ANTI-VULNERABILITY SYSTEM, METHOD, AND COMPUTER PROGRAM PRODUCT

• US 20150271142A1
• Filed: 03/16/2015
• Published: 09/24/2015
• Est. Priority Date: 07/01/2003
• Status: Active Grant

• Current Assignee: SecurityProfiling, LLC
• Original Assignee: SecurityProfiling, LLC
• Inventors: Oliphant, Brett M., Blignaut, John P.
• Granted Patent: US 9,225,686 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system, method, and computer program product are provided for identifying a first and second occurrence in connection with at least one of the networked device. In use, it is possible that it is determined that the at least one actual vulnerability of the at least one networked device is capable of being taken advantage of by the first occurrence identified in connection with the at least one networked device. Further, it is also possible that it is determined that the at least one actual vulnerability of the at least one networked device is not capable of being taken advantage of by the second occurrence identified in connection with the at least one networked device. To this end, the first occurrence and the second occurrence are reported differently.

Claims

1. A computer program product embodied on a non-transitory computer readable medium, comprising:

code for accessing information associated with a plurality of mitigation techniques that mitigate a plurality of attacks that take advantage of a plurality of vulnerabilities, for retrieving a plurality of options in connection with a portion of the mitigation techniques that correspond with a subset of the plurality of the vulnerabilities resulting from at least one of an operating system or an application indicated to be on at least one device;

code for presenting the plurality of options in connection with the portion of mitigation techniques that correspond with the subset of the plurality of the vulnerabilities resulting from at least one of the operating system or the application indicated to be on the at least one device, the plurality of options relating to an intrusion prevention mitigation technique and a firewall mitigation technique;

code for receiving first user input selecting the intrusion prevention mitigation technique in connection with the subset of the plurality of the vulnerabilities resulting from at least one of the operating system or the application indicated to be on the at least one device;

code for receiving second user input selecting the firewall mitigation technique in connection with the subset of the plurality of the vulnerabilities resulting from at least one of the operating system or the application indicated to be on the at least one device;

code for, based on the first user input, applying the selected the intrusion prevention mitigation technique in connection with the subset of the plurality of the vulnerabilities resulting from at least one of the operating system or the application indicated to be on the at least one device, for occurrence mitigation;

code for, based on the second user input, applying the selected firewall mitigation technique in connection with the subset of the plurality of the vulnerabilities resulting from at least one of the operating system or the application indicated to be on the at least one device, for occurrence mitigation;

code for identifying an occurrence including one or more packets directed to the at least one of the device;

code for determining whether the occurrence is capable of taking advantage of at least one of the subset of the plurality of the vulnerabilities resulting from at least one of the operating system or the application indicated to be on the at least one device; and

code for preventing the occurrence from taking advantage of the at least one of the subset of the plurality of the vulnerabilities, utilizing at least one of the intrusion prevention mitigation technique or the firewall mitigation technique based on the application thereof, based on the determination whether the occurrence is capable of taking advantage of the at least one of the subset of the plurality of the vulnerabilities resulting from at least one of the operating system or the application indicated to be on the at least one device.

2. The computer program product of claim 1, wherein the computer program product is operable such that the plurality of options that are presented in connection with the portion of mitigation techniques correspond only with the subset of the plurality of the vulnerabilities resulting from at least one of the operating system or the application indicated to be on the at least one device.

3. The computer program product of claim 1, wherein the computer program product is operable such that the presented plurality of options are updated to exclude one or more options related to a part of the mitigation techniques that correspond with another subset of the plurality of the vulnerabilities that were removed as result of at least one patch previously installed on the at least one device.

4. The computer program product of claim 1, and further comprising:

code for performing a vulnerability scan for identifying at least one actual vulnerability to which the at least device is actually vulnerable;

code for determining whether the occurrence is capable of taking advantage of the at least one actual vulnerability;

code for reporting the occurrence in a first manner, if it is determined that the occurrence is capable of taking advantage of the at least one actual vulnerability; and

code for reporting the occurrence in a first manner, if it is determined that the occurrence is not capable of taking advantage of the at least one actual vulnerability.

5. The computer program product of claim 4, wherein the computer program product is operable such that it is determined whether the occurrence is capable of taking advantage of the at least one actual vulnerability, by cross-referencing a vulnerability identifier associated with the occurrence with device vulnerability information.

