AND TRAIN" category includes the following three measures: 1. Train operational teams in information systems security; 2. Raise user awareness of basic best practices in IT security; and 3. Managing the risks of IT outsourcing.

[0017] The category "KNOW THE INFORMATION SYSTEM" includes the following four measures: 4. Identify the most sensitive information and servers and maintain a network diagram; 5. Have a comprehensive inventory of privileged accounts and keep it up to date; 6. Organize the procedures for user arrival, departure, and job change; and 7. Allow only controlled equipment to connect to the entity's network.

[0018] The "AUTHENTICATE AND CONTROL ACCESS" category includes the following eleven measures: 8. Identify by name each person accessing the system and distinguish between user / administrator roles; 9. Assign the correct rights to sensitive information system resources; 10. Define and verify rules for choosing and sizing passwords; 11. Protect passwords stored on systems; 12. Change the default authentication elements on equipment and services 13. When possible, prioritize strong authentication; 14. Implement a minimum level of security across the entire IT infrastructure 15. Protecting oneself from threats related to the use of removable media; 16. Use a centralized management tool to standardize security policies; 17. Enable and configure the local firewall on workstations; and 18. Encrypt sensitive data transmitted over the Internet.

[0019] The "SECURING THE NETWORK" category includes the following eight measures: 19. Segment the network and put in place a partitioning between these zones; 20. Ensure the security of Wi-Fi access networks and the separation of uses; 21. Use secure network protocols whenever they exist; 22. Set up a secure Internet access gateway; 23. Separate the services visible from the Internet from the rest of the information system 24. Protect your professional email; 25. Secure dedicated network interconnections with partners; and 26. Control and protect access to server rooms and technical premises.

[0020] The category "SECURING THE ADMINISTRATION" includes the following three measures: 27. Prohibit Internet access from workstations or servers used for the administration of the information system; 28. Use a dedicated and isolated network for information system administration; and 29. Limit administrative rights on workstations to the strict operational need.

[0021] The category “MANAGING NOMADISM” includes the following four measures: 30. Take physical security measures for mobile devices; 31. Encrypt sensitive data, especially on potentially lossable equipment; 32. Secure the network connection of workstations used in mobile situations; and 33. Adopt security policies dedicated to mobile devices.

[0022] Finally, the category "MAINTAINING THE INFORMATION SYSTEM UP TO DATE" includes the following seven measures: 34. Define a policy for updating the components of the information system; 35. Anticipate the end of software and system maintenance and limit software dependencies; 36. Enable and configure the logs of the most important components; 37. Define and implement a policy for backing up critical components; 38. Conduct regular security checks and audits and then apply the associated corrective actions; 39. Appoint an information systems security officer and make them known to staff; and 40. Define a procedure for managing security incidents.

[0023] To analyze the IT security of an information system using this ANSSI guide, a CISO analyzes the structure and management of the information system's network, as well as the security measures implemented on each device of the information system. To do this, the CISO must therefore connect to each device to check, for example, whether access to the device is password-protected (measure 11) or whether the device's operating system is up to date (measure 34).

[0024] Typically, this analysis is carried out every 6 months or every year, taking into account the time required to search for all the required information.

[0025] Depending on whether or not the information system complies with all of the ANSSI recommendations, it is possible to obtain an IT security score. The definition of this score can take into account different weights depending on the importance of each category. For example, US document 10,592,938 proposes calculating an IT security score for an information system based on answers provided in a questionnaire that incorporates a large part of the ANSSI recommendations.

[0026] The problem with this solution lies in the analysis time, which prevents the analysis from being carried out often enough, so that security flaws may appear between two analyses and it is possible to have to wait several months before detecting these security flaws during the next analysis.

[0027] Furthermore, the vulnerability scanning strategy for an information system can also evolve as new security vulnerabilities are detected in operating systems. For example, it may be detected that malware uses communication through a browser on a specific port. Following this detection, the vulnerability scanning strategy for an information system can be updated to check whether the information system devices allow the use of this port with this browser in order to verify whether these devices are susceptible to this type of malware. By implementing an analysis annually, such a security vulnerability may take a long time to be detected.

[0028] To limit this detection time and obtain a centralized management interface for multiple devices on multiple networks, document WO2009 / 101155 proposes using a security agent installed on each device of the different networks. This security agent scans the hardware and software configurations of each device to define a device profile. This profile is then sent to a security server, external to the various networks, which issues security requests to be executed by the security agent based on the profile.

