Vulnerability management and tracking system (VMTS)

• US 20040064726A1
• Filed: 09/30/2002
• Published: 04/01/2004
• Est. Priority Date: 09/30/2002
• Status: Abandoned Application

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Girouard, Mario
• Application Number:
  US10/259,763
• Publication Number:
  US 20040064726A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Vulnerabilities may be managed by receiving a vulnerability message describing a profile of a computer system vulnerable to a threat, identifying one or more vulnerable systems with the profile described in the received vulnerability message, the vulnerable systems having a vulnerability that may be exploited by the threat, and generating a display that includes a list of the identified vulnerable systems.

Claims

1. A method of managing vulnerabilities, the method comprising:

receiving a vulnerability message describing a profile of a computer system vulnerable to a threat;

identifying one or more vulnerable systems with the profile described in the received vulnerability message, the vulnerable systems having a vulnerability that may be exploited by the threat; and

generating a display that includes a list of the identified vulnerable systems.

2. The method of claim 1 further comprising identifying one or more corrective actions that may be performed to address the vulnerability.

3. The method of claim 2 wherein the corrective action includes installing a software code segment that addresses the vulnerability.

4. The method of claim 1 wherein the corrective action includes filtering network traffic conforming to a threatening profile.

5. The method of claim 1 wherein generating the display includes displaying a corrective action

6. The method of claim 5 wherein displaying the corrective action includes displaying resources required to perform the corrective action.

7. The method of claim 5 wherein displaying the corrective action includes displaying more than one corrective action for the vulnerability, with each of the more than one corrective actions relating to a different degree of required complexity.

8. The method of claim 5 wherein displaying the corrective action includes enabling an administrator to launch a work order to address the vulnerability.

9. The method of claim 8 further comprising enabling a status of the work order to be tracked in an automated manner.

10. The method of claim 8 further comprising confirming receipt of the work order with a receipt message indicating the work order has been received and viewed by a human operator.

11. The method of claim 1 further comprising receiving a confirmation message indicating that the vulnerable system has become a secured system, wherein the secured system comprises a computer system for which the vulnerability has been addressed.

12. The method of claim 11 further comprising probing the secured system to verify that the vulnerability no longer exists.

13. The method of claim 1 wherein generating the display includes enabling an administrator to select an action from a management display that enables the administrator to:

launch a work order to perform a corrective action;

prompt another administrator for additional information describing the impact; and

reject the work order.

14. The method of claim 13 wherein the management display also includes an action to enable technical modifications of the work order to be made.

15. The method of claim 1 wherein an administrator is prompted to enter an importance level associated with the vulnerable system to prioritize a work order.

16. The method of claim 1 wherein identifying the vulnerable systems includes analyzing a database of computer systems with one or more parameters descriptive of the computer systems.

17. The method of claim 1 wherein identifying the vulnerable system includes probing a network of one or more computer systems for vulnerabilities.

18. The method of claim 1 wherein receiving a vulnerability message includes prompting an administrator to transfer information appearing in vulnerability message into a profile database used to identify one or more computer systems.

19. The method of claim 1 further comprising adding information related to the vulnerability to a library of vulnerabilities.

20. The method of claim 19 further comprising determining whether one or more systems in a network of systems are vulnerable to threats described in the library of vulnerabilities.

21. The method of claim 1 further comprising retrieving a code segment that addresses the vulnerability and enabling an administrator to access the code segment.

22. The method of claim 21 further comprising enabling the administrator to install the code segment.

23. The method of claim 21 further comprising creating a package that includes the code segment, the package being configured to automate an installation of the code segment coordinated with one or more operations requirements.

24. A system configured to managing vulnerabilities, the system comprising:

a communications interface structured and arranged to receive a vulnerability message describing a profile of a computer system vulnerable to a threat;

a first processor structured and arranged to identify one or more vulnerable systems with the profile described in the received vulnerability message, the vulnerable systems having a vulnerability that may be exploited by the threat; and

a second processor structured and arranged to generate a display that includes a list of the identified vulnerable systems.

