System and method for evaluation in a collaborative security assurance system

• US 8,925,091 B2
• Filed: 09/01/2011
• Issued: 12/30/2014
• Est. Priority Date: 09/01/2011
• Status: Active Grant

• Current Assignee: SecureWorks Corp. (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Thomas, Ashley, Paranjpe, Ashwin
• Primary Examiner(s): Nalven, Andrew
• Assistant Examiner(s): Doan, Huan V
• Application Number:
  US13/224,009
• Publication Number:
  US 20130061327A1
• Time in Patent Office: 1,216 Days
• Field of Search: 709/223, 709/224, 709/225, 726/13, 726/15, 726/24, 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A security assurance system includes a back-end application and a computing resource. The back-end application receives a selection of a network security product that is associated with a protected network, and receives a selection of a threat from a plurality of threats stored on the security assurance system. The computing resource launches an evaluation of the security product based upon the threat, and reports to a user of the security assurance system a result of the evaluation.

Claims

1. A method comprising:

storing, by a first developer associated with a first protected network, a first threat, wherein the first threat is stored to a security assurance system, wherein the security assurance system includes a plurality of threats;

storing, by a second developer associated with a second protected network, a second threat, wherein the second threat is stored to the security assurance system;

providing a first security product to the security assurance system;

selecting, by a first administrator associated with the first protected network, the first security product, wherein the first security product is associated with a second security product of the first protected network;

selecting, by the first administrator, the first threat;

launching on the security assurance system a first evaluation of the first security product based upon the first threat;

reporting to the first administrator a first result of the first evaluation;

updating the second security product in response to the first result;

selecting, by a second administrator associated with the second protected network, the first security product, wherein the first security product is associated with a third security product of the second protected network;

selecting, by the second administrator, the second threat, and preventing the selecting, by the second administrator, the first threat;

launching on the security assurance system a second evaluation of the first security product based upon the second threat;

reporting to the second administrator a second result of the second evaluation; and

updating the third security product in response to the second result.

2. The method of claim 1, further comprising:

launching a simulation of the second security product on a computing resource;

wherein launching the evaluation further comprises transmitting the threat to the simulation.

3. The method of claim 2, further comprising:

determining that the simulation of the second security product successfully blocked the threat; and

wherein reporting the result is in response to the determining.

4. The method of claim 1, further comprising:

receiving from the security assurance system a configuration for the second security product in response to selecting the first security product, wherein the configuration is associated with the protected network; and

wherein the evaluation of the first security product includes evaluating the configuration.

5. The method of claim 1, wherein the threat is selected based on a recommendation by the security assurance system.

6. A security assurance system comprising:

a back-end application; and

a hardware computing resource;

wherein the back-end application is operable to;

store a first threat, wherein the security assurance system includes a plurality of threats, and wherein the first threat is received form a first developer associated with a first protected network;

store a second threat, wherein the second threat is received from a second developer associated with a second protected network;

receive a first security product;

receive a first selection of the first security product from a first administrator associated with the first protected network, wherein the first security product is associated with a second security product of the first protected network;

receive a second selection of the first threat from the first administrator;

receive a third selection of the first security product from a second administrator associated with the second protected network, wherein the first security product is associated with a third security product of the second protected network; and

receive a fourth selection, by the second administrator, of the second threat, and prevent the selecting, by the second administrator, of the first threat; and

wherein the computing resource is operable to;

launch a first evaluation of the first security product based upon the first threat;

report to the first administrator a first result of the first evaluation;

update the second security product in response to the first result;

launch on the security assurance system a second evaluation of the first security product based upon the second threat;

report to the second administrator a second result of the second evaluation; and

update the third security product in response to the second result.

7. The security assurance system of claim 6, wherein the computing resource is further operable to:

launch a simulation of the second security product on a computing resource; and

transmit the threat to the simulation.

8. The security assurance system of claim 7, wherein the computing resource is further operable to:

determine that the simulation of the second security product successfully blocked the threat; and

wherein reporting the result is in response to the determining.

9. The security assurance system of claim 6, wherein the back-end application is further operable to:

receive from the security assurance system a configuration for the second security product in response to selecting the first security product, wherein the configuration is associated with the protected network;

wherein the evaluation of the first security product includes evaluating the configuration.

10. The security assurance system of claim 6, wherein the threat is selected based on a recommendation by the security assurance system.

11. Machine-executable code for an information handling system, wherein the machine-executable code is embedded in a non-transitory storage medium and includes instructions for carrying out a method, the method comprising:

storing, by a first developer associated with a first protected network, a first threat, wherein the first threat is stored to a security assurance system, wherein the security assurance system includes a plurality of threats;

storing, by a second developer associated with a second protected network, a second threat, wherein the second threat is stored to the security assurance system;

providing a first security product to the security assurance system;

selecting, by a first administrator associated with the first protected network, the first security product, wherein the first security product is associated with a second security product of the first protected network;

selecting, by the first administrator, the first threat;

launching on the security assurance system a first evaluation of the first security product based upon the first threat;

reporting to the first administrator a first result of the first evaluation;

updating the second security product in response to the first result;

selecting, by a second administrator associated with the second protected network, the first security product, wherein the first security product is associated with a third security product of the second protected network;

selecting, by the second administrator, the second threat, and preventing the selecting, by the second administrator, the first threat;

launching on the security assurance system a second evaluation of the first security product based upon the second threat;

reporting to the second administrator a second result of the second evaluation; and

updating the third security product in response to the second result.

12. The machine-executable code of claim 11, the method further comprising:

launching a simulation of the second security product on a computing resource;

wherein launching the evaluation further comprises transmitting the threat to the simulation.

13. The machine-executable code of claim 12, the method further comprising:

determining that the simulation of the second security product successfully blocked the threat; and

wherein reporting the result is in response to the determining.

14. The machine-executable code of claim 11, the method further comprising:

receiving from the security assurance system a configuration for the second security product in response to selecting the first security product, wherein the configuration is associated with the protected network; and

wherein the evaluation of the first security product includes evaluating the configuration.

15. The machine-executable code of claim 11, wherein the threat is selected based on a recommendation by the security assurance system.