[0029] It is thus possible to centrally update the vulnerability searches to be carried out by the different agents and to perform these searches very regularly, for example every day.

[0030] However, this centralized management does not allow for the detection of devices present on one of the different networks on which the agent is not installed. For example, adding a new printer to a network can present a computer security vulnerability if malware is present on the printer's operating system. With this centralized management, as long as an operator does not install an agent on the printer, the malware cannot be detected.

[0031] In addition, the periodic exchanges between all agents and the external security server to the different networks require numerous network communications, increasing the aging of network equipment, the risk of computer hacking and degrading the carbon footprint of the entire centralized management solution.

[0032] The technical problem of the invention is therefore to obtain an analysis of the IT compliance of a set of separate information system devices, allowing centralized management and more efficient detection of vulnerabilities, including vulnerabilities associated with new devices. Description of the invention

[0033] To address this technical problem, the invention proposes to use agents installed on each device of the information systems, a centralization unit present in each information system to detect new devices without an installed agent, and a general server connected to the different centralization units of the different information systems to update vulnerability searches when a new security flaw is detected.

[0034] To limit network communications, the different centralization units control the different agents of their information systems using a collector stored on the general server.

[0035] For the purposes of the invention, a "collector" corresponds to a computer program executable by an agent on a device with a specific hardware and / or software configuration. A collector can be created to execute one or several measures.

[0036] Agents are programs that allow the detection of the hardware and / or software configuration of devices, the installation of collectors and the execution of collectors according to specific parameters.

[0037] Thus, the invention proposes to automate measurements to simplify the analysis of IT compliance across a set of information systems. It follows that the expected measurements can be performed very frequently, for example, once a day or once an hour, and that the data collectors performing these measurements can be centrally updated when a new vulnerability is detected.

[0038] To this end, the invention relates to a computer-implemented device for analyzing the IT compliance of a set of distinct information systems, each information system comprising a set of peripherals on which an agent is installed; the analysis device comprising: - a general server on which several collectors are stored, each collector corresponding to a computer program executable by an agent on a device with a specific hardware and / or software configuration in order to automate the retrieval of various IT compliance information based on the parameters applied to the collector; and - at least one centralization unit for each information system, each centralization unit being connected to the various agents of its information system and to the main server; each centralization unit integrating: - a module for detecting new devices present on its information system that do not have an agent installed; - a module for retrieving the hardware and / or software configurations of devices for which agents are installed; - a search and transmission module for agents of collectors stored on the general server and associated with the hardware and / or software configurations of the devices on which the agents are installed; - a search strategy execution module, the module directing the various agents to execute their collectors with specific parameters defined in the search strategy; and - a module for centralizing the results of the different agents obtained following the execution of their collectors with the specific parameters.

[0039] Thus, the central unit of each information system can retrieve the collector(s) necessary for its information system and transmit them to the various agents. To propagate updates to these collectors, the central unit can periodically check whether any collector updates have been made. Alternatively, the general server can inform the various central units- readout when an update is performed.

[0040] Furthermore, the search strategy can also be centralized on the general server. The search strategy preferably includes the list of commands to be applied to the agents, along with the execution frequency of each command, the destination, and a description of the collector and parameters to be used. When the search strategy is stored on the general server, the execution module of each centralization unit retrieves the search strategy from the general server to determine how to command the various agents.

[0041] To achieve this, the general server may include a dedicated space for each centralization unit incorporating a search strategy and at least one collector associated with the hardware and / or software configurations of the information system devices of the centralization unit. Preferably, the general server includes one collector per measurement to be performed.

[0042] The results of the various searches can be stored on the central unit of each information system and / or on the general server. When the results of the various searches are stored on the general server, the space dedicated to each central unit also includes a reference file; the module for centralizing the results of the various agents obtained automatically following the execution of their collectors periodically transmits the collected results to the reference file.

[0043] For example, the results can be retransmitted once a day to limit network exchanges between the central unit of each information system and the general server.

[0044] In addition to these automated measures, the general server preferably includes an interface for manually modifying each reference file so that an information system administrator can enter information obtained manually on the information system and / or the information system devices.

[0045] These manually obtained measurements correspond to declarative measures that apply to a device or any other component (router, firewall) of an information system, or even to an element of the human component of that same system. For example, a declarative measure may correspond to information indicating that the person associated with the user profile of a device has read and signed an IT charter. As another example, a declarative measure may correspond to information about a wireless connection router: security level, password change frequency, network display, physical address filtering, etc.

