Security risk management

• US 9,438,615 B2
• Filed: 09/09/2013
• Issued: 09/06/2016
• Est. Priority Date: 09/09/2013
• Status: Active Grant

• Current Assignee: BitSight Technologies, Inc.
• Original Assignee: BitSight Technologies, Inc.
• Inventors: Gladstone, Philip John Steuart, Kirby, Alan Joseph, Truelove, John Matthew, Feinzeig, David, Venna, Nagarjuna, Boyer, Stephen
• Primary Examiner(s): Abdul-Ali, Omar
• Application Number:
  US14/021,585
• Publication Number:
  US 20150074579A1
• Time in Patent Office: 1,093 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06Q 30/0277 Online advertisement
• CPC Class Codes: G06Q 50/01 Social networking
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Among other things, traces are received of activities of an online user who is associated with an entity. By analysis of the traces a security state of the entity is inferred. Also, a map is generated between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets. At least part of the generating of the map is done automatically. A user can be engaged to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities.

Claims

1. A method comprising:

generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically, generating of the map comprising online discovery of information about the technical assets; and

enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities,

the technical assets comprising network-related information, and in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or Regional Internet Registry.

2. The method of claim 1 in which the technical assets comprise network-related information.

3. The method of claim 2 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements.

4. The method of claim 2 in which generating the map comprises online discovery of information about the technical assets.

5. The method of claim 4 in which the information about the technical assets is discovered through passive DNS queries.

6. The method of claim 5 comprising identifying from the passive DNS queries associations between domain names and network addresses.

7. The method of claim 6 comprising tracking changes over time in the network addresses that are associated with a given domain name.

8. The method of claim 6 in which identifying from the passive DNS queries associations between domain names and network addresses comprises:

receiving a first domain name for an entity from the entities;

sending a first passive DNS query to identify first name servers for the first domain name;

receiving a list of the first name servers for the first domain;

sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative;

receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative;

sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names;

receiving a list of the host names and the Internet Protocol addresses for the host names; and

mapping each of the Internet Protocol addresses to an attribute for the entity.

9. The method of claim 1 comprising presenting to the user non-technical-asset information through the user interface.

10. The method of claim 9 in which the non-technical-asset information comprises information about the entities.

11. The method of claim 10 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts.

12. The method of claim 1 in which the tool enables the user to assign a technical asset to an entity.

13. The method of claim 1 comprising invoking external crowd-sourced services to aid in generating the map.

14. The method of claim 1 comprising enabling a separate review and approval of entities proposed to be included in the map.

15. The method of claim 1 comprising providing the map to an application for joining to event data or scoring the security state of the entities.

16. The method of claim 1 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map.

17. The method of claim 1 comprising generating graphs of relationships among entities based on their associations with technical assets.

18. A method comprising:

generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically, the technical assets comprising network-related information, the generating of the map comprising online discovery of information about the technical assets, the information about the technical assets being discovered through passive DNS queries; and

enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities.

19. The method of any of claim 18 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements.

20. The method of claim 18 in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or a Regional Internet Registry.

21. The method of claim 18 comprising identifying from the passive DNS queries associations between domain names and network addresses.

22. The method of claim 21 comprising tracking changes over time in the network addresses that are associated with a given domain name.

23. The method of claim 21 in which identifying from the passive DNS queries associations between domain names and network addresses comprises:

receiving a first domain name for an entity from the entities;

sending a first passive DNS query to identify first name servers for the first domain name;

receiving a list of the first name servers for the first domain;

sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative;

receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative;

sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names;

receiving a list of the host names and the Internet Protocol addresses for the host names; and

mapping each of the Internet Protocol addresses to an attribute for the entity.

24. The method of claim 18 comprising presenting to the user non-technical-asset information through the user interface.

25. The method of claim 24 in which the non-technical-asset information comprises information about the entities.

26. The method of claim 25 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts.

27. The method of claim 18 in which the tool enables the user to assign a technical asset to an entity.

28. The method of claim 18 comprising invoking external crowd-sourced services to aid in generating the map.

29. The method of claim 18 comprising enabling a separate review and approval of entities proposed to be included in the map.

30. The method of claim 18 comprising providing the map to an application for joining to event data or scoring the security state of the entities.

31. The method of claim 18 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map.

32. The method of claim 18 comprising generating graphs of relationships among entities based on their associations with technical assets.

