Mapping remediation to plurality of vulnerabilities

• US 20060021052A1
• Filed: 07/23/2004
• Published: 01/26/2006
• Est. Priority Date: 07/23/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Gandhe, Sudhir, Tyree, David Spencer, D'Mello, Kurt
• Granted Patent: US 7,774,848 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A method of mapping a remediation to a plurality of vulnerabilities may include: assessing susceptibility of an non-remediated machine to a first vulnerability, which results in a first set of two or more vulnerabilities to which the machine is susceptible; implementing the remediation upon the machine; assessing susceptibility of the remediated machine to the first vulnerability, which results in a second set of vulnerabilities to which the machine is susceptible; and creating a machine-actionable map between the remediation and two or more members of the first set based upon differences between the first and second sets.

Claims

1. A method of mapping a remediation to a plurality of vulnerabilities, the method comprising:

assessing susceptibility of an non-remediated machine to a first vulnerability, which results in a first set of two or more vulnerabilities to which the machine is susceptible;

implementing the remediation upon the machine;

assessing susceptibility of the remediated machine to the first vulnerability, which results in a second set of vulnerabilities to which the machine is susceptible; and

creating a machine-actionable map between the remediation and two or more members of the first set based upon differences between the first and second sets.

2. The method of claim 1, wherein the creating of the machine-actionable map includes:

eliminating members of the first set that are also members of the second set to produce a residual set having at least two members; and

creating the machine-actionable map between the remediation and members of the residual set.

3. The method of claim 1, wherein:

the machine is a first version of the machine that includes at least a first technology;

the method further comprises;

adding to the non-remediated first version of the machine at least a second technology according to the residual set in order to produce a second version of the machine;

assessing susceptibility of a non-remediated second version of the machine to the first vulnerability, which results in a third set of two or more vulnerabilities to which the non-remediated second version of the machine is susceptible,

implementing the remediation upon the second version of the machine;

assessing susceptibility of the remediated second version of the machine to the first vulnerability, which results in a fourth set of vulnerabilities to which the remediated second version of the machine is susceptible;

verifying that the remediation mitigates the members of the residual set for the first version of the machine.

5. The method of claim 1, wherein:

the machine includes at least a first technology;

the method further includes

forming a third set of vulnerabilities from the first set thereof, each member vulnerability of the third set corresponding to the first technology, and

forming a fourth set of vulnerabilities from the second set thereof, each member vulnerability of the fourth set corresponding to the first TID; and

the creating of the machine-actionable map includes

eliminating members of the third set that are also members of the fourth set to produce a residual set, and

creating the machine-actionable map between the remediation and members of the residual set.

11. A machine configured to implement the method of claim 1.

12. A machine configured to implement the method of claim 2.

13. A machine configured to implement the method of claim 3.

15. A machine configured to implement the method of claim 5.

4. The method of claim 19, wherein:

the residual set is a first residual set; and

the verifying includes;

eliminating members of the third set that are also members of the fourth set to produce a second residual set; and

confirming that none of the members of the second residual set are members of the first residual set.

14. A machine configured to implement the method of claim 4.

6. A machine-readable medium comprising instructions, execution of which by a machine maps a remediation to a plurality of vulnerabilities, the machine-readable instructions including:

a first code segment to assess susceptibility of an non-remediated machine to a first vulnerability, which results in a first set of two or more vulnerabilities to which the machine is susceptible;

a second code segment to implement the remediation upon the machine;

a third code segment to assess susceptibility of the remediated machine to the first vulnerability, which results in a second set of vulnerabilities to which the machine is susceptible; and

a fourth code segment to create a machine-actionable map between the remediation and two or more members of the first set based upon differences between the first and second sets.

7. The machine-readable medium of claim 6, wherein the fourth code segment includes:

a fifth code segment to eliminate members of the first set that are also members of the second set to produce a residual set having at least two members; and

a fifth code segment to create the machine-actionable map between the remediation and members of the residual set.

8. The machine-readable medium of claim 6, wherein:

the machine is a first version of the machine that includes at least a first technology;

the machine-readable instructions further include;

a fifth code segment to add to the non-remediated first version of the machine at least a second technology according to the residual set in order to produce a second version of the machine;

a sixth code segment to assess susceptibility of a non-remediated second version of the machine to the first vulnerability, which results in a third set of two or more vulnerabilities to which the non-remediated second version of the machine is susceptible,

a seventh code segment to implement the remediation upon the second version of the machine;

an eighth code segment to assess susceptibility of the remediated second version of the machine to the first vulnerability, which results in a fourth set of vulnerabilities to which the remediated second version of the machine is susceptible;

a nine code segment to verify that the remediation mitigates the members of the residual set for the first version of the machine.

9. The machine-readable medium of claim 8, wherein:

the residual set is a first residual set; and

the ninth code segment includes;

a tenth code segment to eliminate members of the third set that are also members of the fourth set to produce a second residual set; and

an eleventh code segment to confirm that none of the members of the second residual set are members of the first residual set.

10. The machine-readable medium of claim 6, wherein:

the machine includes at least a first technology;

the machine-readable instructions further include

a fifth code segment to form a third set of vulnerabilities from the first set thereof, each member vulnerability of the third set corresponding to the first technology, and

a sixth code segment to form a fourth set of vulnerabilities from the second set thereof, each member vulnerability of the fourth set corresponding to the first TID; and

the fourth code segment includes

a seventh code segment to eliminate members of the third set that are also members of the fourth set to produce a residual set, and

an eighth code segment to create the machine-actionable map between the remediation and members of the residual set.

16. An apparatus for mapping a remediation to a plurality of vulnerabilities, the apparatus comprising:

means for assessing susceptibility of an non-remediated machine to a first vulnerability, which results in a first set of two or more vulnerabilities to which the machine is susceptible;

means for implementing the remediation upon the machine;

means for assessing susceptibility of the remediated machine to the first vulnerability, which results in a second set of vulnerabilities to which the machine is susceptible; and

means for creating a machine-actionable map between the remediation and two or more members of the first set based upon differences between the first and second sets.