[0046] Preferably, when a new device is detected by the detection module From a centralization unit, a request is transmitted to an operator so that a declarative measurement can be carried out in parallel with the installation of the agent and the automated measurements.

[0047] With regard to automated measures, it is possible to put in place safeguards to ensure the conformity of these measures.

[0048] Preferably, the communication established between each agent and each centralization unit, and between each centralization unit and the general server, uses a secure protocol, for example, SFTP or SSH. Furthermore, the module for retrieving the hardware and / or software configurations of the devices on which agents are installed can perform an agent integrity check. Similarly, the module for executing a search strategy can perform an agent integrity check before commanding the execution of the collectors.

[0049] The agent may correspond to a Microsoft Windows service or a Linux daemon installed on a device's operating system. Of course, other operating systems may be used without changing the invention and by adapting the agent.

[0050] To install the agent on each network device, an operator can physically go to each device to install the agent. Preferably, the agent is deployed from the central unit. For example, the operator can manually command the agent deployment via a command from the central unit. The agent can also be deployed automatically, for example, using an installation package delivered according to a Group Policy in a Microsoft Active Directory forest. Indeed, a Group Policy, also called GPO for "Group Policy Objects" in English-language literature, allows for the automatic delivery of installation packages, for example, using the Windows Installer protocol.

[0051] The centralization unit can also be configured to update the agent. This update process can also be used by the centralization unit to automatically install a new version of the agent.

[0052] The centralization unit preferably corresponds to a physical box connected to the network with a motherboard, a processor and a network card connected to the information system network.

[0053] Alternatively, the centralization unit can be implemented as software on an information system device, for example a physical or virtual server.

[0054] The centralization unit and / or the general server includes or has access to memory storage allows the results of the different measurements to be grouped together. Preferably, to interpret these measurements, the estimation module is configured to associate a score with each measurement of each device; a safety target for an accurate recommendation is obtained by calculating the sum of the values ​​of the device measurements divided by the number of devices measured.

[0055] From these measures, the centralization unit and / or the general server can directly integrate a visualization interface for the conformity of each device of an information system with a set of recommendations.

[0056] This interface is then accessible to an operator, for example, an information system security manager. Furthermore, the central unit and / or the general server can also be configured to automatically trigger an alert when one or more devices do not comply with a security recommendation. Summary description of the figures

[0057] The manner of implementing the invention and the resulting advantages will become clear from the following embodiments, given by way of example but not limitation, with reference to Figures 1 and 2 in which:

[0058] [Fig. 1] is a schematic representation of a computer compliance analysis device for a set of separate information systems according to one embodiment of the invention; and

[0059] [Fig.2] is a schematic representation of a centralization unit associated with three agents of an analysis device according to [Fig.1]. Detailed description of the invention

[0060] Fig. 1 illustrates an analysis device 10 of three information systems 38-40, for example information systems 38-40 of companies and / or communities.

[0061] Each information system 38-40 includes, for example, a firewall, a router, computers, and other peripherals, such as copiers or servers. Thus, each information system 38-40 can be composed of a set of diverse and varied peripherals 41-44 operating with various hardware and software means. These peripherals 41-44 are connected to a network or a plurality of interconnected subnetworks. Several peripherals 41-44 incorporate an agent 30. As illustrated in [Fig. 1], it is not necessary for an agent 30 to be installed on all peripherals 41-44, although this configuration is preferable for comprehensive monitoring of the IT security level of an information system 38-40.

[0062] For example, a device such as a printer 44 or an air conditioner can be connected to the network without it being possible to install an agent because this hardware can to be managed by an external company.

[0063] In addition to the agents 30, the analysis device 10 also includes a centralization unit 20 connected within each information system 38-40. The centralization unit 20 may be a physical enclosure integrating a motherboard, a processor, memory, and a network card. Alternatively, the centralization unit 20 may be software installed on a device 41-44, for example, on the firewall or router.

[0064] Agent 30 corresponds preferentially to software means, for example a Microsoft Windows service or a Linux daemon.

[0065] Unlike prior art solutions using very complex agents, the invention allows the use of a very simple agent 30 comprising only, as illustrated in [Fig.2], a communication module 21, an identification module 22, and an execution module 23. These different modules 21 to 23 can correspond to functions of a computer program for example.

[0066] The communication module 21 is connected to the network card of the peripheral device 41-43 on which the agent 30 is installed and it allows communication with the centralization unit 20.

