Application security assessment

• US 10,628,590 B2
• Filed: 01/24/2017
• Issued: 04/21/2020
• Est. Priority Date: 01/24/2017
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Abukhovsky, Maxim, Pareek, Bharath Kumar, Salomaa, Jari, Singh, Amarjit, Kashyap, Poorak, Kuo, Pohsuen, Ganesan, Prashanth Mahalingam
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US15/413,751
• Publication Number:
  US 20180211045A1
• Time in Patent Office: 1,183 Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 67/01 Protocols

Abstract

Application security assessment is described. A system identifies a first security configuration and a second security configuration associated with an application. The system calculates a security score based on a comparison of the first security configuration to a first baseline security setting and a comparison of the second security configuration to a second baseline security setting. The system generates a security report associated with the application that includes the security score and outputs the security report.

Claims

1. A system for application security assessment, the system comprising:

one or more processors; and

a non-transitory computer readable medium storing a plurality of instructions, which when executed, cause the one or more processors to;

identify a first security configuration and a second security configuration associated with an application executing on a computing system;

compare the first security configuration to a first baseline security setting and the second security configuration to a second baseline security setting to determine measurements of compliance between the respective security configurations and the corresponding baseline security settings, the first baseline security setting and the second baseline security setting being recommended security settings associated with the corresponding security configurations of the application;

determine a security score representing the overall compliance between the first and second security configurations and their corresponding baseline security settings;

cause a security report associated with the application to be generated, the security report including the security score; and

cause the security report to be outputted.

2. The system of claim 1, comprising further instructions, which when executed, cause the one or more processors to identify a third security configuration and a fourth security configuration associated with the application, the first security configuration and the second security configuration associated with a first security setting group, the third security configuration and the fourth security configuration associated with a second security setting group, wherein determining the security score is further based on a comparison of the third security configuration to a third baseline security setting and a comparison of the fourth security configuration to a fourth baseline security setting.

3. The system of claim 1, wherein determining the security score is further based on a first weight associated with the comparison of the first security configuration to the first baseline security setting and a second weight associated with the comparison of the second security configuration to the second baseline security setting.

4. The system of claim 1, wherein the security report associates at least one security configuration with a risk level.

5. The system of claim 1, wherein the security report further comprises a recommended action to improve security associated with the application.

6. The system of claim 5, comprising further instructions, which when executed, cause the one or more processors to execute the recommended action to improve the security associated with the application in response to receiving a user selection of the recommended action.

7. The system of claim 1, comprising further instructions, which when executed, cause the one or more processors to modify at least one of the first baseline security setting and the second baseline security setting in response to a user request.

8. A computer program product comprising computer-readable program code to be executed by one or more processors when retrieved from a non-transitory computer-readable medium, the program code including instructions to:

identify a first security configuration and a second security configuration associated with an application executing on a computing system;

compare the first security configuration to a first baseline security setting and the second security configuration to a second baseline security setting to determine measurements of compliance between the respective security configurations and the corresponding baseline security settings, the first baseline security setting and the second baseline security setting being recommended security settings associated with the corresponding security configurations of the application;

determine a security score representing the overall compliance between the first and second security configurations and their corresponding baseline security settings;

cause a security report associated with the application to be generated, the security report including the security score; and

cause the security report to be outputted.

9. The computer program product of claim 8, wherein the program code comprises further instructions to identify a third security configuration and a fourth security configuration associated with the application, the first security configuration and the second security configuration associated with a first security setting group, the third security configuration and the fourth security configuration associated with a second security setting group, wherein determining the security score is further based on a comparison of the third security configuration to a third baseline security setting and a comparison of the fourth security configuration to a fourth baseline security setting.

10. The computer program product of claim 8, wherein determining the security score is further based on a first weight associated with the comparison of the first security configuration to the first baseline security setting and a second weight associated with the comparison of the second security configuration to the second baseline security setting.

11. The computer program product of claim 8, wherein the security report associates at least one security configuration with a risk level.

12. The computer program product of claim 8, wherein the security report further comprises a recommended action to improve security associated with the application.

13. The computer program product of claim 12, wherein the program code comprises further instructions to execute the recommended action to improve the security associated with the application in response to receiving a user selection of the recommended action.

14. The computer program product of claim 8, wherein the program code comprises further instructions to modify at least one of the first baseline security setting and the second baseline security setting in response to a user request.

15. A method comprising:

identifying, by a computing system, a first security configuration and a second security configuration associated with an application executing on a computing system;

comparing the first security configuration to a first baseline security setting and the second security configuration to a second baseline security setting to determine measurements of compliance between the respective security configurations and the corresponding baseline security settings, the first baseline security setting and the second baseline security setting being recommended security settings associated with the corresponding security configurations of the application;

determining a security score representing the overall compliance between the first and second security configurations and their corresponding baseline security settings;

causing a security report associated with the application to be generated, the security report including the security score; and

causing the security report to be outputted.

16. The method of claim 15, wherein the method further comprises identifying a third security configuration and a fourth security configuration associated with the application, the first security configuration and the second security configuration associated with a first security setting group, the third security configuration and the fourth security configuration associated with a second security setting group, wherein determining the security score is further based on a comparison of the third security configuration to a third baseline security setting and a comparison of the fourth security configuration to a fourth baseline security setting, and a first weight associated with the comparison of the first security configuration to the first baseline security setting and a second weight associated with the comparison of the second security configuration to the second baseline security setting.

17. The method of claim 15, wherein the security report associates at least one security configuration with a risk level.

18. The method of claim 15, wherein the security report further comprises a recommended action to improve security associated with the application.

19. The method of claim 18, wherein the method further comprises executing the recommended action to improve the security associated with the application in response to receiving a user selection of the recommended action.

20. The method of claim 15, wherein the method further comprises modifying at least one of the first baseline security setting and the second baseline security setting in response to a user request.