25. The system of claim 24 further comprising a third processor structured and arranged to identify one or more corrective actions that may be performed to address the vulnerability.

26. The system of claim 25 wherein the corrective action includes installing a software code segment that addresses the vulnerability.

27. The system of claim 26 wherein the corrective action includes filtering network traffic conforming to a threatening profile.

28. The system of claim 25 wherein the second processor is structured and arranged to display a corrective action

29. The system of claim 25 wherein the second processor is structured and arranged to display resources required to perform the corrective action.

30. The system of claim 28 wherein the second processor is structured and arranged to display more than one corrective action for the vulnerability, with each of the more than one corrective actions relating to a different degree of required complexity.

31. The system of claim 28 wherein the second processor is structured and arranged to enable an administrator to launch a work order to address the vulnerability.

32. The system of claim 31 further comprising a third processor structured and arranged to enable a status of the work order to be tracked in an automated manner.

33. The system of claim 31 further comprising a fourth processor structured and arranged to confirm receipt of the work order with a receipt message indicating the work order has been received and viewed by a human operator.

34. The system of claim 24 further comprising a fifth processor structured and arranged to receive a confirmation message indicating that the vulnerable system has become a secured system, wherein the secured system comprises a computer system for which the vulnerability has been addressed.

35. The system of claim 34 further comprising a sixth processor structured and arranged to probe the secured system to verify that the vulnerability no longer exists.

36. The system of claim 24 wherein the second processor is structured and arranged to enable an administrator to select an action from a management display that enables the administrator to:

launch a work order to perform a corrective action;

prompt another administrator for additional information describing the impact; and

reject the work order.

37. The system of claim 26 wherein the management display is structured and arranged to enable technical modifications of the work order to be made.

38. The system of claim 24 wherein the second processor is structured and arranged to prompt an administrator to enter an importance level associated with the vulnerable system to prioritize a work order.

39. The system of claim 24 wherein the first processor is structured and arranged to analyze a database of computer systems with one or more parameters descriptive of the computer systems.

40. The system of claim 24 wherein the first processor is structured and arranged to probe a network of one or more computer systems for vulnerabilities.

41. The system of claim 24 wherein the first communications interface is structured and arranged to prompt an administrator to transfer information appearing in vulnerability message into a profile database used to identify one or more computer systems.

42. The system of claim 24 further comprising a second communications interface structured and arranged to add information related to the vulnerability to a library of vulnerabilities.

43. The system of claim 42 further comprising a seventh processor structured and arranged to determine whether one or more systems in a network of systems are vulnerable to threats described in the library of vulnerabilities.

44. The system of claim 24 further comprising a third communications interface structured and arranged to retrieve a code segment that addresses the vulnerability and enabling an administrator to access the code segment.

45. The system of claim 44 further comprising an eighth processor structured and arranged to enable the administrator to install the code segment.

46. The system of claim 44 further comprising a ninth processor structured and arranged to create a package that includes the code segment, the package being configured to automate an installation of the code segment coordinated with one or more operations requirements.

47. A system for managing vulnerabilities, the method comprising:

means for receiving a vulnerability message describing a profile of a computer system vulnerable to a threat;

means for identifying one or more vulnerable systems with the profile described in the received vulnerability message, the vulnerable systems having a vulnerability that may be exploited by the threat; and

means for generating a display that includes a list of the identified vulnerable systems.

48. A computer program configured to managing vulnerabilities, the system comprising:

a first code segment structured and arranged to receive a vulnerability message describing a profile of a computer system vulnerable to a threat;

a second code segment structured and arranged to identify one or more vulnerable systems with the profile described in the received vulnerability message, the vulnerable systems having a vulnerability that may be exploited by the threat; and

a third code segment structured and arranged to generate a display that includes a list of the identified vulnerable systems.