[0067] The identification module 22 allows the detection of the hardware and / or software components of the device 41-43 on which the agent 30 is installed. For example, when a connection is established between an agent 30 and the central unit 20, the agent 30 can display the code "WIN" if the operating system on which the agent 30 is installed is a Windows operating system or the code "LIN" when the operating system on which the agent 30 is installed is a Linux operating system.

[0068] In addition to the identification module 22, the agent 30 also includes an execution module 23 configured to execute queries transmitted by the centralization unit 20 and to send the result of these queries to the centralization unit 20.

[0069] The centralization unit 20 includes a module 31 for detecting new devices. This module 31 is connected to the network port 36 of the centralization unit 20 and monitors communications exchanged on the network to verify that the addresses used for these communications have a known sender and / or recipient. To do this, the module 31 can use a ConfAgents file containing the physical addresses Add of the devices 41-43 on which the agent 30 is installed. When a physical address of a communication is not associated with a physical address Add in the ConfAgents file, the module 31 attempts to establish a connection, preferably a secure connection, with an agent 30 installed on the newly detected device.

[0070] If the centralization unit 20 detects that no agent 30 is installed on this device peripheral, the centralization unit 20 can attempt to automatically install this agent 30 or attempt to more precisely identify the detected device.

[0071] To do this, the central unit 20 can attempt to identify the Internet address, MAC address, and NetBIOS name of the device. The central unit 20 can then send an alert to an operator indicating the identified information about the detected device, requesting that operator to install agent 30 or to disable the device's network access.

[0072] When an agent 30 has been detected for a newly identified device by the centralization unit 20, the centralization unit 20 uses a hardware and / or software configuration retrieval module 32 to send queries to the agent 30 in order to more precisely identify the newly detected device.

[0073] For example, when agent 30 sends central unit 20 the information that the detected device's operating system is Windows, central unit 20 can then transmit commands to obtain the device's Internet address, MAC address, NetBIOS name, operating system type, or operating system version. Obviously, other information can be collected during this phase of identifying a new device. If the operating system version is Microsoft Server, then a command to detect the presence of a Microsoft Active Directory organization may be necessary. If the operating system version is Microsoft 10, then the search for user security group membership will be performed on local security groups.If the operating system version is Microsoft Server and a Microsoft Active Directory organization is detected, then the search for user security group membership will be performed on global security groups.

[0074] This information is stored in the ConfAgents file, which includes, for example, the last DconfA date for retrieving hardware and / or software configurations, the OSconfA operating system type, the TconfA device type, the VconfA operating system version, and the Add MAC address.

[0075] In addition, module 32 can also implement an integrity check of agents 30, for example a periodic check every month.

[0076] From all the information associated with a device and stored in memory, a search and transmission module 33 is able to communicate with a general server 50 to retrieve collectors 25-26 in order to transmit them to the agents 30.

[0077] Indeed, during the creation or installation of the centralization unit 20, a ConfCloud configuration file is installed in order to define how the centralization unit 20 can communicate with the general server 50.

[0078] For example, network traffic between the centralization unit 20 and the general server 50 can be bidirectional using an SSH-type general server 50. Thus, the ConfCloud file can include the public IP address of the general server 50, an identifier for the centralization unit 20, and a communication encryption key. The general server 50 preferably includes a dedicated space for each centralization unit 20, incorporating a search strategy 10-12 and at least one collector 25-26 associated with the hardware and / or software configurations of the devices 41-43 of the information system 38-40 of the centralization unit 20.

[0079] This communication between the centralization unit 20 and the general server 50 allows the retrieval of the collectors 25-26 required for the configurations of the detected agents 30. These collectors 25-26 are sent to the execution module 23 of the agents 30 for installation on the agents' devices 41-44, if they have not already been installed on these devices 41-44. For example, these collectors 25-26 are downloaded and installed when an update to these collectors 25-26 is detected. Preferably, the general server 50 integrates one collector 25-26 for each measure to be performed.

[0080] When the collectors 25-26 are correctly installed on the devices 41-44, the search strategy execution module 34 can perform automated searches. To do this, the search strategy 10-12 can be defined in a file on the centralization unit 20. This search strategy 10-12 can also be stored in the space dedicated to each centralization unit 20 of the general server 50; the module 34 then retrieves this search strategy 10-12 when it is updated.

