Secure Configuration Auditing for Network Defense (SCAND)

This research investigates a concept for automatically monitoring and auditing system security con-figurations and assuring compliance with established security policies. The concept uses multiple, distributed, intelligent software agents, which may be mobile, to compare the security configurations of network devices and software with established security policy. The agents will either 1) notify the security manager before proceeding, or 2) automatically implement the necessary configuration changes to the system found in violation of the policies. The proposed concept is based upon an agent platform that provides secure execution and host migration and is interfaced with a computer network defense system that supports responsive decision making by network security managers.