Internet breach correlation

• US 8,966,639 B1
• Filed: 02/14/2014
• Issued: 02/24/2015
• Est. Priority Date: 02/14/2014
• Status: Active Grant

• Current Assignee: Kenna Security LLC (Cisco Systems, Inc.)
• Original Assignee: Risk I/O, Inc.
• Inventors: Roytman, Michael, Bellis, Edward T., Heuer, Jeffrey
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Tran, Tri
• Application Number:
  US14/181,382
• Time in Patent Office: 375 Days
• Field of Search: 726/25
• US Class Current: 726/25
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Techniques for ranking a set of vulnerabilities of a computing asset and set of remediations for a computing asset, and determining a risk score for one or more computing assets are provided. In one technique, vulnerabilities of computing assets in a customer network are received at a vulnerability intelligence platform. Breach data indicating set of breaches that occurred outside customer network is also received. A subset of the set of vulnerabilities that are most vulnerable to a breach is identified based on the breach data. In another technique, multiple vulnerabilities of a computing asset are determined. A risk score is generated for the computing asset based on the vulnerabilities. In another technique, multiple remediations associated with a risk score and multiple vulnerabilities are identified. The remediations are ordered based on the remediations that would reduce the risk score the most if those remediations were applied to remove the corresponding vulnerabilities.

Claims

1. A method comprising:

receiving, from a first source, vulnerability data that indicates a set of vulnerabilities of computing assets in a customer network;

receiving, from one or more second sources that are different than the first source, breach data that at least indicates, for a first vulnerability, a first number of breaches that occurred outside the customer network for the first vulnerability, and for a second vulnerability, a second number of breaches that occurred outside the customer network for the second vulnerability;

wherein the breach data indicates a first period of time for the first vulnerability and a second period of time for the second vulnerability;

identifying the first vulnerability within the set of vulnerabilities;

identifying the second vulnerability within the set of vulnerabilities;

determining that the first vulnerability is more vulnerable to a breach than the second vulnerability based on the first number of breaches and the second number of breaches;

causing result data that is based on the first vulnerability and the second vulnerability to be displayed on a screen of a computing device;

wherein the result data includes a plurality of risk scores, wherein each risk score of the plurality of risk scores is associated with one or more computing assets of the computing assets in the customer network;

receiving input that selects a particular risk score of the plurality of risk scores;

in response to receiving the input that selects the particular risk score, displaying a plurality of metrics associated with the particular risk score, wherein the plurality of metrics includes;

a total number of vulnerabilities of the one or more computing assets that are associated with the particular risk score, and

a total number of breaches that occurred outside the customer network for the vulnerabilities of the one or more computing assets that are associated with the particular risk score;

wherein the method is performed by one or more computing devices.

2. The method of claim 1, further comprising:

identifying, based on the breach data, a subset of the set of vulnerabilities;

based on a frequency of each breach associated with the subset of the set of vulnerabilities, assigning a ranking to each vulnerability in the subset;

wherein causing the result data to be displayed comprising causing the result data to be displayed based on the ranking of each vulnerability in the subset.

3. The method of claim 1, further comprising:

receiving, from a third source that is different than the first and second sources, second breach data that indicates a second set of breaches that have occurred outside the customer network.

4. The method of claim 1, wherein each computing asset of the computing assets in the customer network is one of a database, an operating system, an application, a desktop computer, a server, or source code.

5. The method of claim 1, further comprising:

receiving, from a third source that is different than the first source and the second source, exploit data that indicates a number of exploits for each vulnerability in the set of vulnerabilities;

identifying, based on the breach data and exploit data, a subset of the set of vulnerabilities that are most vulnerable to a breach.

6. The method of claim 1, further comprising:

receiving, from a third source that is different than the first source and the second source, vulnerability data that indicates a score for each vulnerability in the set of vulnerabilities;

identifying, based on the breach data and vulnerability data, a subset of the set of vulnerabilities that are most vulnerable to a breach.

7. One or more non-transitory computer-readable media storing instructions which, when executed by one or more processors, cause:

receiving, from a first source, vulnerability data that indicates a set of vulnerabilities of computing assets in a customer network;

receiving, from one or more second sources that are different than the first source, breach data that at least indicates, for a first vulnerability, a first number of breaches that occurred outside the customer network for the first vulnerability, and for a second vulnerability, a second number of breaches that occurred outside the customer network for the second vulnerability;

wherein the breach data indicates a first period of time for the first vulnerability and a second period of time for the second vulnerability;

identifying the first vulnerability within the set of vulnerabilities;

identifying the second vulnerability within the set of vulnerabilities;

determining that the first vulnerability is more vulnerable to a breach than the second vulnerability based on the first number of breaches and the second number of breaches;

causing result data that is based on the first vulnerability and the second vulnerability to be displayed on a screen of a computing device;

wherein the result data includes a plurality of risk scores, wherein each risk score of the plurality of risk scores is associated with one or more computing assets of the computing assets in the customer network;

receiving input that selects a particular risk score of the plurality of risk scores;

in response to receiving the input that selects the particular risk score, displaying a plurality of metrics associated with the particular risk score, wherein the plurality of metrics includes;

a total number of vulnerabilities of the one or more computing assets that are associated with the particular risk score, and

a total number of breaches that occurred outside the customer network for the vulnerabilities of the one or more computing assets that are associated with the particular risk score.