[0081] The search strategy 10-12 incorporates the list of commands to be applied to the agents 30, including, for example, the search number Num, the execution frequency of each command Fe, the destination Dest, and the description of the collector Type and the parameters Param to be used. The execution frequency of each command Fe can correspond to a value in seconds after which the search must be renewed.

[0082] The destination Dest can target all devices 41-44 of an information system 38-40, with the instruction "*", or simply one or more devices 41-44 by indicating their MAC addresses.

[0083] The description of the collector type allows you to indicate which computer program installed on the device should be executed, thus allowing several separate programs to be installed to perform separate measurements.

[0084] When the execution module 34 of the centralization unit 20 establishes a preferably secure connection with an agent 30, the module 34 transmits the Param parameters to be executed by the collector 25-26 installed on the agent 30. Preferably, the module 34 can implement an integrity check of agents 30 before passing the Param parameters to be executed by the collector 25-26.

[0085] When the collector 25-26 is executed, the agent 30 returns the measurement result, and the module 35 can collect and centralize all the results in a Mes file on the centralization unit 20. As illustrated in [Fig. 2], the results can be stored as a Mes file containing the measurement date Dmes, the MAC address Add of the device on which the measurement was performed, the parameter used Param, and the measurement result Res. Preferably, the Res result is a boolean value that can be either "0" or "1".

[0086] For example, considering the ANSSI recommendations, many of the recommendations described above can be automated. The automation of these recommendations is described below.

[0087] For measure 5, "Have a comprehensive inventory of privileged accounts and keep it up to date", the objective of this measure may simply be to determine if the user of a device is an administrator.

[0088] This measure is carried out, for example, in three successive steps. The first step consists of obtaining the name of the logged-in user using, for example, the query "quser". This query returns the list of users on the computer. In the second step, to obtain the list of administrators, the query "net localgroup Administrateurs" (or "net localgroup Administrators") can be used. This query retrieves the names of the users registered in this local group. These groups allow the accounts created on a machine to be grouped into different categories, such as Administrators, Users, or Guests, to name the most common. The third step aims to search the list to see if the username is present. If so, then the user in question is indeed an administrator.

[0089] The character associated with the measurement will be set to “1” if the user is not an administrator and to “0” if they are. “1” corresponds to a valid measurement while “0” corresponds to a failed measurement; more schematically, “1” is a green light while “0” is a red light.

[0090] For measure 8, "Identify by name each person accessing the system and distinguish user / administrator roles", the objective of this measure may be to determine whether the user's name complies with certain requirements; that is, whether it has a well-defined name and not a default name.

[0091] This measure takes place in three successive stages: - define a dictionary containing trivial usernames such as Admin, Administrator, User, User and their English equivalent; - obtain the name of the logged-in user; and - check that the username is not included in the list.

[0092] If so, then the username is considered compliant. The character associated with the measure will be set to “0” if the username contains a trivial term and to “1” if it does not, as is the case with usernames of the type “first name last name”.

[0093] For measure 9, "Assign the correct rights to sensitive information system resources," the objective of this measure may be to verify whether the computer has shared folders. If so, it is necessary to verify whether new local groups have been created.

[0094] This measure therefore takes place in two stages, the second of which depends on the state of the first. The first stage consists of checking whether there are shares other than administrative shares by using, for example, the "net view Wlocalhost" query which allows obtaining the names of the shares.

[0095] If so, it is necessary to check if any new local groups exist. For example, by using the query "net localgroup", which provides a list of the groups present on the machine.

[0096] The character associated with the measure will be set to “1” if there are no shares or if there are shares associated with local groups and to “0” if there are shares without new local groups.

[0097] For measure 10, "Define and verify rules for choosing and sizing passwords", the objective of this measure may be to determine whether passwords meet complexity requirements such as the integration of special characters.

[0098] This measure takes place in two successive stages: - Generate a security configuration file, for example with the command "secedit / export / cfg" under Windows to generate the file "securityconfig.txt"; and - Look for the password complexity imposed by the system in the generated security configuration file, for example, in the [System Access] section, the "securityconfig.txt" file contains a binary value associated with the "PasswordComplexity" variable.

[0099] The character associated with the measure will be set to “1” if the parameter is enabled, i.e. if the user is required to use complex passwords, and to “0” if it is not enabled, i.e. if the user is not required to use complex passwords.

[0100] For measure 14, "Implement a minimum level of security across the entire IT infrastructure," the objective of this measure may be to determine whether a machine is portable. In this case, it is necessary to verify that the hard drive is encrypted and that USB media are prohibited.

