Data structure for vulnerability-based remediation selection

• US 20060021053A1
• Filed: 09/20/2004
• Published: 01/26/2006
• Est. Priority Date: 07/23/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Gandhe, Sudhir, O'Brien, Eric David, Tyree, David Spencer, D'Mello, Kurt
• Granted Patent: US 7,694,337 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A machine-actionable memory comprises one or more machine-actionable records arranged according to a data structure. Such a data structure may include links that respectively map between a remediation, at least one action, and at least two vulnerabilities. A method of selecting a remediation, that is appropriate to a vulnerability which is present on a machine to be remediated, may include: providing a machine-actionable memory as mentioned above; and indexing into the memory using: a given vulnerability identifier to determine (A) at least one of a remediation mapped thereto and (B) at least one action mapped to the given vulnerability identifier; and/or a given remediation to determine at least two vulnerabilities mapped thereto.

Claims

1. A machine-actionable memory comprising:

one or more machine-actionable records arranged according to a data structure and representing a remediation, the data structure including links that respectively map between

a remediation,

at least one action, and

at least two vulnerabilities.

2. The memory of claim 1, wherein the links of the data structure respectively map between

a R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID);

at least one ACT_ID field, the contents of which denotes an ID of an action (ACT_ID); and

at least two V_ID fields, the contents of which denote IDs of vulnerabilities (V_IDs).

3. The memory of claim 2, wherein the data structure further includes links that extend the mapping to at least one T_ID field, the contents of which denote an ID of a technology (T_ID), respectively.

4. The memory of claim 2, wherein:

implementation of the remediation upon an asset mitigates against respective vulnerability thereof to the at least two vulnerabilities denoted by the contents of the at least two V_ID fields; and

execution of the at least one action denoted by the contents of the at least one ACT_ID field at least in part implements the remediation.

5. The memory of claim 2, wherein the data structure further includes:

at least one AS_ID field, the contents of which denotes an ID of an asset (AS_ID) to which the remediation is to be applied.

6. The memory of claim 5, wherein:

implementation of the remediation upon the at least one asset denoted by the contents of the at least one AS_ID field mitigates against respective vulnerability thereof to the at least two vulnerabilities denoted by the contents of the at least two V_ID fields; and

execution of the at least one action denoted by the contents of the at least one ACT_ID field at least in part implements the remediation.

7. The memory of claim 5, wherein the data structure for at least one of the one-or-more machine-actionable records includes:

two or more V_ID fields, the contents of which denote two or more V_IDs, respectively;

a plurality of ACT_ID fields, the contents of which denote a plurality of ACT_IDs, respectively;

two or more SS links relating one or more among the plurality of ACT_ID fields as a subset (SS) thereof, respectively;

two or more AS_ID fields, the contents of which denote two or more AS_ID fields; and

at least one of the following,

(A) at least two V-SS links between the two or more V_ID fields, respectively, and the two or more subsets,

(B) at least two R-V links between the R_ID field and the two or more V_ID fields, respectively,

(C) at least two R-SS links between the R_ID field and the two or more subsets, respectively, and

(D) at least two R-AS links between the R_ID field and the two or more AS_ID fields, respectively.

8. The memory of claim 2, wherein the data structure for at least one of the one-or-more machine-actionable records includes:

two or more V_ID fields, the contents of which denote two or more V_IDs, respectively;

a plurality of ACT_ID fields, the contents of which denote a plurality of ACT_IDs, respectively;

at least two SS links relating one or more among the plurality of ACT_ID fields as a subset (SS) thereof, respectively; and

at least one of the following,

(A) at least two V-SS links between the two or more V_ID fields, respectively, and the two or more subsets,

(B) at least two R-V links between the R_ID field and the two or more V_ID fields, respectively, and

at least two R-SS links between the R_ID field and the two or more subsets, respectively.

11. A machine having a memory as in claim 1.

12. A machine having a memory as in claim 2.

13. A machine having a memory as in claim 3.

14. A machine having a memory as in claim 4.

15. A machine having a memory as in claim 5

16. A machine having a memory as in claim 6.

17. A machine having a memory as in claim 7.

18. A machine having a memory as in claim 8.

20. The machine-readable medium of claim 1, wherein:

the links of the data structure of the first code segment respectively map between

a R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID),

at least one ACT_ID field, the contents of which denotes an ID of an action (ACT_ID), and

at least two V_ID fields, the contents of which denote IDs of vulnerabilities (V_IDs); and

the second code segment indexes into the memory using a given V_ID value to determine (A) at least one of a R_ID value mapped thereto and (B) at least one ACT_ID value mapped to the given V_ID value.