8. The one or more non-transitory computer-readable media of claim 7, wherein the instructions, when executed by the one or more processors, further cause:

identifying, based on the breach data, a subset of the set of vulnerabilities;

based on a frequency of each breach associated with the subset of the set of vulnerabilities, assigning a ranking to each vulnerability in the subset;

wherein causing the result data to be displayed comprising causing the result data to be displayed based on the ranking of each vulnerability in the subset.

9. The one or more non-transitory computer-readable media of claim 7, wherein the instructions, when executed by the one or more processors, further cause:

receiving, from a third source that is different than the first and second sources, second breach data that indicates a second set of breaches that have occurred outside the customer network.

10. The one or more non-transitory computer-readable media of claim 7, wherein each computing asset of the computing assets in the customer network is one of a database, an operating system, an application, a desktop computer, a server, or source code.

11. The one or more non-transitory computer-readable media of claim 7, wherein the instructions, when executed by the one or more processors, further cause:

receiving, from a third source that is different than the first source and the second source, exploit data that indicates a number of exploits for each vulnerability in the set of vulnerabilities;

identifying, based on the breach data and exploit data, a subset of the set of vulnerabilities that are most vulnerable to a breach.

12. The one or more non-transitory computer-readable media of claim 7, wherein the instructions, when executed by the one or more processors, further cause:

receiving, from a third source that is different than the first source and the second source, vulnerability data that indicates a score for each vulnerability in the set of vulnerabilities;

identifying, based on the breach data and vulnerability data, a subset of the set of vulnerabilities that are most vulnerable to a breach.

13. An apparatus comprising:

one or more processors;

one or more computer-readable media storing instructions which, when executed by the one or more processors, cause;

receiving, from a first source, vulnerability data that indicates a set of vulnerabilities of computing assets in a customer network;

receiving, from one or more second sources that are different than the first source, breach data that at least indicates, for a first vulnerability, a first number of breaches that occurred outside the customer network for the first vulnerability, and for a second vulnerability, a second number of breaches that occurred outside the customer network for the second vulnerability;

wherein the breach data indicates a first period of time for the first vulnerability and a second period of time for the second vulnerability;

identifying the first vulnerability within the set of vulnerabilities;

identifying the second vulnerability within the set of vulnerabilities;

determining that the first vulnerability is more vulnerable to a breach than the second vulnerability based on the first number of breaches and the second number of breaches;

causing result data that is based on the first vulnerability and the second vulnerability to be displayed on a screen of a computing device;

wherein the result data includes a plurality of risk scores, wherein each risk score of the plurality of risk scores is associated with one or more computing assets of the computing assets in the customer network;

receiving input that selects a particular risk score of the plurality of risk scores;

in response to receiving the input that selects the particular risk score, displaying a plurality of metrics associated with the particular risk score, wherein the plurality of metrics includes;

a total number of vulnerabilities of the one or more computing assets that are associated with the particular risk score, and

a total number of breaches that occurred outside the customer network for the vulnerabilities of the one or more computing assets that are associated with the particular risk score.

14. The apparatus of claim 13, wherein the instructions, when executed by the one or more processors, further cause:

identifying, based on the breach data, a subset of the set of vulnerabilities;

based on a frequency of each breach associated with the subset of the set of vulnerabilities, assigning a ranking to each vulnerability in the subset;

wherein causing the result data to be displayed comprising causing the result data to be displayed based on the ranking of each vulnerability in the subset.

15. The apparatus of claim 13, wherein the instructions, when executed by the one or more processors, further cause:

receiving, from a third source that is different than the first and second sources, second breach data that indicates a second set of breaches that have occurred outside the customer network.

16. The apparatus of claim 13, wherein each computing asset of the computing assets in the customer network is one of a database, an operating system, an application, a desktop computer, a server, or source code.

17. The apparatus of claim 13, wherein the instructions, when executed by the one or more processors, further cause:

receiving, from a third source that is different than the first source and the second source, exploit data that indicates a number of exploits for each vulnerability in the set of vulnerabilities;

identifying, based on the breach data and exploit data, a subset of the set of vulnerabilities that are most vulnerable to a breach.

18. The apparatus of claim 13, wherein the instructions, when executed by the one or more processors, further cause:

receiving, from a third source that is different than the first source and second source, vulnerability data that indicates a score for each vulnerability in the set of vulnerabilities;

identifying, based on the breach data and vulnerability data, a subset of the set of vulnerabilities that are most vulnerable to a breach.