[0101] This measure takes place in three stages, the last two of which are conditional: - Check that USB media are prohibited; - If this is not the case, the program stops, otherwise it continues and determines whether the machine is portable or not; - If the machine is portable, we check if the hard drive is encrypted, that is, we look at the BitLocker status. If the machine is desktop, the program stops at the previous step.

[0102] The character associated with the measure will be set to “0” in the following cases: - The use of USB storage devices is prohibited while the machine is stationary; and - The use of USB media is prohibited; the machine is portable but the hard drive is not encrypted.

[0103] It will be set to “1” if it combines the fact that the machine is portable and has an encrypted hard drive as well as a ban on USB media.

[0104] For measure 15, "Protecting against threats related to the use of removable media", the objective of this measure may be to verify that USB media are prohibited. The same method is used as for the previous measure.

[0105] The character associated with the measure will be set to “1” if the use of USB media is permitted and to “1” if it is prohibited.

[0106] For measure 16, "Use a centralized management tool to standardize security policies", the objective of this measure may be to verify the use of a centralized management tool, i.e. to verify that the security policies are standardized.

[0107] This measure therefore takes place in two successive conditional stages; - Check if the computer is integrated into an Active Directory, which aims to centralize the identification and authentication of a Windows machine network. This directory contains resources, i.e., workstations, printers, and shared folders; users; and services (email, etc.). - If so, then the program stops; otherwise, it checks that the web browser is connected to a proxy.

[0108] The character associated with the measure will be set to “0” if both points are not respected and to “1” if one of the two points is verified.

[0109] For measure 17, "Enable and configure the local firewall on workstations", the objective of this measure may be to verify that the firewalls are enabled.

[0110] This measure takes place in a single step which consists of verifying that all firewalls are active by using for example the query "netsh advfirewall show allprofil", allowing to obtain relationships relating to the firewalls, in particular their states.

[0111] The character associated with the measure will be set to “0” if the firewalls are inactive and to “1” if they are active.

[0112] For measure 19, "Segment the network and put in place a partition between these areas", the objective of this measure may be to verify the segmentation and partitioning of the networks.

[0113] This measure takes place in two successive stages: - Scan the network to identify the list of IP subnets; and - Scan for open ports on other computers.

[0114] The character associated with the measure will be set to “0” if there are open ports on the IP subnets and to “1” if all ports are closed.

[0115] For measure 21, "Use secure network protocols whenever they exist", the objective of this measure may be to verify whether certain devices use the secure protocols HTTPS (TCP 443), SSH (TCP 22) IMAPS (TCP 993), SMTPS (TCP 465 or 587) or POP3S (TCP 995) to an Internet service.

[0116] The character associated with the measurement will be set to “1” if one of these protocols is used and to “0” if none of these protocols are used.

[0117] For measure 22, "Set up a secure Internet access gateway", the objective of this measure may be to check whether a proxy server is being used, using the same technique as for the second step of measure 16.

[0118] The character associated with the measurement will be set to “1” if there is a proxy server and to “0” otherwise.

[0119] For measure 27, "Prohibit access to the Internet from workstations or servers used for the administration of the information system", the objective of this measure may be to deny access to the Internet from workstations used for the administration of the information system.

[0120] This measure therefore takes place in two successive conditional steps: - Identify if the operating system is of the server type (Windows Server); - If so, the program checks that a proxy is enabled. A proxy is a software component designed to secure communications between two hosts.

[0121] The character associated with the measure will be set to “0” if the proxy is not enabled with a Windows Server operating system and to “1” if the operating system is other than Windows Server or if the proxy is enabled with Windows Server.

[0122] For measure 29, "Limit administrative rights on workstations to the strict operational need", the code for this measure may be identical to that of measure 8, which aims to verify that a user is not an administrator.

[0123] For measure 34, "Define a policy for updating the components of the information system", the objective of this measure may be to verify the implementation of automatic updates.

[0124] This measure takes place, for example, in two successive conditional steps: - Determine if the Windows Update service is active. Its purpose is to enable the detection, download, and installation of Windows updates. - If it is active, you must check that the startup type is automatic.

[0125] The character associated with the measure will be set to “0” if the Windows Update service is not enabled or if it is enabled without automatic mode and to “1” if Windows update is enabled with an automatic startup type.

[0126] For measure 35, "Anticipate the end of software and systems maintenance and limit software dependencies", the objective of this measure may be to verify whether the operating system is still supported by Microsoft.

