Methods and systems for managing assets

• US 20030233438A1
• Filed: 10/04/2002
• Published: 12/18/2003
• Est. Priority Date: 06/18/2002
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.), ESecurityOnline, LLC
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Hutchinson, Robin, Giubileo, John, OʼBrien, Darci
• Granted Patent: US 7,668,947 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The disclosed methods and systems can be used to manage at least one asset, where the methods and systems include associating the at least one asset with at least one user, and providing the at least one user with at least one task list that includes at least one task associated with a vulnerability of the asset and at least one task associated with a configuration standard associated with the asset.

Claims

1. A method of managing at least one asset, the method comprising:

associating the at least one asset with at least one user; and

providing the at least one user with at least one task list that includes at least one task associated with a vulnerability of the at least one asset and at least one task associated with at least one configuration standard associated with the at least one asset.

2. A method according to claim 1, wherein the at least one task list is at least one of:

an asset administration task list, an overdue notification task list, an archive notification task list, an approval task list, and an asset risk exception task list.

3. A method according to claim 1, wherein the at least one asset includes one or more asset components, where an asset component is at least one of:

at least one application, at least one device, at least one operating system, and at least one database.

4. A method according to claim 1, wherein the at least one user is associated with at least one responsibility group.

5. A method according to claim 1, further comprising:

providing at least one interface to associate the at least one asset with the at least one user.

6. A method according to claim 1, wherein the at least one asset is associated with at least one of:

at least one Enterprise, at least one functional unit, and at least one responsibility group.

7. A method according to claim 1, further comprising:

providing an interface to associate the at least one asset with at least one of;

at least one Enterprise, at least one functional unit, and at least one responsibility group.

8. A method according to claim 1, where the at least one asset is connected to a network.

9. A method according to claim 1, where the at least one configuration standard includes at least one minimum baseline procedure associated with at least one operational characteristic of the at least one asset.

10. A method according to claim 1, further including providing at least one policy, where the at least one configuration standard is associated with the at least one policy.

11. A method according to claim 10, where the policy is associated with an Enterprise.

12. A method according to claim 1, further comprising:

generating at least one vulnerability profile associated with at least one detected vulnerability of the at least one asset, the at least one vulnerability profile including at least one link to at least one of;

a patch and information, the patch and the information associated with the at least one vulnerability; and

notifying the at least one user of the at least one generated vulnerability profile.

13. A method according to claim 12, where the at least one link to the at least one patch includes at least one uniform resource locator (URL).

14. A method according to claim 1, further comprising:

providing the at least one configuration standard, where the at least one configuration standard is associated with an operational characteristic of the at least one asset; and

notifying the at least one user of the at least one configuration standard.

15. A method according to claim 14, wherein the at least one configuration standard includes a procedure for implementing an operational characteristic of the at least one asset.

16. A method according to claim 1, further comprising:

providing at least one report based on at least one of;

at least one asset profile, at least one vulnerability profile, and the at least one configuration standard.

17. A method according to claim 16, where the at least one report is at least one of:

an asset vulnerability assessment report, an asset configuration standard assessment report, an asset vulnerability risk state report, an asset configuration standard risk state report, a vulnerability status summary report, a configuration standard status summary report, and an ad hoc report.

18. A method according to claim 1, further comprising:

providing the at least one user with data based on a scanning module, the data including a detected vulnerability of the at least one asset.

19. A method according to claim 1, further comprising:

providing the at least one user with data based on a scanning module, the data associated with at least one of;

at least one detected vulnerability based on the at least one asset associated with the at least one user, at least one asset that is not associated with the user, and at least one detected vulnerability that is associated with at least one asset that is not associated with the user.

20. A method according to claim 1, further comprising:

providing the at least one user with data based on a scanning module, the data associated with at least one of;

at least one detected vulnerability based on the at least one asset component associated with the at least one user, at least one asset component that is not associated with the user, and at least one detected vulnerability that is associated with at least one asset component that is not associated with the user.

21. A method according to claim 10, where the at least one policy includes a name, a purpose, and a statement.

22. A method according to claim 10, where the at least one policy is based on a default policy.

23. A method according to claim 1, further including providing a risk assessment questionnaire

24. A system for managing at least one asset, the system comprising:

at least one memory to associate at least one asset with at least one vulnerability and at least one configuration standard; and

instructions for causing a processor to;

associate the at least one asset with at least one user; and

provide the at least one user with at least one task list that includes at least one task associated with a vulnerability of the at least one asset and at least one task associated with a configuration standard associated with the at least one asset.

25. A system according to claim 24, where the at least one asset includes one or more asset components, and where an asset component is at least one of:

at least one application, at least one device, at least one operating system, and at least one database.

26. A system according to claim 24, where the at least one vulnerability includes at least one of a vulnerability name, a discovery date, a description of the vulnerability, a vulnerability type, a vulnerability risk rating, and a list of one or more assets affected by the vulnerability.

27. A system according to claim 24, wherein the at least one configuration standard includes at least one of:

a configuration standard name, a description of the at least one configuration standard, a list of one or more assets associated with the at least one configuration standard, at least one responsibility group name, at least one risk statement, at least one implementation procedure, at least one implementation script, and at least one manual review procedure.