System and method for network vulnerability detection and reporting

• US 7,257,630 B2
• Filed: 03/10/2003
• Issued: 08/14/2007
• Est. Priority Date: 01/15/2002
• Status: Active Grant

• Current Assignee: McAfee, LLC, Mission Foundstone, Inc.
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Cole, David M., Caso, Erik, Hanzlik, Dennis J.
• Primary Examiner(s): Salad; Abdullahi
• Application Number:
  US10/387,221
• Publication Number:
  US 20040015728A1
• Time in Patent Office: 1,618 Days
• Field of Search: 709/224, 709/225, 726/25, 726222-225, 714/4, 714 47- 48
• US Class Current: 709/224
• CPC Class Codes: G02B 2006/12097 Ridge, rib or the like
• CPC Class Codes: G02B 2006/12116 Polariser; Birefringent
• CPC Class Codes: G02B 5/3083 Birefringent or phase retarding elements G02B5/3008, G02B5/3016 take precedence; systems for polarisation control G02B27/286; manufacturing phase modulating patterns by lithographic processes G03F7/001
• CPC Class Codes: G02B 6/105 having optical polarisation effects
• CPC Class Codes: G02B 6/12011 characterised by the arrayed waveguides, e.g. comprising a filled groove in the array section
• CPC Class Codes: G02B 6/12023 characterised by means for reducing the polarisation dependence, e.g. reduced birefringence
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system and method provide comprehensive and highly automated testing of vulnerabilities to intrusion on a target network, including identification of operating system, identification of target network topology and target computers, identification of open target ports, assessment of vulnerabilities on target ports, active assessment of vulnerabilities based on information acquired from target computers, quantitative assessment of target network security and vulnerability, and hierarchical graphical representation of the target network, target computers, and vulnerabilities in a test report. The system and method employ minimally obtrusive techniques to avoid interference with or damage to the target network during or after testing.

Claims

1. A method of objectively assessing the security of a networks, said method comprising:

assigning a vulnerability risk level to each of a plurality of vulnerabilities found on the network;

assigning a vulnerability risk level to each of a plurality of nodes on the network based on vulnerabilities found on each of the plurality of nodes;

assigning an exposure risk level to each exposure found on the network;

providing a security score that is dependent on at least the vulnerability risk levels of the vulnerabilities, the vulnerability risk levels of the nodes, and a number of nodes on the network;

wherein the security score is derived from a formula of form F=a−

V−

E, wherein F is the security score, a is a constant, V is a vulnerability loss, and E is an exposure loss.

2. The method of claim 1, further comprising the step of assigning an exposure risk level to each of a plurality of exposures found on the network, and wherein the security score is further dependent on the exposure risk levels.

3. The method of claim 2, wherein the security score is based on selected vulnerabilities and exposures that affect internal network security.

4. The method of claim 3, wherein the selected exposures include rogue applications, wireless access points, trojan horses, and backdoors.

5. The method of claim 1, wherein V is derived from a formula of form V=min (b, (cV_hH_h+dV_mH_m+eV_lH_l)/H_n)), where V is the vulnerability loss, min( . . . , . . . ) is a standard minimum function, V_h is a number of high level vulnerabilities detected, H_h is a number of hosts on which high level vulnerabilities are detected, V_m is a number of medium level vulnerabilities detected, H_m is a number of hosts on which medium level venerabilities are detected, V_l is a number of low level vulnerabilities detected, H_l is a number of hosts on which low level vulnerabilities are detected, and H_n is a total number of hosts on the network.

6. The method of claim 5, wherein E is derived from a formula E=min(f, Σ

<sub>(y=l→

Hn)</sub>{gR_y+hW_y+iT_y}), where E is the exposure loss, min ( . . . , . . . ) is the standard minimum function, Σ

is a summation symbol, R_y is a number of Rogue applications found on a host y, W_Y is a number of wireless access points found on the host y, and T_y is a number of trojan horses or backdoors found on the host y.

