System and method of managing network security risks

• US 8,201,257 B1
• Filed: 03/31/2004
• Issued: 06/12/2012
• Est. Priority Date: 03/31/2004
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Cole, David M., Kurtz, George R., Andres, Steven G., Cummings, Thomas Gregory, Garcia, Roberto Ramon, Kenyon, Brian Michael, McClure, Stuart Cartier, Moore, Christopher William, O'Dea, Michael J., Saruwatari, Ken D.
• Primary Examiner(s): Goodarzi, Nasser
• Assistant Examiner(s): Johnson, Carlton
• Application Number:
  US10/813,917
• Time in Patent Office: 2,995 Days
• Field of Search: 713/201, 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files

Abstract

A security risk management system comprises a vulnerability database, an asset database, a local threat intelligence database and a threat correlation module. The vulnerability database comprises data about security vulnerabilities of assets on a network gathered using active or passive vulnerability assessment techniques. The asset database comprises data concerning attributes of each asset. The threat correlation module receives threat intelligence alerts that identify attributes and vulnerabilities associated with security threats that affect classes of assets. The threat correlation module compares asset attributes and vulnerabilities with threat attributes and vulnerabilities and displays a list of assets that are affected by a particular threat. The list can be sorted according to a calculated risk score, allowing an administrator to prioritize preventive action and respond first to threats that affect higher risk assets. The security risk management system provides tools for performing preventive action and for tracking the success of preventive action.

Claims

1. A security risk management system, comprising:

a processor and a memory;

a vulnerability database comprising data indicative of security vulnerabilities possessed by each asset of a plurality of assets connected to a computer network;

an asset database comprising data indicative of attributes possessed by each asset of the plurality of assets such that the vulnerability database and the asset database together define for each asset a group of security vulnerabilities and attributes possessed by each asset; and

a threat correlation module in communication with the vulnerability database and the asset database and configured to;

receive at least one threat intelligence alert that comprises data identifying at least one security threat that affects a class of assets, wherein the threat intelligence alert defines the affected class of assets with reference to an associated group of attributes and security vulnerabilities possessed by the affected class of assets;

identify a selected threat from the at least one security threat identified by the at least one threat intelligence alert;

identify any assets affected by the selected threat, wherein the asset is deemed to be affected by the selected threat if the group of attributes and security vulnerabilities associated with the selected threat matches the group of attributes and security vulnerabilities possessed by the asset, wherein a user recommendation is provided for responding to the selected threat;

generate a prioritized list of the affected assets based on their respective security risks such that scanning activities are initiated for at least some of the affected assets based on their respective security risks; and

communicate with a threat response module configured to access a vulnerability remediation module and to initiate a ticketing and workflow process that at least partially directs remediation of asset vulnerabilities, wherein the ticketing and workflow process assigns at least one user at least one specific remediation task, and initiates a check-up vulnerability scan in order to verify that the remediation has occurred.

2. The security risk management system of claim 1, wherein the threat correlation module is further configured to display information about each affected asset including a risk score representative of a level of risk to which the asset exposes the network.

3. The security risk management system of claim 2, wherein the risk score of each asset is based at least on a criticality of the asset, a vulnerability severity ranking for each vulnerability associated with the asset, and a criticality of the threats that affect the asset.

4. The security risk management system of claim 1, wherein the threat response module is further configured to transmit to the user, in response to receiving a download request, a file that includes information related to the affected assets.

5. The security risk management system of claim 1, wherein the compliance goal and the time-based compliance measurement are expressed as a percentage of assets not affected by the threat.

6. The security risk management system of claim 1, wherein the compliance goal and the time-based compliance measurement are expressed as a raw number of assets not affected by the threat.

7. The security risk management system of claim 1, wherein the data in the vulnerability database includes:

an identification of the asset;

an identification of the vulnerability;

open ports on the asset;

an operating system running on the asset;

an IP address of the asset;

a domain name for the asset;

a NetBIOS name; and

a Windows Domain/Workgroup name.

8. The security risk management system of claim 1, wherein the attributes possessed by each asset of the plurality of assets comprise:

an IP address;

open ports on the asset;

banners produced by the asset;

an operating system run by the asset;

a criticality of the asset;

services run on the asset;

an asset group to which the asset belongs;

a human understandable asset label;

an asset owner; and

a geographical asset location.

9. The security risk management system of claim 1, wherein a success of the remediation is defined in terms of a percentage.

10. The security risk management system of claim 9, wherein a remediation goal is defined for use with the percentage in order to determine whether the remediation goal has been met.

11. The security risk management system of claim 1, wherein the security risk management system is operable such that the at least one threat intelligence alert is initiated immediately from a threat intelligence communication module after an urgent threat has been added to a threat intelligence database.

12. The security risk management system of claim 11, wherein the at least one threat intelligence alert is received from the threat intelligence communication module by the threat correlation module which stores the at least one threat intelligence alert into a local threat intelligence database.

13. A method of correlating a conceptual network security threat with assets that can be affected by the conceptual network security threat, the method comprising:

identifying a selected conceptual network security threat, wherein the selected conceptual network security threat defines a group of attributes and vulnerabilities that, if possessed by an asset, indicate that the asset possessing the group of attributes and vulnerabilities can be affected by the selected threat if the threat becomes a realized threat;

identifying a group of assets for comparison;

comparing attributes and vulnerabilities associated with each asset of the group of assets with attributes and vulnerabilities of the selected threat utilizing a threat correlation module;

generating a prioritized list of the affected assets based on their respective security risks such that scanning activities are initiated for at least some of the affected assets based on their respective security risks; and

displaying the list of affected assets comprising each asset whose attributes and vulnerabilities match the attributes and vulnerabilities of the selected threat;

wherein the threat correlation module is in communication with a threat response module configured to access a vulnerability remediation module and initiate an automated ticketing and workflow process that at least partially directs remediation of asset vulnerabilities, the automated ticketing and workflow process automatically assigning at least one user at least one specific remediation task, determining if the at least one specific remediation task has been completed by the at least one user, and commencing a check-up vulnerability scan to verify that the remediation has occurred, wherein a user recommendation is provided for responding to the selected conceptual network security threat.

14. The method of claim 13, wherein the list of affected assets comprises each asset whose attributes and vulnerabilities partially match the attributes and vulnerabilities of the selected threat.

15. The method of claim 13, wherein identifying a group of assets for comparison includes identifying a group of assets that, based on the vulnerabilities and attributes of the assets and the vulnerabilities and attributes of the selected threat can potentially be affected by the selected threat.

16. The method of claim 13, wherein displaying a list of affected assets includes displaying along with each affected asset a risk score representing a level of security risk posed by the affected asset to a computer network and wherein the list is sorted such that assets posing high security risk are presented near the top of the list.