[0127] The character associated with the measurement will be set, for example, to “0” if the operating system is a version prior to Windows 8 and Windows Server 2012 and to “1” in other cases.

[0128] For measure 36, "Enable and configure logs for the most important components," the objective of this measure could be to verify that the "Event Log" service is running. This service manages events and event logs. It supports the recording of significant events on a machine, such as a session opening or when a program encounters an error.

[0129] The character associated with the measurement will be set to “0” if the service is not activated and to “1” if it is.

[0130] For measure 37, "Define and apply a policy for safeguarding critical components", the objective of this measure may be to verify the presence of a backup system.

[0131] This measure takes place in two successive conditional steps: - Determine if the operating system is of the Microsoft Windows Server type; - If this is not the case, the program stops; otherwise, it checks that the backup services are running, such as the "Windows Backup" service.

[0132] The character associated with the measure will be set to “0” if “Windows Server Backup” is not activated when the machine's operating system is Microsoft Windows Server and to “1” if backup services are activated under Microsoft Windows Server or if the operating system is different from Windows Server.

[0133] The paragraphs above illustrate the ANSSI recommendations that can be automated with the invention. Of course, the security recommendations may evolve, as may the list of automated measures. Furthermore, the queries may be formulated differently to address each recommendation, particularly when the hardware and / or software components of the device are specific.

[0134] The Res results of these different measurements are preferentially stored in the centralization unit 20 and in the space dedicated to each centralization unit 20 on the general server 50. To do this, the module 35 of the centralization unit 20 retransmits the Res results of the measurements in a reference file Ref of the space dedicated to each centralization unit 20 on the general server 50. For example, these Res results can be retransmitted every day or every week to limit network communications.

[0135] Then, based on the Ref reference file, a module of the centralization unit 20 or the general server 50 can detect whether the set of devices meets security objectives.

[0136] To do this, the centralization unit 20 or the general server 50 can support a dashboard accessible by an operator allowing to indicate, for all devices 41-44, whether each device 41-44 meets each security recommendation.

[0137] In addition, other security recommendations can be analyzed even if it is not possible to automate these measures. To do this, it is possible to use the general server 50 with a data collection module providing a graphical interface so that an operator can answer questions relating to the IT security of their information system 38-40.

[0138] For example, for measure 2 aimed at raising user awareness of basic good IT security practices, a question may simply ask whether the company has an IT charter.

[0139] If the operator indicates that the company does not have an IT charter, the characteristic associated with this information will, for example, be set to “0”, whereas if the operator indicates that the company has an IT charter, the characteristic associated with it will be set to “l”.

[0140] As another example, for measure 20 aimed at ensuring the security of Wi-Fi access networks and the separation of uses, a question could simply ask whether the information system network 38-40 includes a secure Wi-Fi solution. If the operator answers this question with "yes," the characteristic of this measure will be set to "1," whereas if the operator answers this question with "no," the associated characteristic will be set to "0."

[0141] Thus, the general server 50's data collection module allows an operator to answer generic questions about their information system 38-40. In addition to these generic questions, the general server 50 also includes a calculation module for retrieving the responses from devices 41-44 to the recommendations obtained by the centralization unit 20. To aggregate the measurements from the centralization unit 20 with those obtained in response to the questions from the server's data collection module In general, 50, it is possible to average the score of all devices by summing the characters associated with each measurement and dividing by the number of devices 41-44 used for that measurement.

[0142] Thus, the general server 50 provides a score for the compliance of an information system with IT security recommendations 38-40. This score can be updated periodically using the centralization unit 20 to regularly test the recommendations that can be automated. Therefore, measures that can be automated can be updated regularly, for example, daily or weekly, while measures resulting from a questionnaire response can be updated less frequently, for example, every six months or annually.

[0143] All of these measures make it possible to raise alerts in different scenarios that the operator can pre-program on the centralization unit 20 or the general server 50.

[0144] For example, an alert can be raised when a new device is detected without an agent 30 being installed on that device. This alert can be transmitted by means of an indicator light or a message sent to the operator.

[0145] Another alert can be sent to an operator when the compliance measurements of an information system 38-40 fall below a threshold value. For example, if an entire information system 38-40 has a compliance rate of less than 50%, the operator can be notified. Alternatively, for a specific security recommendation, the operator can also configure an alert when a device does not comply with that specific claim, for example, a need to enable the firewall.

