Computer asset vulnerabilities

• US 10,313,389 B2
• Filed: 03/06/2018
• Issued: 06/04/2019
• Est. Priority Date: 08/13/2015
• Status: Active Grant

• Current Assignee: Accenture Global Services Limited (Accenture PLC)
• Original Assignee: Accenture Global Services Limited (Accenture PLC)
• Inventors: Hovor, Elvis, Mulchandani, Shaan, Carver, Matthew
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US15/913,219
• Publication Number:
  US 20180198815A1
• Time in Patent Office: 455 Days
• Field of Search: 726 25
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for determining a network path between computer assets. One of the methods includes receiving an asset topology that includes an identifier for each computer-related asset that may be an entry point for an attack simulation, receiving threat data that identifies vulnerabilities of computer-related assets, determining a first computer-related asset that may be an entry point for an attack simulation, identifying one or more first vulnerabilities of the first computer-related asset, determining a path from the first computer-related asset to a second computer-related asset, determining one or more second vulnerabilities of the second computer-related asset, determining a probability that the second computer-related asset will be compromised by an adversary, and determining a change to the asset topology to reduce the probability that the second computer-related asset will be compromised by an adversary.

Claims

1. A system comprising:

a data processing apparatus; and

a non-transitory computer readable storage medium in data communication with the data processing apparatus and storing instructions executable by the data processing apparatus and upon such execution cause the data processing apparatus to perform operations comprising;

identifying, using threat data that identifies vulnerabilities of computer-related assets, one or more first vulnerabilities of a first computer-related asset that is a) identified by an asset topology that i) identifies an entity'"'"'s computer-related assets including one or more first computer-related assets each of which is a potential entry point for an attack simulation and one or more second computer-related assets each of which is not a potential entry point for an attack simulation, and ii) how the computer-related assets are connected together and b) one of the first computer-related assets;

in response to identifying the one or more first vulnerabilities of the first computer-related asset, determining, using the one or more first vulnerabilities, that a first probability that the first computer-related asset will be compromised by an adversary'"'"'s device satisfies a threshold probability;

in response to determining that the first probability that the first computer-related asset will be compromised by an adversary'"'"'s device satisfies the threshold probability, determining, using the asset topology, a path from the first computer-related asset to a second computer-related asset that is one of the second computer-related assets identified by the asset topology;

in response to determining the path from the first computer-related asset to the second computer-related asset, determining, using the threat data, one or more second vulnerabilities of the second computer-related asset;

in response to determining the one or more second vulnerabilities of the second computer-related asset, determining, using the one or more second vulnerabilities of the second computer-related asset, a second probability that the second computer-related asset will be compromised by an adversary'"'"'s device;

in response to determining the second probability that the second computer-related asset will be compromised by an adversary'"'"'s device, determining, using the asset topology and the threat data, a change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary'"'"'s device; and

in response to determining the change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary'"'"'s device, implementing the change to the asset topology.

2. The system of claim 1, wherein determining, using the asset topology, the path from the first computer-related asset to a second computer-related asset that is one of the second computer-related assets identified by the asset topology comprises:

determining, for each of two or more of the second computer-related assets using the asset topology, a path from the first computer-related asset to the second computer-related asset.

3. The system of claim 2, the operations comprising:

receiving new threat data over a predetermined period of time;

determining, using the new threat data, paths from the first computer-related asset to each of the two or more of the second computer-related assets over the predetermined period of time; and

determining trends in the paths from the first computer-related asset to each of the two or more of the second computer-related assets over the predetermined period of time.

4. The system of claim 3, wherein determining the trends in the paths from the first computer-related asset to each of the two or more of the second computer-related assets over the predetermined period of time comprises determining a recurring path of compromise that has a high probability that one or more assets on the recurring path will be compromised by an adversary'"'"'s device over at least a threshold value of times during the predetermined period of time.

