This invention relates to the field of network management, and in particular to a method and system for analyzing and verifying compliance with security policies among devices in a network.
Network security is a continuing concern among network users and network managers. In a secure computer network, to prevent unauthorized access to the network, only a specified set of systems, services, and applications are permitted to use the network. Additionally, within a network, not all systems, services, and applications are permitted to communicate with each other. The term ‘security policy’ is used to identify the connections that should be permitted or denied between network elements.
Certain devices within a network, such as routers and firewalls, can be configured to enforce security policies within the network, and complex security policies may require that multiple devices be compatibly configured.
Verifying that each device in a network is properly configured to effect the intended security policies is a daunting task, particularly in complex networks that include multiple communication paths among network elements. This task is further complicated by the fact that different devices may use different schemes for effecting the same security policy. A security analyst must typically be aware of a variety of vendor-dependent configuration formats and protocols, and must be aware of each configuration setting's effect on the security policy of each connection to the device.
Often, security policy analysis and verification is a ‘hit or miss’ process, with minimal analytical basis. A security analyst reviews configuration settings, corrects any obvious security loopholes, and then verifies security by attempting to send messages to or from a variety of elements on the network. If a message traverses a denied connection, or is blocked from a permitted connection, the cause of the error is determined, the configuration is modified, and the test is repeated.
It is an objective of this invention to provide a method and system for identifying and verifying compliance with security policies within a network. It is a further objective of this invention to provide a method and system for identifying network configuration data that is inconsistent with intended security policies.
These objectives, and others, are achieved by a method and system that uses a security policy database that identifies the intended security policies within a network to generate test traffic that is configured to test each defined security policy, and simulates the propagation of this traffic on a model of the network. The model of the network includes the configuration data associated with each device, and thus, if devices are properly configured to enforce the intended security policies, the success/failure of the simulated test traffic will conform to the intended permit/deny policy of each connection. Differences between the simulated message propagation and the intended security policies are reported to the user, and diagnostic tools are provided to facilitate identification of the device configuration data that accounts for the observed difference. Additionally, if a network's current security policy is unknown, test traffic is generated to reveal the actual policy in effect, to construct a baseline intended security policy.
Throughout the drawings, the same reference numerals indicate similar or corresponding features or functions. The drawings are included for illustrative purposes and are not intended to limit the scope of the invention.