9. A method of selecting a remediation that is appropriate to a vulnerability which is present on a machine to be remediated, the method comprising:

providing a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure and representing a remediation, the data structure including links that respectively map between

a remediation,

at least one action, and

at least two vulnerabilities;

indexing into the memory using a given vulnerability identifier to determine (A) at least one of a remediation mapped thereto and (B) at least one action mapped to the given vulnerability identifier.

10. The method of claim 9, wherein:

the links of the data structure respectively map between

a R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID),

at least one ACT_ID field, the contents of which denotes an ID of an action (ACT_ID), and

at least two V_ID fields, the contents of which denote IDs of vulnerabilities (V_IDs); and

the indexing into the memory indexes using a given V_ID value to determine (A) at least one of a R_ID value mapped thereto and (B) at least one ACT_ID value mapped to the given V_ID value.

21. A machine configured to implement the method of claim 9.

22. A machine configured to implement the method of claim 10.

19. A machine-readable medium comprising instructions, execution of which by a machine selects a remediation that is appropriate to a vulnerability which is present on a machine to be remediated, the machine-readable instructions including:

a first code segment to provide a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure and representing a remediation, the data structure including links that respectively map between

a remediation,

at least one action, and

at least two vulnerabilities;

a second code segment to index into the memory using a given vulnerability identifier to determine (A) at least one of a remediation mapped thereto and (B) at least one action mapped to the given vulnerability identifier.

23. An apparatus for selecting a remediation that is appropriate to a vulnerability which is present on a machine to be remediated, the method comprising:

a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure and representing a remediation, the data structure including links that respectively map between

a remediation,

at least one action, and

at least two vulnerabilities;

means for indexing into the memory using a given vulnerability identifier to determine (A) at least one of a remediation mapped thereto and (B) at least one action mapped to the given vulnerability identifier.

24. The apparatus of claim 23, wherein

the links of the data structure respectively map between

a R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID),

at least one ACT_ID field, the contents of which denotes an ID of an action (ACT_ID), and

at least two V_ID fields, the contents of which denote IDs of vulnerabilities (V_IDs);

and

the means for indexing is further operable for indexing into the memory using a given V_ID value to determine (A) at least one of a R_ID value mapped thereto and (B) at least one ACT_ID value mapped to the given V_ID value.

25. A method of selecting a remediation that is appropriate to a vulnerability which is present on a machine to be remediated, the method comprising:

providing a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure and representing a remediation, the data structure including links that respectively map between a remediation,

at least one action, and

at least two vulnerabilities;

indexing into the memory using a given remediation to determine at least two vulnerabilities mapped thereto.

26. The method of claim 25, wherein:

the links of the data structure respectively map between

a R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID),

at least one ACT_ID field, the contents of which denotes an ID of an action (ACT_ID), and

at least two V_ID fields, the contents of which denote IDs of vulnerabilities (V_IDs); and

the indexing into the memory indexes using a given R_ID value to determine at least two V_ID values mapped thereto.

27. A machine configured to implement the method of claim 25.

28. A machine configured to implement the method of claim 26.

29. A machine-readable medium comprising instructions, execution of which by a machine selects a remediation that is appropriate to a vulnerability which is present on a machine to be remediated, the machine-readable instructions including:

a first code segment to provide a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure and representing a remediation, the data structure including links that respectively map between

a remediation,

at least one action, and

at least two vulnerabilities;

a second code segment to index into the memory using a given remediation to determine at least two vulnerabilities mapped thereto.

30. An apparatus for selecting a remediation that is appropriate to a vulnerability which is present on a machine to be remediated, the method comprising:

a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure and representing a remediation, the data structure including links that respectively map between

a remediation,

at least one action, and

at least two vulnerabilities;

means for indexing into the memory using a given remediation to determine at least two vulnerabilities mapped thereto.