SYSTEM AND METHOD FOR SELECTING AND APPLYING FILTERS FOR INTRUSION PROTECTION SYSTEM WITHIN A VULNERABILITY MANAGEMENT SYSTEM

• US 20100242114A1
• Filed: 03/18/2010
• Published: 09/23/2010
• Est. Priority Date: 03/20/2009
• Status: Active Grant

• Current Assignee: Alert Logic Incorporated
• Original Assignee: Achilles Guard, Inc. (Alert Logic Incorporated)
• Inventors: BUNKER, NELSON, HARRIS, DAVID, MITCHELL, KEVIN, BUNKER, EVA
• Granted Patent: US 8,881,272 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: Y10S 707/957 Multidimensional
• CPC Class Codes: Y10S 707/959 Network

Abstract

A system for controlling selection of filters for protecting against vulnerabilities of a computer network includes a vulnerability management system analyzes the computer network and determines network vulnerabilities for the computer network. The vulnerability management system is configured to receive real-time data on a status of filters protecting against vulnerabilities of the computer network. A database contains a pre-generated mapping of network vulnerabilities to filters for protecting against the network vulnerabilities. The vulnerability management system enables user control of filters for protecting against vulnerabilities of the computer network based upon the determined network vulnerabilities of the computer network, the pre-generated mapping of network vulnerabilities to the filters for protecting against the network vulnerabilities and the real-time data on the status of the filters.

Claims

1. A system for controlling selection of filters for protecting against vulnerabilities of a computer network:

a vulnerability management system for analyzing the computer network and determining network vulnerabilities for the computer network, wherein the vulnerability management system is configured to receive real-time data on a status of filters protecting against vulnerabilities of the computer network;

a database contain a pre-generated mapping of network vulnerabilities to filters for protecting against the network vulnerabilities; and

wherein the vulnerability management system enables user control of filters for protecting against vulnerabilities of the computer network based upon the determined network vulnerabilities of the computer network, the pre-generated mapping of network vulnerabilities to the filters for protecting against the network vulnerabilities and the real-time data on the status of the filters.

2. The system of claim 1, wherein the vulnerability management system further generates reports relating to the status of filters associated with the determined network vulnerabilities responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters.

3. The system of claim 2, wherein the reports include a mitigated risk report listing each of the determined network vulnerabilities that is protected from by an enabled filter responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters.

4. The system of claim 2, wherein the reports include an active risk report listing each of the determined network vulnerabilities that are at least partially unprotected from by one of the filters, further wherein the active risk report associates with each of the determined network vulnerabilities at least one filter that can protect from the determined network vulnerabilities and whether the at least one filter is enabled or disabled responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters.

5. The system of claim 2, wherein the reports include a list of determined network vulnerabilities that do not have an associated filter to protect from the vulnerability responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters.

6. The system of claim 2, wherein the reports include a mitigated risk report listing each of the determined network vulnerabilities that is protected from by an enabled filter responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters and further wherein the determined network vulnerabilities in the mitigated risk report can be exempted from future mitigated risk reports.

7. The system of claim 1, wherein the vulnerability management system further includes an interface to a security management system controlling the filters of at least one intrusion protection system, the interface enabling provision of commands to the security management system relating the control of the filters for protecting against vulnerabilities of the computer network.

8. The system of claim 1, wherein the vulnerability management system further includes:

at least one scanning server for scanning for the network vulnerabilities within the corporate network; and

a vulnerability management server for receiving the determined network vulnerabilities from the scanning server and controlling the filters for protecting against the vulnerabilities of the computer network based upon the determined network vulnerabilities of the computer network, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters.

9. The system of claim 1, wherein the real-time data on the status of filters protecting against vulnerabilities of the computer network are provided from an intrusion protection system.

10. A system for controlling selection of filters for protecting against vulnerabilities of a computer network:

a vulnerability management system for analyzing the computer network and determining network vulnerabilities for the computer network, wherein the vulnerability management system is configured to receive real-time data on a status of filters protecting against vulnerabilities of the computer network;

at least one intrusion protection system server connected between the computer network and an external network, the intrusion protection system including a plurality of filters for protecting against the network vulnerabilities and providing the real-time data on a status of filters;

a security management system for controlling enabling and disabling of the filters within the at least one intrusion protection system responsive to commands from the vulnerability management system;

a database contain a pre-generated mapping of network vulnerabilities to the filters for protecting against the network vulnerabilities within the at least one intrusion protection system; and

wherein the vulnerability management system enables control of filters for protecting against vulnerabilities of the computer network within the at least one intrusion protection system based upon the commands generated responsive to the determined network vulnerabilities of the computer network, the pre-generated mapping of network vulnerabilities to the filters for protecting against the network vulnerabilities and the real-time data on the status of the filters.

