Asset risk analysis

• US 9,021,595 B2
• Filed: 07/23/2013
• Issued: 04/28/2015
• Est. Priority Date: 11/30/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Schrecker, Sven, Ritter, Stephen, Nakawatase, Ryan
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US13/949,129
• Publication Number:
  US 20130340084A1
• Time in Patent Office: 644 Days
• Field of Search: 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for asset risk analysis. One method includes receiving threat definition data for threats, vulnerability detection data for assets, and countermeasure detection data for assets. The method further includes determining a respective risk metric for each of the assets for each of the threats. This includes analyzing the vulnerability detection data for an asset to determine whether the asset is vulnerable to a threat, determining from the threat definition data and the countermeasure detection data whether the asset is protected by one of the countermeasures identified for the threat, and determining the risk metric for the asset for the threat according to whether the asset is vulnerable to the threat and whether the asset is protected by one of the countermeasures identified for the threat.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

determine whether a particular asset is vulnerable to a particular threat;

determine whether the particular asset is protected from the particular threat by one or more countermeasures in a set of countermeasures including at least one network-based countermeasure and at least one agent-based countermeasure, wherein determining whether the particular asset is protected from the particular threat includes determining a likelihood that one or more of the network-based countermeasures protects the particular asset and determining a likelihood that one or more of the agent-based countermeasures protects the particular asset; and

determine a risk metric for the particular asset for the particular threat according to whether the particular asset is vulnerable to the particular threat and whether the particular asset is protected by one or more of the countermeasures for the particular threat.

2. The storage medium of claim 1, wherein the risk metric is further based on determining, for each of a plurality of threats including the particular threat, whether the particular asset is vulnerable to the respective threat and whether the particular asset is protected from the respective threat by one or more countermeasures.

3. The storage medium of claim 1, wherein determining whether the particular asset is vulnerable to the particular threat includes:

identifying one or more configurations of assets that the particular threat applies to;

determining a configuration of the particular asset; and

determining whether the particular threat applies to the configuration of the particular asset.

4. The storage medium of claim 3, wherein:

determining whether the particular asset is vulnerable includes determining a predicate categorization for the particular asset for the particular threat of vulnerable, not vulnerable, or unknown vulnerability;

determining whether the particular asset is protected from the particular threat by one or more countermeasures includes determining a predicate categorization for the particular asset for the particular threat of protected, not protected, or unknown protection; and

determining whether the particular threat applies to the configuration of the particular asset includes determining a predicate categorization for the particular asset for the particular threat of applicable, not applicable, or unknown applicability.

5. The storage medium of claim 1, wherein determining whether the particular asset is protected from the particular threat by one or more countermeasures includes receiving countermeasure detection data describing countermeasures detected as applying to the particular asset.

6. The storage medium of claim 5, wherein receiving countermeasure detection data includes:

receiving protection data identifying one or more assets protected by a sensor;

receiving sensor countermeasure data describing one or more countermeasures provided by the sensor; and

generating countermeasure detection data for each of the one or more assets protected by the sensor, the countermeasure detection data describing the one or more countermeasures provided by the sensor.

7. The storage medium of claim 6, wherein the sensor countermeasure data identifies one or more signatures blocked by the sensor, and associates each signature with an attack identifier for a respective threat corresponding to the signature.

8. The storage medium of claim 5, wherein the countermeasure detection data is received from multiple sources, at least two of the multiple sources provide countermeasure detection data in different formats, and the instructions, when executed, further cause the machine to normalize the countermeasure detection data so that the countermeasure detection data is in a common format.

9. The storage medium of claim 1, wherein determining whether the particular asset is vulnerable includes receiving vulnerability detection data describing vulnerabilities detected as affecting the particular asset.

10. The storage medium of claim 9, wherein the vulnerability detection data is received from multiple sources, wherein at least two of the multiple sources provide vulnerability detection data in different formats, and the instructions, when executed, further cause the machine to normalize the vulnerability detection data so that the vulnerability detection data is in a common format.

11. The storage medium of claim 1, wherein the instructions, when executed, further cause the machine to identify a risk score for a particular threat measuring how likely the particular threat is to affect an asset, wherein the risk metric is determined at least in part from the risk score for the particular threat.

12. The storage medium of claim 1, wherein the instructions, when executed, further cause the machine to identify for the particular threat definition data.

13. The storage medium of claim 12, wherein the threat definition data includes a respective confidence score for each countermeasure for the particular threat measuring how likely the countermeasure is to reduce a risk that the particular threat will affect an asset possessing the countermeasure.

14. The storage medium of claim 1, wherein the instructions, when executed, further cause the machine to generate a report summarizing the risk metric of the particular asset.

15. The storage medium of claim 1, wherein network-based countermeasures include countermeasures that protect assets by controlling network traffic to the respective asset.

16. The storage medium of claim 1, wherein agent-based countermeasures include countermeasures to protect assets by executing on the respective asset.

17. The storage medium of claim 1, wherein the particular asset is determined to be protected by a first network-based countermeasure and a second agent-based countermeasure.

18. A method comprising:

determining whether a particular asset is vulnerable to a particular threat;

determining whether the particular asset is protected from the particular threat by one or more countermeasures in a set of countermeasures including at least one network-based countermeasure and at least one agent-based countermeasure, wherein determining whether the particular asset is protected from the particular threat includes determining a likelihood that one or more of the network-based countermeasures protects the particular asset and determining a likelihood that one or more of the agent-based countermeasures protects the particular asset; and

determining, using at least one data processing apparatus, a risk metric for the particular asset for the particular threat according to whether the particular asset is vulnerable to the particular threat and whether the particular asset is protected by one or more of the countermeasures for the particular threat.

19. The method of claim 18, further comprising:

identifying vulnerability detection data describing vulnerabilities detected as affecting the particular asset; and

identifying countermeasure detection data describing countermeasures detected as applying to the particular asset.

20. The method of claim 18, wherein network-based countermeasures include countermeasures that protect assets by controlling network traffic to the respective asset.

21. The method of claim 18, wherein agent-based countermeasures include countermeasures to protect assets by executing on the respective asset.

22. A system comprising:

a processor; and

a computer storage medium coupled to the processor and including instructions, which, when executed by the processor, cause the processor to perform operations comprising;

determining whether a particular asset is vulnerable to a particular threat;

determining whether the particular asset is protected from the particular threat by one or more countermeasures in a set of countermeasures including at least one network-based countermeasure and at least one agent-based countermeasure, wherein determining whether the particular asset is protected from the particular threat includes determining a likelihood that one or more of the network-based countermeasures protects the particular asset and determining a likelihood that one or more of the agent-based countermeasures protects the particular asset; and

determining, using at least one data processing apparatus, a risk metric for the particular asset for the particular threat according to whether the particular asset is vulnerable to the particular threat and whether the particular asset is protected by one or more of the countermeasures for the particular threat.