[0146] All these detection and alert methods thus allow the operator to have more efficient and easier management of the IT security of the network of an information system 38-40. They can therefore apply the necessary security patches based on the alerts raised. Furthermore, the measures can be recorded in a dashboard allowing the operator to regularly consider the strategy that should be implemented to improve the security of the network of the information system 38-40.

[0147] Thus, the invention makes it possible to obtain an analysis of the IT compliance of a set of devices 41-44 of separate information systems 38-40, allowing centralized management at the level of the general server 50 and more efficient detection of vulnerabilities by means of the different centralization units 20.

Claims

Claims

1. Computer-implemented device (10) for analyzing the IT compliance of a set of separate information systems (38-40), each information system (38-40) comprising a set of peripherals (41-44) on which an agent (30) is installed; the analysis device comprising: - a general server (50) on which several collectors (25-26) are stored, at least one collector (25-26) corresponding to a measurement of a standard or guide written by an approved body, each collector (25-26) corresponding to a computer program executable, by an agent (30), on a peripheral (41-44) with a specific hardware and / or software configuration in order to automate the search for several pieces of IT compliance information according to the parameters (Param) applied to the collector (25-26); and - at least one centralization unit (20) for each information system (38-40), each centralization unit (20) being connected to the different agents (30) of its information system (38-40) and to the general server (50); each centralization unit (20) integrating: - a module (31) for detecting new peripherals (41-44) present on its information system (38-40) and not having an agent installed; - a module (32) for recovering the hardware and / or software configurations of the peripherals (41-44) for which agents (30) are installed; - a module (33) for searching and transmitting to the agents (30) the collectors (25-26) stored on the general server (50) and associated with the hardware and / or software configurations of the peripherals (41-44) on which the agents (30) are installed; - a module (34) for executing a search strategy (10-12), the module (34) controlling the different agents (30) so that they execute their collectors (25-26) with specific parameters (Param) defined in the search strategy (10-12); and - a module (35) for centralizing the results (Mes) of the different agents (30) obtained following the execution of their collectors (25-26) with the specific parameters (Param).

2. Device for analyzing the computer conformity of a set of information systems according to claim 1, in which the search strategy (10-12) integrates the list of commands to be applied to the agents (30) with the frequency of execution of each command (Fe), the destination (Dest), and the description of the collector (Type) and the parameters (Param) to be used.

3. Device for analyzing the IT compliance of a set of information systems according to claim 1 or 2, in which the search strategy (10-12) is stored on the general server (50), the execution module (34) of each centralization unit (20) recovering the search strategy (10-12) on the general server (50) in order to determine how to control the different agents (30).

4. Device for analyzing the IT conformity of a set of information systems according to claim 3, in which the general server (50) comprises a space dedicated to each centralization unit (20) integrating a search strategy (10-12) and at least one collector (25-26) associated with the hardware and / or software configurations of the peripherals (41-44) of the information system (38-40) of the centralization unit (20).

5. Device for analyzing the IT compliance of a set of information systems according to claim 4, in which the space dedicated to each centralization unit (20) also integrates a reference file (Ref); the module (35) for centralizing the results of the different agents (30) obtained automatically following the execution of their collectors (25-26) periodically retransmitting the results (Mes) collected to the reference file (Ref).

6. Device for analyzing the IT compliance of a set of information systems according to claim 5, in which the general server (50) comprises an interface for manual modification of each reference file (Ref) so that an administrator of an information system (38-40) can enter information obtained manually on the information system (38-40) and / or the peripherals (41-44) of the information system (38-40).

7. Device for analyzing the IT compliance of a set of information systems according to one of claims 1 to 6, in which the modules (32-35) of each centralization unit (20) establish a secure connection with the agents (30) before transmitting or retrieving information from the agents (30).

8. Device for analyzing the computer conformity of a set of information systems according to one of claims 1 to 7, in which the module (32) for recovering the hardware and / or software configurations of the peripherals (41-44) for which agents (30) are installed carries out an integrity check of the agents (30).

9. Device for analyzing the IT compliance of a set of information systems according to one of claims 1 to 8, in which the module (34) for executing a search strategy (10-12) carries out an integrity check of the agents (30) before ordering the execution of the collectors (25-26).

10. Device for analyzing the IT compliance of a set of information systems according to one of claims 1 to 9, in which the agent (30) corresponds to a Microsoft Windows service or a Linux daemon installed on an operating system of a device (41-44).

Images