6. The computer program product of claim 1, wherein the computer program product is operable such that at least one of the plurality of options is presented and the second user input is received before the identification of the occurrence such that the occurrence is prevented from taking advantage of the at least one of the subset of the plurality of the vulnerabilities, in immediate response to the determination that the occurrence is capable of taking advantage of the at least one of the subset of the plurality of the vulnerabilities resulting from at least one of the operating system or the application indicated to be on the at least one device, and the computer program product is further operable such that at least one of the plurality of options is presented and the first user input is received after the identification of the occurrence such that the intrusion prevention mitigation technique is applied in immediate response to the first user input for further preventing the occurrence from taking advantage of the at least one of the subset of the plurality of the vulnerabilities resulting from at least one of the operating system or the application indicated to be on the at least one device.

7. The computer program product of claim 1, wherein the computer program product is operable such that the determination whether the occurrence is capable of taking advantage of at least one of the subset of the plurality of the vulnerabilities resulting from at least one of the operating system or the application indicated to be on the at least one device, is carried out by inspecting at least one characteristic of a payload of at least one of the packets.

8. A computer program product embodied on a non-transitory computer readable medium, comprising:

code for receiving first information associated with a plurality of actual vulnerabilities, the first information being based on second information associated with a plurality of potential vulnerabilities;

said first information associated with the plurality of actual vulnerabilities being based on the second information associated with the plurality of potential vulnerabilities, at least in part as a result of a determination that one or more of a plurality of networked devices is actually vulnerable based on the second information;

code for determining whether an attack is capable of taking advantage of at least one of the plurality of actual vulnerabilities to which at least one of the plurality of the networked devices is actually vulnerable, at least in part as a function of the first information;

code for displaying one or more user options to selectively utilize different attack mitigation actions of diverse attack mitigation types, including a firewall-based attack mitigation type and an intrusion prevention system-based attack mitigation type, for preventing the attack from taking advantage of the at least one actual vulnerability at the at least one networked device, such that the at least one actual vulnerability is determined as a function of the at least one of the operating system or the application of the at least one networked device and the different attack mitigation actions are specific to the at least one actual vulnerability, so that only relevant actual vulnerabilities prompt user selection of relevant attack mitigation actions of the diverse attack mitigation types; and

code for conditionally completing the different attack mitigation actions of the diverse attack mitigation types, including the firewall-based attack mitigation type and the intrusion prevention system-based attack mitigation type, based on a user input in connection with the displayed one or more user options, for preventing the attack from taking advantage of the at least one actual vulnerability at the at least one networked device.

9. The computer program product of claim 8, wherein the computer program product is operable such that the different attack mitigation actions of the diverse attack mitigation types are completed by a deployment from at least one server to at least one client agent supporting at least one of a firewall for implementing the firewall-based attack mitigation type or an intrusion prevention system for implementing the intrusion prevention system-based attack mitigation type.

10. The computer program product of claim 9, wherein the computer program product is operable such that at least one of:

said intrusion prevention system and the firewall are separate;

said intrusion prevention system and the firewall are integrated on the same single platform;

said intrusion prevention system-based attack mitigation type involves an intrusion prevention system action that prevents the attack;

said firewall-based attack mitigation type includes a firewall action that blocks the attack;

said intrusion prevention system-based attack mitigation type utilizes the intrusion prevention system to deploy a patch utilizing an update component;

or

said firewall-based attack mitigation type utilizes the firewall to deploy a patch utilizing an update component.

11. A computer program product embodied on a non-transitory computer readable medium, comprising:

code for receiving first information associated with a plurality of actual vulnerabilities, the first information being based on second information associated with a plurality of potential vulnerabilities;

said first information associated with the plurality of actual vulnerabilities being based on the second information associated with the plurality of potential vulnerabilities, at least in part as a result of a determination that one or more of a plurality of devices is actually vulnerable based on the second information and at least one of an operating system or an application; and

code for, based on or in connection with the first information, displaying one or more options for selection by at least one user to selectively utilize one or more different occurrence mitigation actions in connection with one or more of the plurality of actual vulnerabilities, the different occurrence mitigation actions including;

a firewall-related occurrence mitigation action that includes sending a firewall update resulting in utilization of a firewall feature for preventing an actual vulnerability addressed by the firewall update from being taken advantage of in response to identification of an occurrence capable of taking advantage of the actual vulnerability addressed by the firewall update, and

an intrusion detection or prevention system-related occurrence mitigation action that includes sending an intrusion detection or prevention system update resulting in utilization of an intrusion detection or prevention system feature for preventing an actual vulnerability addressed by the intrusion detection or prevention system update from being taken advantage of in response to identification of an occurrence capable of taking advantage of the actual vulnerability addressed by the intrusion detection or prevention system update.

