Protecting a data processing system from attack by a vandal who uses a vulnerability scanner

• US 7,793,348 B2
• Filed: 06/06/2007
• Issued: 09/07/2010
• Est. Priority Date: 10/01/2001
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Yell, Nigel Birkbeck, Lingafelt, Charles Steven
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Powers; William S
• Application Number:
  US11/759,040
• Publication Number:
  US 20070245421A1
• Time in Patent Office: 1,189 Days
• Field of Search: 726/25, 726/23, 713/189
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Method and apparatus for protecting a data processing system such as an Internet server from attack by a vandal who uses an offensive vulnerability scanner to find an externally visible vulnerability of the data processing system. The method includes determining an externally visible vulnerability using a defensive vulnerability scanner, configuring an intrusion detection system to detect a network flow associated with the vulnerability, and blocking that flow by a firewall or a router. The apparatus includes a defensive vulnerability scanner that finds an externally visible vulnerability and provides a description of the vulnerability, an intrusion detection system that detects a network flow that satisfies the description, and a firewall or a router that blocks the flow responsive to detection of the flow by the intrusion detection system.

Claims

1. A method for protecting a data processing system against attack by a vandal, the method comprising the steps of:

blocking, by a hardware blocker, a first instance of a network flow to the data processing system, said first instance of the network flow having been detected by an observation engine of the apparatus and being associated with a first externally visible vulnerability of the data processing system, said first externally visible vulnerability having been determined by a vulnerability scanner of the apparatus,

lifting, by the observation engine, a blocking of an earlier-blocked instance of the network flow, wherein the earlier-blocked instance of the network flow had been blocked by the hardware blocker due to having satisfied a description of the earlier-blocked instance provided by the vulnerability scanner responsive to the vulnerability scanner having determined a second externally visible vulnerability of the data processing system such that the earlier-blocked instance of the network flow is associated with the second externally visible vulnerability.

2. The method of claim 1, wherein the vulnerability scanner accesses the list in the database through the Internet.

3. The method of claim 1, wherein the vulnerability scanner is a network vulnerability scanner.

4. The method of claim 1, wherein the vulnerability scanner is a host vulnerability scanner.

5. The method of claim 1, wherein the vulnerability scanner is an application vulnerability scanner.

6. The method of claim 1, wherein the observation engine is an intrusion detection system.

7. The method of claim 1, wherein the hardware blocker is a firewall.

8. The method of claim 1, wherein the hardware blocker is a router.

9. The method of claim 1,

wherein the step of providing said description is performed after the step of determining the first externally visible vulnerability is performed,

wherein the step of detecting is performed after the step of providing said description is performed,

wherein the step of instructing is performed after the step of detecting is performed, and

wherein the step of blocking is performed after the step of instructing is performed.

10. Apparatus for protecting a data processing system against attack by a vandal, the apparatus comprising:

a vulnerability scanner for determining a first externally visible vulnerability of the data processing system and for providing to an observation engine a description of a first instance of a network flow to the data processing system such that the first instance of the network flow is associated with the first externally visible vulnerability, said first externally visible vulnerability being on a list, said list appearing in a database;

the observation engine for detecting the first instance of the network flow satisfying said description and for instructing a hardware blocker to block the detected first instance of the network flow, said instructing being in response to said detecting; and

the hardware blocker for blocking the detected first instance of the network flow, said blocking being in response to said instructing,

wherein the observation engine is adapted to lift a blocking of an earlier-blocked instance of the network flow, wherein the earlier-blocked instance of the network flow had been blocked by the hardware blocker due to having satisfied a description of the earlier-blocked instance provided by the vulnerability scanner responsive to the vulnerability scanner having determined a second externally visible vulnerability of the data processing system such that the earlier-blocked instance of the network flow is associated with the second externally visible vulnerability, and wherein the second externally visible vulnerability is on the list.

11. The apparatus of claim 10, wherein the observation engine is adapted to lift the blocking of the earlier-blocked instance in response to an elapse of a specified interval of time following a last known arrival of the earlier-blocked instance at the data processing system.

12. The apparatus of claim 10, wherein the observation engine is adapted to lift the blocking of the earlier-blocked instance in response to an installation of a software patch or upgrade in the data processing system in relation to the earlier externally visible vulnerability.

13. The apparatus of claim 10, wherein the hardware blocker is a router.

14. The apparatus of claim 10, wherein the hardware blocker is a firewall.

15. The apparatus of claim 10, wherein the vulnerability scanner is selected from the group consisting of a network vulnerability scanner, a host vulnerability scanner, and an application vulnerability scanner.

16. The apparatus of claim 10, wherein the observation engine is an intrusion detection system.

17. Apparatus for protecting a data processing system against attack by a vandal, the apparatus comprising:

a hardware blocker for blocking a first instance of a network flow to the data processing system, said first instance of the network flow having been detected by an observation engine of the apparatus and being associated with a first externally visible vulnerability of the data processing system, said first externally visible vulnerability having been determined by a vulnerability scanner of the apparatus,

wherein the observation engine is adapted to lift a blocking of an earlier-blocked instance of the network flow, wherein the earlier-blocked instance of the network flow had been blocked by the hardware blocker due to having satisfied a description of the earlier-blocked instance provided by the vulnerability scanner responsive to the vulnerability scanner having determined a second externally visible vulnerability of the data processing system such that the earlier-blocked instance of the network flow is associated with the second externally visible vulnerability.

18. The apparatus of claim 17, wherein the hardware blocker is a router.

19. The apparatus of claim 17, wherein the hardware blocker is a firewall.

20. The apparatus of claim 17, wherein the vulnerability scanner is selected from the group consisting of a network vulnerability scanner, a host vulnerability scanner, and an application vulnerability scanner.

21. The apparatus of claim 17, wherein the observation engine is an intrusion detection system.