5. The system of claim 3, the operations comprising:

determining, using the trends in the paths from the first computer-related asset to each of the two or more of the second computer-related assets, a probability that a particular second computer-related asset will be compromised by an adversary'"'"'s device over the predetermined period of time that is greater than probabilities that the other computer-related assets in the two or more of the second computer-related assets will be compromised by an adversary'"'"'s device over the predetermined period of time; and

determining, using the asset topology and the new threat data, a change to the asset topology to reduce the probability that the particular second computer-related asset will be compromised by an adversary'"'"'s device.

6. The system of claim 5, the operations comprising:

providing information about the change to the asset topology for presentation to a user.

7. The system of claim 5, wherein:

determining, using the asset topology and the new threat data, the change to the asset topology to reduce the probability that the particular second computer-related asset will be compromised by an adversary'"'"'s device comprises determining a software update to apply to one of the computer-related assets identified by the asset topology, the operations comprising;

applying the software update to the one of the computer-related assets identified by the asset topology.

8. The system of claim 1, wherein determining the path from the first computer-related asset to the second computer-related asset comprises:

determining, for each computer-related asset on the path between the first computer-related asset and the second computer-related asset, one or more vulnerabilities for the computer-related asset; and

determining, for the one or more vulnerabilities of the computer-related asset on the path between the first computer-related asset and the second computer-related asset, corresponding probabilities that the computer-related asset will be compromised by an adversary'"'"'s device.

9. The system of claim 8, the operations comprising:

for at least one of the computer-related assets on the path between the first computer-related asset and the second computer-related asset;

determining, using the asset topology, all of subsequent computer-related assets directly connected to the computer-related asset not including any computer-related assets used to access the computer-related asset;

determining, for each of the subsequent computer-related assets, one or more vulnerabilities of the subsequent computer-related asset;

determining, for each of the subsequent computer-related assets using the vulnerabilities of the subsequent computer-related asset, a probability that the subsequent computer-related asset will be compromised by an adversary'"'"'s device; and

selecting a particular subsequent computer-related asset with the probability greater than the probabilities of the other subsequent computer-related assets as the next computer-related asset in the path between the first computer-related asset and the second computer-related asset.

10. The system of claim 1, wherein determining the second probability that the second computer-related asset will be compromised by an adversary'"'"'s device comprises:

determining, for each of the one or more second vulnerabilities of the second computer-related asset, a particular probability; and

combining all of the particular probabilities for the one or more second vulnerabilities of the second computer-related to determine the probability that the second computer-related asset will be compromised by an adversary'"'"'s device.

11. The system of claim 1, the operations comprising analyzing one or more computer networks of the entity to determine the asset topology.

12. The system of claim 1, the operations comprising receiving the asset topology that identifies the one or more first computer-related assets each of which is directly connected to a network that is not controlled by the entity without intervening hardware and the one or more second computer-related assets each of which is not directly connected to a network that is not controlled by the entity.

13. The system of claim 12, wherein receiving the asset topology that identifies the entity'"'"'s computer-related assets comprises receiving the asset topology and an identifier for at least one of the first computer-related assets that is directly connected to the Internet.

14. The system of claim 12, wherein receiving the asset topology that identifies the entity'"'"'s computer-related assets comprises receiving the asset topology and an identifier for at least one of the first computer-related assets that is a wireless router.

15. The system of claim 1, the operations comprising:

determining, for each of the computer related assets, a category to which the computer related asset belongs;

determining, for a particular category from the determined categories, paths from an external facing asset to each of the assets in the category; and

determining, using the paths from the external facing asset to each of the assets in the category, a category probability of compromise for the particular category.

16. The system of claim 15, the operations comprising:

comparing the category probability of compromise for the particular category with a second category probability of compromise for a second category;

ranking the particular category and the second category using the category probability of compromise and the second category probability of compromise; and

implementing a change to the asset topology for a computer-related asset in a higher ranked category from the particular category and the second category.

17. The system of claim 1, the operations comprising:

determining a particular computer related asset that is a potential target of an attack by the adversary'"'"'s device, wherein determining the path from the first computer-related asset to the second computer-related asset that is one of the second computer-related assets comprises determining a path from the first computer related asset to the particular computer related asset.