12. The computer program product of claim 11, and further comprising:

code for, based on a selection received from the at least one user in connection with the one or more options, identifying the occurrence capable of taking advantage of the actual vulnerability addressed by the firewall update, utilizing the first information;

code for, in automatic response to the identification of the occurrence capable of taking advantage of the actual vulnerability addressed by the firewall update, preventing the actual vulnerability addressed by the firewall update from being taken advantage of;

code for, based on a selection received from the at least one user in connection with the one or more options, identifying the occurrence capable of taking advantage of the actual vulnerability addressed by the intrusion detection or prevention system update, utilizing the first information; and

code for, in automatic response to the identification of the occurrence capable of taking advantage of the actual vulnerability addressed by the intrusion detection or prevention system update, preventing the actual vulnerability addressed by the intrusion detection or prevention system update from being taken advantage of.

13. The computer program product of claim 11, wherein the computer program product is operable such that the different occurrence mitigation actions further include a patch update-related occurrence mitigation action that includes sending a patch update resulting in utilization of an update feature for removing an actual vulnerability addressed by the patch update.

14. The computer program product of claim 11, and further comprising code for, in response to the identification of at least one occurrence in connection with at least one device, displaying one or more additional options for selection by the at least one user to selectively utilize one or more additional occurrence mitigation actions in connection with the identified at least one occurrence, including:

another firewall-related occurrence mitigation action that includes sending a firewall signal resulting in utilization of the firewall feature for dropping at least one packet in connection with the identified at least one occurrence, and

another intrusion detection or prevention system-related occurrence mitigation action that includes sending an intrusion detection or prevention system signal resulting in utilization of the intrusion detection or prevention system feature for quarantining the at least one device.

15. The computer program product of claim 14, wherein the computer program product is operable such that the one or more options are displayed for pre-occurrence selection in connection with multiple of the plurality of devices, and the one or more additional options are displayed for post-occurrence selection in connection with a single one of the plurality of the devices subjected to the identified at least one occurrence.

16. The computer program product of claim 14, and further comprising:

code for;

determining the identified at least one occurrence to have a first severity if it is determined that at least one actual vulnerability of at least one of the plurality of devices is susceptible to being taken advantage of by the identified at least one occurrence, and further determining the identified at least one occurrence to have a second severity if it is determined that the at least one actual vulnerability of the at least one of the plurality of devices is not susceptible to being taken advantage of by the identified at least one occurrence; and

code for reporting the identified at least one occurrence differently based on whether the identified at least one occurrence is determined to have the first severity or the second severity, utilizing at least one user interface with which the one or more additional options are displayed.

17. The computer program product of claim 11, wherein the computer program product is operable such that the one or more options include multiple options that are provided by being displayed via an intrusion prevention system interface of an intrusion prevention system that is supported by a single client agent that supports at least one aspect of the identification of the occurrence capable of taking advantage of the actual vulnerability addressed by the intrusion detection or prevention system update, at least one aspect of receiving the intrusion detection or prevention system update, and at least one aspect of preventing the actual vulnerability addressed by the intrusion detection or prevention system update from being taken advantage of.

18. The computer program product of claim 17, wherein the computer program product is operable such that the single client agent further supports at least one aspect of the identification of the occurrence capable of taking advantage of the actual vulnerability addressed by the firewall update, at least one aspect of receiving the firewall update, and at least one aspect of preventing the actual vulnerability addressed by the firewall update from being taken advantage of.

19. The computer program product of claim 11, wherein the computer program product is operable such that the one or more options are displayed with the different identified actual vulnerabilities.

20. The computer program product of claim 11, wherein the computer program product is operable such that the one or more options includes displaying a first option corresponding to the firewall-related occurrence mitigation action utilizing a firewall user interface element, and displaying a second option corresponding to the intrusion detection or prevention system-related occurrence mitigation action utilizing an intrusion detection or prevention user interface element.