7. A method of objectively assessing the security of a network, said method comprising the steps of:

assigning a vulnerability risk level to each of a plurality of vulnerabilities found on the network;

assigning a vulnerability risk level to each of a plurality of nodes on the network based on vulnerabilities found on each of the plurality of nodes;

assigning an exposure risk level to each exposure found on the network;

assigning an exposure risk level to each of a plurality of exposures found on the network;

providing a security score that is dependent on at least the vulnerability risk levels of the vulnerabilities, the vulnerability risk levels of the nodes, and a number of nodes on the network;

wherein to security score is further dependent on the exposure risk levels;

wherein the security score is derived from a formula of form F=a−

V−

E, wherein F is the security score, a is a constant, V is a vulnerability loss, and E is an exposure loss.

8. A system for selectively calculating one of a plurality of network security scores, the system comprising:

a network security score calculation module adapted to run computer instructions for calculating a network security score, the network security score being calculated according to defined vulnerabilities and exposures found in a network and defined numerical weights for each defined vulnerability and exposure;

a plurality of network security calculation instruction sets, the plurality of network security calculation instruction sets adapted to define the vulnerabilities and exposures included in the calculation, and to define the numerical weights for each vulnerability and exposure; and

a calculation selection module adapted to allow a computer user to select one of the plurality of network security calculation instruction sets to be run by the network security score calculation module;

wherein the network security score is derived from formula of form F=a−

V−

E, wherein F is the network security score, a is a constant, V is a vulnerability loss, and E is an exposure loss.

9. The system of claim 8, wherein the plurality of network security calculation instruction sets includes a first set of network security calculation instruction sets adapted to provide a network security score that focuses on security vulnerabilities and exposures that affect external security of the network and a second set of network security calculation instruction sets adapted to provide a network security score that focuses on security vulnerabilities and exposures that affect internal security of the network.

10. A computer program product embodied on a tangible computer readable medium for objectively assessing the security of a network, said computer program product comprising:

computer code for assigning a vulnerability risk level to each of a plurality of vulnerabilities found on the network;

computer code for assigning a vulnerability risk level to each of a plurality of nodes on the network based on vulnerabilities found on each of the plurality of nodes;

computer code for assigning an exposure risk level to each exposure found on the network;

computer code for providing a security score that is dependent on at least the vulnerability risk levels of the vulnerabilities, the vulnerability risk levels of the nodes, and a number of nodes on the network;

wherein the security score is derived front a formula of form F=a−

V−

E, wherein F is the security score, a is a constant, V is a vulnerability loss, and E is an exposure loss.

11. The computer program product of claim 10, further comprising computer code for assigning an exposure risk level to each of a plurality of exposures found on the network, and wherein the security score is further dependent on the exposure risk levels.

12. The computer program product of claim 11, wherein the security score is based on selected vulnerabilities and exposures that affect internal network security.

13. The computer program product of claim 12, wherein the selected exposures include rogue applications, wireless access points, trojan horses, and backdoors.

14. The computer program product of claim 10, wherein V is derived from a formula of form V=min (b, (cV_hH_h+dV_mH_m+eV_lH_l)/H_n)), where V is the vulnerability loss, min( . . . , . . . ) is a standard minimum function, V_h is a number of high level venerabilities detected, H_h is a number of hosts on which high level vulnerabilities are detected, V_m is a number of medium level vulnerabilities detected, H_m is a number of hosts on which medium level vulnerabilities are detected, V_l is a number of low level vulnerabilities detected, H_l is a number of hosts on which low level vulnerabilities are detected, and H_n is a total number of hosts on the network.

15. The computer program product of claim 14, wherein E is derived from a formula E=min(f, Σ

<sub>(y=l→

Hn)</sub>{(gR_y+hW_y+iT_y}), where E is the exposure loss, min ( . . . , . . . ) is the standard minimum function, Σ

is a summation symbol, R_y is a number of Rogue applications found on a host y, W_y is a number of wireless access points found on the host y, and T_y is a number of trojan horses or backdoors found on the host y.