Method and System for Managing Computer System Vulnerabilities

• US 20140047546A1
• Filed: 08/10/2012
• Published: 02/13/2014
• Est. Priority Date: 08/10/2012
• Status: Active Grant

• Current Assignee: NopSec, Inc.
• Original Assignee: NopSec, Inc.
• Inventors: Sidagni, Michelangelo
• Granted Patent: US 8,756,698 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A vulnerability risk management (VRM) module receives an indication of a VRM service to be provided from the end user. The VRM module extracts from the indication either external IP addresses or the web application URL and a list of assets of the enterprise computer system to be tested. The VRM module discovers the assets of the enterprise computer system. The VRM module receives a request for a vulnerability scan using a predefined scan configuration based on preferences of the end user and a specified date and time to conduct the scan. The VRM module reports and stores a preliminary list of potential vulnerabilities in the VRM vulnerability database. The preliminary list is fed to an expert system, which applies specific rule sets using an inference engine and a knowledge base to refine results stored in the VRM vulnerability database by removing extraneous information and false positives.

Claims

1. A computer-implemented method for vulnerability risk management of an enterprise computer system, comprising the steps of:

instantiating, by a cloud computing system, a vulnerability risk management module and an expert system coupled vulnerability risk management module, the vulnerability risk management module configured for;

receiving from an end user a type of vulnerability;

determining a list of potential vulnerabilities of the enterprise computer system based the received type of vulnerability;

transmitting the list of potential vulnerabilities to the expert system;

receiving from the expert system a refined list of potential vulnerabilities; and

reporting a refined set of vulnerabilities to the end user.

2. The method of claim 1, wherein the refined set is substantially free of at least one of extraneous information or false positives.

3. The method of claim 1, wherein the refined set of vulnerabilities is based on an application of a rule set to the list of potential vulnerabilities by an inference engine and a knowledge base of the expert system.

4. The method of claim 3, wherein the rule set is based on the received type of vulnerability.

5. The method of claim 3, wherein the inference engine is configured to iteratively refine the list of potential vulnerabilities using the knowledge base to produce the refined list of vulnerabilities.

6. The method of claim 1, wherein the cloud employs a software-as-a-service multi-tenant architecture.

7. The method of claim 6, wherein the software-as-a-service multi-tenant architecture includes a dual factor log-in to prevent sharing of a database between the enterprise computing system and another enterprise computer system.

8. The method of claim 1, wherein determining the list of potential vulnerabilities comprises performing a scan of an asset of the enterprise computing system associated with the type of vulnerability.

9. The method of claim 8, wherein the asset is at least one of an external network, an internal network, a Web application, a mobile application, a social engineering application, a voice-over Internet protocol (VoIP) application, or a wireless application.

10. The method of claim 8, wherein the scan is based on a non-intrusive scanning technique.

11. The method of claim 8, wherein the scan is based on a preference of the end user and a specified date and time to conduct the scan.

12. The method of claim 1, further comprising automatically opening a trouble ticket based on a vulnerability threshold determined by the end user.

13. The method of claim 1, further comprising removing the refined set of vulnerabilities.

14. A system for vulnerability risk management of an enterprise computer system, comprising:

a cloud computing system configured to instantiate a vulnerability risk management module and an expert system coupled to the vulnerability risk management module, the vulnerability risk management module configured to;

receive from an end user a type of vulnerability;

determine a list of potential vulnerabilities of the enterprise computer system based the received type of vulnerability;

transmit the list of potential vulnerabilities to the expert system;

receive from the expert system a refined list of potential vulnerabilities; and

report a refined set of vulnerabilities to the end user.

15. The system of claim 14, wherein the refined set is substantially free of at least one of extraneous information or false positives.

16. The system of claim 14, wherein the refined set of vulnerabilities is based on an application of a rule set to the list of potential vulnerabilities by an inference engine and a knowledge base of the expert system.

17. The system of claim 16, wherein the inference engine is configured to iteratively refine the list of potential vulnerabilities using the knowledge base to produce the refined list of vulnerabilities.

18. The system of claim 17, wherein the cloud employs a software-as-a-service multi-tenant architecture.

19. The system of claim 18, wherein the software-as-a-service multi-tenant architecture includes a dual factor log-in to prevent sharing of a database between the enterprise computing system and another enterprise computer system.

20. The system of claim 14, wherein the vulnerability risk management module is configured to automatically open a trouble ticket based on a vulnerability threshold determined by the end user.

21. The system of claim 14, wherein the vulnerability risk management module is configured to remove the refined set of vulnerabilities.

22. A non-transitory computer-readable storage medium including instructions that, when accessed by a processing system, cause the processing system to perform a method for vulnerability risk management of an enterprise computer system, comprising the steps of:

instantiating, by a cloud computing system, a vulnerability risk management module and an expert system coupled vulnerability risk management module, the vulnerability risk management module configured for;

receiving from an end user a type of vulnerability;

determining a list of potential vulnerabilities of the enterprise computer system based the received type of vulnerability;

transmitting the list of potential vulnerabilities to the expert system;

receiving from the expert system a refined list of potential vulnerabilities; and

reporting a refined set of vulnerabilities to the end user.