Performing security assessments in an online services system

• US 8,904,541 B2
• Filed: 08/26/2010
• Issued: 12/02/2014
• Est. Priority Date: 08/26/2010
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Soby, Brian, Fly, Robert
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US12/869,680
• Publication Number:
  US 20120054871A1
• Time in Patent Office: 1,559 Days
• Field of Search: None
• US Class Current: 726/25
• CPC Class Codes: G06F 11/3664 Environments for testing or debugging software
• CPC Class Codes: G06F 11/3688 for test execution, e.g. scheduling of test suites
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A system and method for performing security assessments in an online services system. In one embodiment, a method includes receiving an accepted security assessment agreement from a user, where the security assessment agreement is associated with a software application utilized in an online services system. The method also includes receiving configuration data associated with the software application; receiving scanning data associated with the software application; and sending the configuration data and scanning data to one or more security assessment systems.

Claims

1. A method for facilitating security assessments in an online services environment, the method comprising:

receiving, in an online services system, from a third-party application provider, a software application for utilization in the online services system;

receiving, at a processor in the online services system from the third-party application provider, configuration data associated with a security assessment to be performed on the software application for utilization in the online services system, the configuration data comprising testing parameters for testing the software application and requirements for starting the security assessment on the software application;

determining, in the online services system, whether the configuration data is valid;

receiving, in the online services system from the third-party application provider, scanning data associated with the software application, the scanning data comprising access credentials for performing the security assessment on the software application;

sending, by the online services system, the configuration data and scanning data to one or more security assessment systems such that the one or more security assessment systems performs the security assessment of the software application in accordance with the configuration data and the scanning data; and

receiving the security assessment in the online services system from the one or more security assessment systems.

2. The method of claim 1, further comprising dynamically resolving data referenced in the software application during the security assessment to detect vulnerabilities associated therewith, and wherein the vulnerabilities associated with the data referenced in the software application includes at least one of a validation logic vulnerability and a data type vulnerability.

3. The method of claim 1, further comprising creating, in the online services system, a test environment for performing security assessments on the software application.

4. The method of claim 1, further comprising creating, in the online services system, a test environment for performing security assessments on the software application, wherein the test environment is based on the configuration data.

5. The method of claim 1, further comprising determining if the online services system communicates with an unauthorized computer system.

6. The method of claim 1, further comprising creating, in the online services system, a test environment for performing security assessments on the software application, wherein creating the test environment is conditioned upon receiving a security assessment agreement.

7. A non-transitory computer-readable storage medium having one or more instructions thereon for facilitating security assessments in an online services system, the instructions when executed by a processor causing the processor to:

receive, in an online services system, from a third-party application provider, a software application for utilization in the online services system;

receive, at a processor in the online services system from the third-party application provider, configuration data associated with a security assessment to be performed on the software application for utilization in the online services system, the configuration data comprising testing parameters for testing the software application and requirements for starting the security assessment on the software application;

determine, in an online services system, whether the configuration data is valid;

receive, in the online services system from the third-party application provider, scanning data associated with the software application, the scanning data comprising access credentials for performing the security assessment on the software application;

send, by the online services system, the configuration data and scanning data to one or more security assessment systems such that the one or more security assessment systems performs the security assessment of the software application in accordance with the configuration data and the scanning data; and

receive the security assessment in the online services system from the one or more security assessment systems.

8. The computer-readable storage medium of claim 7, wherein the instructions further cause the processor to dynamically resolve data referenced in the software application during the security assessment to detect vulnerabilities associated therewith, and wherein the vulnerabilities associated with the data referenced in the software application includes at least one of a validation logic vulnerability and a data type vulnerability.

9. The computer-readable storage medium of claim 7, wherein the instructions further cause the processor to create, in the online services system, a test environment for performing security assessments on the software application.

10. The computer-readable storage medium of claim 7, wherein the instructions further cause the processor to create, in the online services system, a test environment for performing security assessments on the software application, wherein the test environment is based on the configuration data.

11. The computer-readable storage medium of claim 7, wherein the instructions further cause the processor to determine if the online services system communicates with an unauthorized computer system.

12. The computer-readable storage medium of claim 7, wherein the instructions further cause the processor to create, in the online services system, a test environment for performing security assessments on the software application, wherein creating the test environment is conditioned upon receiving a security assessment agreement.

13. An apparatus for facilitating security assessments in an online services system, the apparatus comprising:

a processor; and

a storage device storing one or more stored sequences of instructions which when executed by the processor cause the processor to;

receive, in an online services system, from a third-party application provider, a software application for utilization in the online services system;

receive, at a processor in the online services system from the third-party application provider, configuration data associated with a security assessment to be performed on the software application for utilization in the online services system, the configuration data comprising testing parameters for testing the software application and requirements for starting the security assessment on the software application;

determine, in an online services system, whether the configuration data is valid;

receive in the online services system from the third-party application provider, scanning data associated with the software application, the scanning data comprising access credentials for performing the security assessment on the software application; and

send, by the online services system, the configuration data and scanning data to one or more security assessment systems such that the one or more security assessment systems performs the security assessment of the software application in accordance with the configuration data and the scanning data; and

receive the security assessment in the online services system from the one or more security assessment systems.

14. The apparatus of claim 13, wherein the instructions further cause the processor to dynamically resolve data referenced in the software application during the security assessment to detect vulnerabilities associated therewith, and wherein the vulnerabilities associated with the data referenced in the software application includes at least one of a validation logic vulnerability and a data type vulnerability.

15. The apparatus of claim 13, wherein the instructions further cause the processor to create, in the online services system, a test environment for performing security assessments on the software application.

16. The apparatus of claim 13, wherein the instructions further cause the processor to create, in the online services system, a test environment for performing security assessments on the software application, wherein the test environment is based on the configuration data.

17. The apparatus of claim 13, wherein the instructions further cause the processor to determine if the online services system communicates with an unauthorized computer system.