18. The system of claim 1, the operations comprising:

determining a type of computer-related assets that are a potential target of an attack by the adversary'"'"'s device, wherein determining the path from the first computer-related asset to the second computer-related asset that is one of the second computer-related assets comprises determining a path from the first computer related asset to the second computer-related asset that includes at least one computer related asset of the type of computer related assets that are a potential target of the attack.

19. The system of claim 18, wherein determining the type of computer-related assets that are the potential target of an attack by the adversary'"'"'s device comprises determining the type of computer-related assets that are the potential target of an attack by the adversary'"'"'s device using the threat data.

20. The system of claim 1, the operations comprising:

determining a type of computer-related assets that are a potential target of an attack by the adversary'"'"'s device, wherein determining the path from the first computer-related asset to the second computer-related asset that is one of the second computer-related assets comprises determining a path from the first computer related asset to the second computer-related asset that includes only computer-related asset of the type of computer-related assets that are a potential target of the attack, both the first computer-related asset and the second computer-related asset being of the type of computer-related assets that are a potential target of the attack.

21. The system of claim 1, the operations comprising receiving, for each computer-related asset in a plurality of computer-related assets, threat data that indicates an identified computer vulnerability for the computer-related asset, wherein the plurality of computer-related assets includes the first computer-related asset that is a potential entry point for an attack simulation.

22. A computer-implemented method comprising:

identifying, using threat data that identifies vulnerabilities of computer-related assets, one or more first vulnerabilities of a first computer-related asset that is a) identified by an asset topology that i) identifies an entity'"'"'s computer-related assets including one or more first computer-related assets each of which is a potential entry point for an attack simulation and one or more second computer-related assets each of which is not a potential entry point for an attack simulation, and ii) how the computer-related assets are connected together and b) one of the first computer-related assets;

in response to identifying the one or more first vulnerabilities of the first computer-related asset, determining, using the one or more first vulnerabilities, that a first probability that the first computer-related asset will be compromised by an adversary'"'"'s device satisfies a threshold probability;

in response to determining that the first probability that the first computer-related asset will be compromised by an adversary'"'"'s device satisfies the threshold probability, determining, using the asset topology, a path from the first computer-related asset to a second computer-related asset that is one of the second computer-related assets identified by the asset topology;

in response to determining the path from the first computer-related asset to the second computer-related asset, determining, using the threat data, one or more second vulnerabilities of the second computer-related asset;

in response to determining the one or more second vulnerabilities of the second computer-related asset, determining, using the one or more second vulnerabilities of the second computer-related asset, a second probability that the second computer-related asset will be compromised by an adversary'"'"'s device;

in response to determining the second probability that the second computer-related asset will be compromised by an adversary'"'"'s device, determining, using the asset topology and the threat data, a change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary'"'"'s device; and

in response to determining the change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary'"'"'s device, implementing the change to the asset topology.

24. The method of claim 22, wherein determining, using the asset topology, the path from the first computer-related asset to a second computer-related asset that is one of the second computer-related assets identified by the asset topology comprises:

determining, for each of two or more of the second computer-related assets using the asset topology, a path from the first computer-related asset to the second computer-related asset.

25. The method of claim 24, comprising:

receiving new threat data over a predetermined period of time;

determining, using the new threat data, paths from the first computer-related asset to each of the two or more of the second computer-related assets over the predetermined period of time; and

determining trends in the paths from the first computer-related asset to each of the two or more of the second computer-related assets over the predetermined period of time.

26. The method of claim 25, wherein determining the trends in the paths from the first computer-related asset to each of the two or more of the second computer-related assets over the predetermined period of time comprises determining a recurring path of compromise that has a high probability that one or more assets on the recurring path will be compromised by an adversary'"'"'s device over at least a threshold value of times during the predetermined period of time.