21. The computer program product of claim 11, wherein the computer program product is operable such that the displaying the one or more options includes displaying a first option corresponding to the firewall-related occurrence mitigation action based on an identification of the actual vulnerability addressed by the firewall update.

22. The computer program product of claim 21, wherein the computer program product is operable such that the displaying the one or more options includes displaying a second option corresponding to the intrusion detection or prevention system-related occurrence mitigation action based on identification of the actual vulnerability addressed by the intrusion detection or prevention system update, wherein the computer program product is operable such that the first option is capable of being selected for a first actual vulnerability, the second option is capable of being selected for a second actual vulnerability, and both the first and second options are capable of being selected for a third actual vulnerability.

23. The computer program product of claim 11, wherein the computer program product is operable such that the one or more options is displayed via at least one user interface of an intrusion prevention system that includes integrated intrusion prevention functionality and firewall functionality that are both supported by a security component that in turn supports at least one aspect of the identification of the occurrence capable of taking advantage of the actual vulnerability addressed by the firewall update and the identification of the occurrence capable of taking advantage of the actual vulnerability addressed by the intrusion detection or prevention system update, and further includes logic that receives the first information and utilizes the first information to effect the display of the one or more options to selectively utilize the intrusion prevention functionality and the firewall functionality as a function of an existence of the one or more actual vulnerabilities to reduce false positives in connection with both the intrusion prevention functionality and the firewall functionality.

24. The computer program product of claim 23, wherein the computer program product is operable such that the identification of the occurrence capable of taking advantage of the actual vulnerability addressed by the firewall update is carried out by:

identifying at least one first occurrence packet;

determining whether the actual vulnerability addressed by the firewall update is capable of being taken advantage of by identifying at least one aspect of the at least one first occurrence packet and utilizing the at least one aspect of the at least one first occurrence packet to determine whether the actual vulnerability addressed by the firewall update is capable of being taken advantage of; and

wherein the computer program product is further operable such that the identification of the occurrence capable of taking advantage of the actual vulnerability addressed by the intrusion detection or prevention system update is carried out by;

identifying at least one second occurrence packet;

determining whether the actual vulnerability addressed by the intrusion detection or prevention system update is capable of being taken advantage of by identifying at least one aspect of the at least one second occurrence packet and utilizing the at least one aspect of the at least one second occurrence packet to determine whether the actual vulnerability addressed by the intrusion detection or prevention system update is capable of being taken advantage of.

25. The computer program product of claim 11, wherein the computer program product is operable such that the actual vulnerability addressed by the firewall update is prevented by filtering or blocking the same, and the actual vulnerability addressed by the intrusion detection or prevention system update is prevented by quarantining at least one device subject to the actual vulnerability addressed by the intrusion detection or prevention system update.

26. The computer program product of claim 11, wherein the computer program product is operable such that at least one of the identification of the occurrence capable of taking advantage of the actual vulnerability addressed by the firewall update, or the identification of the occurrence capable of taking advantage of the actual vulnerability addressed by the intrusion detection or prevention system update, includes an operation utilizing a Common Vulnerabilities and Exposures (CVE) identifier.

27. The computer program product of claim 11, wherein the computer program product is operable such that the one or more options are displayed based on the first information by displaying the options only for the plurality of actual vulnerabilities.

28. The computer program product of claim 11, wherein the computer program product is operable such that at least one of:

said firewall update includes a firewall upgrade or a new firewall policy;

said firewall update includes a firewall policy or a firewall setting;

said firewall update is sent to a firewall or a component with firewall functionality;

said firewall update is sent to a firewall or a component with firewall functionality for automatic installation therewith;

said intrusion detection or prevention system update includes an intrusion detection or prevention system upgrade or a new intrusion detection or prevention system policy;

said intrusion detection or prevention system update includes an intrusion detection or prevention system policy or an intrusion detection or prevention system setting;

said intrusion detection or prevention system update is sent to an intrusion detection or prevention system or a component with intrusion detection or prevention system functionality;

said intrusion detection or prevention system update is sent to an intrusion detection or prevention system or a component with intrusion detection or prevention system functionality for automatic installation therewith;

said intrusion detection or prevention system-related occurrence mitigation action includes at least one of an intrusion detection system-related occurrence mitigation action or an intrusion prevention system-related occurrence mitigation action;

