SYSTEM AND METHOD FOR GROUPING COMPUTER VULNERABILITIES

• US 20130247207A1
• Filed: 10/11/2011
• Published: 09/19/2013
• Est. Priority Date: 09/21/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hugard, James M. IV, Leroux, Alexander Lawrence, Mallabarapu, Charles, Muniz, Jorge Armando, Russell, Braden C., Wu, Zengjue
• Granted Patent: US 9,251,351 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method in one embodiment includes modules for creating an asset tag including one or more conditions of an asset on a network, adding the asset tag to an asset report template, and generating an asset report from the asset report template. More specific embodiments include creating the asset tag by generating a query for the one or more conditions. The asset tag may include a second asset tag configured to be updated automatically, and a third asset tag configured to be updated manually, and the second asset tag may be updated automatically when the asset tag is updated. Other embodiments include creating a vulnerability set including a selection of vulnerabilities from a plurality of vulnerabilities, adding the vulnerability set to the asset report template, and scanning a plurality of assets on the network.

Claims

1. A method comprising:

providing a list of asset tags to be displayed by a graphical user interface (GUI) of a computer that includes a processor;

creating a first asset tag comprising at least one condition of an asset on a network, wherein the at least one condition is part of a query being displayed by the GUI;

adding the first asset tag to an asset report template; and

generating an asset report from the asset report template, wherein the asset report includes scan results associated with the first asset tag for the computer.

2. The method of claim 1, wherein the at least one condition is selected from a group comprising asset location, asset criticality, asset group name, asset label, asset owner, asset status, asset tag, authentication statistics, banners, Common Vulnerabilities and Exposures (CVE) number, false positives, host domain name system (DNS) name, host netBIOS name, Information Assurance Vulnerability Alert (IAVA) Number, Internet Protocol (IP) Address, Microsoft Knowledge Base (KB) Number, open ports, operating system, protocol name, scan name, vulnerability name, vulnerability severity, and vulnerability set.

3. The method of claim 1, wherein the asset report comprises a list of assets on the network meeting the at least one condition.

4. The method of claim 1, wherein creating the first asset tag comprises generating a query including the at least one condition.

5. The method of claim 4, further comprising updating the asset report template comprising adding a new condition to the query.

6. The method of claim 1, wherein the first asset tag comprises:

a second asset tag configured to be updated automatically; and

a third asset tag configured to be updated manually.

7. The method of claim 6, further comprising updating the second asset tag automatically when the first asset tag is updated.

8. The method of claim 1, further comprising:

creating a vulnerability set comprising a selection of vulnerabilities from a plurality of vulnerabilities;

adding the vulnerability set to the asset report template; and

scanning a plurality of assets on the network to identify one or more of the plurality of assets having the selection of vulnerabilities.

9. The method of claim 8, wherein the asset report comprises a list of assets on the network meeting the at least one condition and having the selection of vulnerabilities in the vulnerability set.

10. An apparatus comprising:

a memory element configured to store data; and

a processor operable to execute instructions associated with the data, wherein the apparatus is configured for;

providing a list of asset tags to be displayed by a graphical user interface (GUI) of a computer that includes the processor;

creating a first asset tag comprising at least one condition of an asset on a network, wherein the at least one condition is part of a query being displayed by the GUI;

adding the first asset tag to an asset report template; and

generating an asset report from the asset report template, wherein the asset report includes scan results associated with the first asset tag for the computer.

11. The apparatus of claim 10, wherein the at least one condition is selected from a group comprising asset location, asset criticality, asset group name, asset label, asset owner, asset status, asset tag, authentication statistics, banners, CVE number, false positives, host DNS name, host netBIOS name, IAVA Number, IP Address, Microsoft KB Number, open ports, operating system, protocol name, scan name, vulnerability name, vulnerability severity, and vulnerability set.

12. The apparatus of claim 10, wherein the apparatus further configured for:

creating a vulnerability set comprising a selection of vulnerabilities from a plurality of vulnerabilities;

adding the vulnerability set to the asset report template; and

scanning a plurality of assets on the network to identify one or more of the plurality of assets having the selection of vulnerabilities.

13. The apparatus of claim 10, wherein creating the first asset tag comprises generating a query including the at least one condition.

14. The apparatus of claim 13, wherein the apparatus further configured for adding a new condition to the query to update the asset report template.

15. Non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

providing a list of asset tags to be displayed by a graphical user interface (GUI) of a computer that includes the processor;

creating a first asset tag comprising at least one condition of an asset on a network, wherein the at least one condition is part of a query being displayed by the GUI;

adding the first asset tag to an asset report template; and

generating an asset report from the asset report template, wherein the asset report includes scan results associated with the first asset tag for the computer.

16. The media of claim 15, wherein the at least one condition is selected from a group comprising asset location, asset criticality, asset group name, asset label, asset owner, asset status, asset tag, authentication statistics, banners, CVE number, false positives, host DNS name, host netBIOS name, IAVA Number, IP Address, Microsoft KB Number, open ports, operating system, protocol name, scan name, vulnerability name, vulnerability severity, and vulnerability set.

17. The media of claim 15, the operations further comprising:

creating a vulnerability set comprising a selection of vulnerabilities from a plurality of vulnerabilities;

adding the vulnerability set to the asset report template; and

scanning a plurality of assets on the network to identify one or more of the plurality of assets having the selection of vulnerabilities.

18. The media of claim 17, wherein the asset report comprises a list of assets on the network meeting the at least one condition and having the selection of vulnerabilities in the vulnerability set.

19. The media of claim 15, wherein creating the first asset tag comprises generating a query including the at least one condition.

20. The media of claim 15, further comprising updating the asset report template comprising adding a new condition to the query.