27. The method of claim 25, comprising:

determining, using the trends in the paths from the first computer-related asset to each of the two or more of the second computer-related assets, a probability that a particular second computer-related asset will be compromised by an adversary'"'"'s device over the predetermined period of time that is greater than probabilities that the other computer-related assets in the two or more of the second computer-related assets will be compromised by an adversary'"'"'s device over the predetermined period of time; and

determining, using the asset topology and the new threat data, a change to the asset topology to reduce the probability that the particular second computer-related asset will be compromised by an adversary'"'"'s device.

28. The method of claim 22, comprising:

determining, for each of the computer related assets, a category to which the computer related asset belongs;

determining, for a particular category from the determined categories, paths from an external facing asset to each of the assets in the category; and

determining, using the paths from the external facing asset to each of the assets in the category, a category probability of compromise for the particular category.

29. The method of claim 28, comprising:

comparing the category probability of compromise for the particular category with a second category probability of compromise for a second category;

ranking the particular category and the second category using the category probability of compromise and the second category probability of compromise; and

implementing a change to the asset topology for a computer-related asset in a higher ranked category from the particular category and the second category.

30. The method of claim 22, comprising:

determining a particular computer related asset that is a potential target of an attack by the adversary'"'"'s device, wherein determining the path from the first computer-related asset to the second computer-related asset that is one of the second computer-related assets comprises determining a path from the first computer related asset to the particular computer related asset.

31. The method of claim 22, comprising:

determining a type of computer-related assets that are a potential target of an attack by the adversary'"'"'s device, wherein determining the path from the first computer-related asset to the second computer-related asset that is one of the second computer-related assets comprises determining a path from the first computer related asset to the second computer-related asset that includes at least one computer related asset of the type of computer related assets that are a potential target of the attack.

32. The method of claim 31, wherein determining the type of computer-related assets that are the potential target of an attack by the adversary'"'"'s device comprises determining the type of computer-related assets that are the potential target of an attack by the adversary'"'"'s device using the threat data.

33. The method of claim 22, comprising:

determining a type of computer-related assets that are a potential target of an attack by the adversary'"'"'s device, wherein determining the path from the first computer-related asset to the second computer-related asset that is one of the second computer-related assets comprises determining a path from the first computer related asset to the second computer-related asset that includes only computer-related asset of the type of computer-related assets that are a potential target of the attack, both the first computer-related asset and the second computer-related asset being of the type of computer-related assets that are a potential target of the attack.

23. A non-transitory computer readable storage medium storing instructions executable by a data processing apparatus and upon such execution cause the data processing apparatus to perform operations comprising:

identifying, using threat data that identifies vulnerabilities of computer-related assets, one or more first vulnerabilities of a first computer-related asset that is a) identified by an asset topology that i) identifies an entity'"'"'s computer-related assets including one or more first computer-related assets each of which is a potential entry point for an attack simulation and one or more second computer-related assets each of which is not a potential entry point for an attack simulation, and ii) how the computer-related assets are connected together and b) one of the first computer-related assets;

in response to identifying the one or more first vulnerabilities of the first computer-related asset, determining, using the one or more first vulnerabilities, that a first probability that the first computer-related asset will be compromised by an adversary'"'"'s device satisfies a threshold probability;

in response to determining that the first probability that the first computer-related asset will be compromised by an adversary'"'"'s device satisfies the threshold probability, determining, using the asset topology, a path from the first computer-related asset to a second computer-related asset that is one of the second computer-related assets identified by the asset topology;

in response to determining the path from the first computer-related asset to the second computer-related asset, determining, using the threat data, one or more second vulnerabilities of the second computer-related asset;

in response to determining the one or more second vulnerabilities of the second computer-related asset, determining, using the one or more second vulnerabilities of the second computer-related asset, a second probability that the second computer-related asset will be compromised by an adversary'"'"'s device;

in response to determining the second probability that the second computer-related asset will be compromised by an adversary'"'"'s device, determining, using the asset topology and the threat data, a change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary'"'"'s device; and

in response to determining the change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary'"'"'s device, implementing the change to the asset topology.