11. The system of claim 10, wherein the vulnerability management system further generates reports relating to the status of filters associated with the determined network vulnerabilities responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters.

12. The system of claim 11, wherein the reports include a mitigated risk report listing each of the determined network vulnerabilities that is protected from by an enabled filter responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters.

13. The system of claim 11, wherein the reports include an active risk report listing each of the determined network vulnerabilities that are at least partially unprotected from by one of the filters, further wherein the active risk report associates with each of the determined network vulnerabilities at least one filter that can protect from the determined network vulnerabilities and whether the at least one filter is enabled or disabled responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters.

14. The system of claim 11, wherein the reports include a list of determined network vulnerabilities that do not have an associated filter to protect from the vulnerability responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters.

15. The system of claim 11, wherein the reports include a mitigated risk report listing each of the determined network vulnerabilities that is protected from by an enabled filter responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters and further wherein the determined network vulnerabilities in the mitigated risk report can be exempted from future mitigated risk reports.

16. The system of claim 10, wherein the vulnerability management system further includes:

at least one scanning server for scanning for the network vulnerabilities within the corporate network; and

a vulnerability management server for receiving the determined network vulnerabilities from the scanning server and controlling the filters for protecting against the vulnerabilities of the computer network based upon the determined network vulnerabilities of the computer network, the database of mapped vulnerabilities to filters and the real-time data on the status of the filters.

17. A method for controlling selection of filters for protecting against vulnerabilities of a computer network:

storing a plurality of mapped network vulnerabilities of the computer network to filters for protecting against the network vulnerabilities within a database;

determining network vulnerabilities for the computer network within a vulnerability management system;

receiving real-time data on a status of available filters protecting against vulnerabilities of the computer network at the vulnerability management system; and

controlling the filters for protecting against vulnerabilities of the computer network based upon the determined network vulnerabilities of the computer network, the mapped network vulnerabilities to the filters for protecting against the network vulnerabilities and the real-time data on the status of the filters from the vulnerability management system.

18. The method of claim 17 further including the step of generating reports relating to the status of the filters associated with the determined network vulnerabilities responsive to the determined network vulnerabilities, the mapped network vulnerabilities to filters and the real-time data on the status of the filters.

19. The method of claim 18, wherein the step of generating reports further includes the step of generating a mitigated risk report listing each of the determined network vulnerabilities that is protected from by an enabled filter responsive to the determined network vulnerabilities, the mapped network vulnerabilities to filters and the real-time data on the status of the filters.

20. The method of claim 18, wherein the step of generating reports further includes the step of generating an active risk report listing each of the determined network vulnerabilities that are at least partially unprotected from by one of the filters, the active risk report associating with each of the determined network vulnerabilities at least one filter that can protect from the determined network vulnerabilities and whether the at least one filter is enabled or disabled responsive to the determined network vulnerabilities, the mapped network vulnerabilities to filters and the real-time data on the status of the filters.

21. The method of claim 18, wherein the step of generating reports further includes the step of generating a list of determined network vulnerabilities that do not have an associated filter to protect from the vulnerability responsive to the determined network vulnerabilities, the mapped network vulnerabilities to filters and the real-time data on the status of the filters.

22. The method of claim 18, wherein the steps of generating reports further includes the steps:

generating a mitigated risk report listing each of the determined network vulnerabilities that is protected from by an enabled filter responsive to the determined network vulnerabilities, the mapped network vulnerabilities to filters and the real-time data on the status of the filters;

selecting determined network vulnerabilities to be filtered from future mitigated risk reports; and

exempting the selected vulnerabilities from the future mitigated risk reports.

23. The method of claim 17, wherein the step of controlling further comprises the steps of:

transmitting commands controlling the filters to a security management system from the vulnerability management system;

controlling the filters of at least one intrusion protection system for protecting against vulnerabilities of the computer network responsive to the commands to the security management system.

24. The method of claim 17, wherein the step of determining further comprises the steps of:

scanning for the network vulnerabilities within the corporate network using a scanning server;

receiving the determined network vulnerabilities at a control server from the scanning server; and

controlling the filters for protecting against the vulnerabilities of the computer network based upon the determined network vulnerabilities of the computer network, the mapped network vulnerabilities to filters and the real-time data on the status of the filters.

25. The method of claim 17, wherein the step of receiving further includes the step of receiving the real-time data on the status of filters protecting against vulnerabilities of the computer network are provided from an intrusion protection system.