said intrusion detection or prevention system update includes at least one of an intrusion detection system update or an intrusion prevention system update;

said second information is received by at least one of;

receiving at least one update from a data storage;

pulling at least one update, or synchronizing with a data storage;

said first information results from a vulnerability scan operation;

said first information identifies the plurality of actual vulnerabilities;

said first information includes at least one of a vulnerability identifier or information related to the plurality of actual vulnerabilities;

said first information includes information related to the plurality of actual vulnerabilities including at least one of remediation information or vulnerability identifiers;

said one or more options are displayed utilizing one or more user interface elements;

said firewall-related occurrence mitigation action includes at least one of removing the actual vulnerability addressed by the firewall update, or reducing an effect of the occurrence capable of taking advantage of the actual vulnerability addressed by the firewall update;

said firewall-related occurrence mitigation action includes at least one of;

an action that results in occurrence mitigation utilizing firewall functionality, or an action that results in occurrence mitigation utilizing a firewall;

said intrusion detection or prevention system-related occurrence mitigation action includes at least one of;

an action that results in occurrence mitigation utilizing intrusion detection or prevention system functionality, or an action that results in occurrence mitigation utilizing an intrusion detection or prevention system;

one or more of said one or more options are capable of being selected before occurrence identification to selectively utilize the different occurrence mitigation actions in connection therewith;

said display of the one or more options is based on the first information;

said one or more options is displayed in connection with the first information;

said different occurrence mitigation actions include different remediation actions;

said occurrence includes at least one of a request, traffic, at least one packet, or a potential attack;

said plurality of actual vulnerabilities include a subset of the plurality of potential vulnerabilities to which one or more of the plurality of devices is determined to be actually vulnerable based on at least one of the operating system or the application;

said first information associated with the plurality of actual vulnerabilities being based on the second information associated with the plurality of potential vulnerabilities, at least in part as a result of a determination that one or more of a plurality of devices is actually vulnerable based on the second information and the operating system;

said first information associated with the plurality of actual vulnerabilities being based on the second information associated with the plurality of potential vulnerabilities, at least in part as a result of a determination that one or more of a plurality of devices is actually vulnerable based on the second information and the application;

said determination that one or more of a plurality of devices is actually vulnerable, is based on an automated process;

said determination that one or more of a plurality of devices is actually vulnerable, is based on a vulnerability scan;

said determination that one or more of a plurality of devices is actually vulnerable, is based on user input;

said one or more options are displayed based on the first information by displaying the options only for the plurality of actual vulnerabilities, before the determining;

said one or more options are displayed based on the first information by displaying the options only for the plurality of actual vulnerabilities, after the determining;

or

said computer program product is embodied on a single non-transitory computer readable medium; and

wherein the computer program product is further operable for use with at least one NOC server, a data warehouse, and an SDK for allowing access to information associated with at least one vulnerability and at least one remediation, and wherein the computer program product is operable for determining which devices have vulnerabilities by directly querying a firmware or operating system of the devices.

29. A system, comprising:

an intrusion prevention system component capable of accessing at least one data structure identifying a plurality of mitigation techniques that mitigate effects of attacks that take advantage of vulnerabilities, such that;

each mitigation technique is capable of mitigating an effect of an attack that takes advantage of a corresponding vulnerability,

each mitigation technique has a mitigation type including at least one of a patch, a policy setting, or a configuration option,

at least two of the mitigation techniques are capable of mitigating an effect of an attack that takes advantage of a first one of the vulnerabilities, and

said at least two mitigation techniques include a first mitigation technique that utilizes a firewall action for at least mitigating the attack that takes advantage of the first one of the vulnerabilities and a second mitigation technique that utilizes a real-time intrusion prevention action for at least mitigating the attack that takes advantage of the first one of the vulnerabilities;

said intrusion prevention system component configured for;

causing a display of the at least two mitigation techniques for selection by a user via at least one user interface;

receiving a selection of at least one of the at least two mitigation techniques; and

automatically applying the selected at least one of the at least two mitigation techniques utilizing a communication between a server and client code supporting the intrusion prevention system component.

30. The system of claim 29, wherein the system is operable such that the first one of the vulnerabilities is identified as a function of at least one of an operating system or an application identified in connection with a device, so that, in order to avoid false positives, only relevant vulnerabilities prompt mitigation technique user selection among the at least two mitigation techniques.