33. A method comprising:

generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically,

invoking external crowd-sourced services to aid in generating the map; and

enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities.

34. The method of claim 33 in which the technical assets comprise network-related information.

35. The method of any of claim 34 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements.

36. The method of claim 34 in which generating the map comprises online discovery of information about the technical assets.

37. The method of claim 36 in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or a Regional Internet Registry.

38. The method of claim 36 in which the information about the technical assets is discovered through passive DNS queries.

39. The method of claim 38 comprising identifying from the passive DNS queries associations between domain names and network addresses.

40. The method of claim 39 comprising tracking changes over time in the network addresses that are associated with a given domain name.

41. The method of claim 39 in which identifying from the passive DNS queries associations between domain names and network addresses comprises:

receiving a first domain name for an entity from the entities;

sending a first passive DNS query to identify first name servers for the first domain name;

receiving a list of the first name servers for the first domain;

sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative;

receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative;

sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names;

receiving a list of the host names and the Internet Protocol addresses for the host names; and

mapping each of the Internet Protocol addresses to an attribute for the entity.

42. The method of claim 33 comprising presenting to the user non-technical-asset information through the user interface.

43. The method of claim 42 in which the non-technical-asset information comprises information about the entities.

44. The method of claim 43 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts.

45. The method of claim 33 in which the tool enables the user to assign a technical asset to an entity.

46. The method of claim 33 comprising enabling a separate review and approval of entities proposed to be included in the map.

47. The method of claim 33 comprising providing the map to an application for joining to event data or scoring the security state of the entities.

48. The method of claim 33 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map.

49. The method of claim 33 comprising generating graphs of relationships among entities based on their associations with technical assets.

50. A method comprising:

generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically,

enabling a separate review and approval of entities proposed to be included in the map, and

enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities.

51. The method of claim 50 in which the technical assets comprise network-related information.

52. The method of any of claim 51 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements.

53. The method of claim 50 in which generating the map comprises online discovery of information about the technical assets.

54. The method of claim 53 in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or a Regional Internet Registry.

55. The method of claim 53 in which the information about the technical assets is discovered through passive DNS queries.

56. The method of claim 55 comprising identifying from the passive DNS queries associations between domain names and network addresses.

57. The method of claim 56 comprising tracking changes over time in the network that are associated with a given domain name.

58. The method of claim 56 in which identifying from the passive DNS queries associations between domain names and network addresses comprises:

receiving a first domain name for an entity from the entities;

sending a first passive DNS query to identify first name servers for the first domain name;

receiving a list of the first name servers for the first domain;

sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative;

receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative;

sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names;

receiving a list of the host names and the Internet Protocol addresses for the host names; and

mapping each of the Internet Protocol addresses to an attribute for the entity.

59. The method of claim 50 comprising presenting to the user non-technical-asset information through the user interface.

60. The method of claim 59 in which the non-technical-asset information comprises information about the entities.

61. The method of claim 60 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts.

62. The method of claim 50 in which the tool enables the user to assign a technical asset to an entity.

63. The method of claim 50 comprising invoking external crowd-sourced services to aid in generating the map.

64. The method of claim 50 comprising providing the map to an application for joining to event data or scoring the security state of the entities.

65. The method of claim 50 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map.

66. The method of claim 50 comprising generating graphs of relationships among entities based on their associations with technical assets.

67. A method comprising:

generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically,

providing the map to an application for joining to event data or scoring the security state of the entities; and

enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities.

68. The method of claim 67 in which the technical assets comprise network-related information.

69. The method of any of claim 68 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements.

70. The method of claim 68 in which generating the map comprises online discovery of information about the technical assets.

71. The method of claim 70 in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or a Regional Internet Registry.

72. The method of claim 70 in which the information about the technical assets is discovered through passive DNS queries.

73. The method of claim 72 comprising identifying from the passive DNS queries associations between domain names and network addresses.

74. The method of claim 73 comprising tracking changes over time in the network addresses that are associated with a given domain name.

75. The method of claim 73 in which identifying from the passive DNS queries associations between domain names and network addresses comprises:

receiving a first domain name for an entity from the entities;

sending a first passive DNS query to identify first name servers for the first domain name;

receiving a list of the first name servers for the first domain;

sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative;

receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative;

sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names;

receiving a list of the host names and the Internet Protocol addresses for the host names; and

mapping each of the Internet Protocol addresses to an attribute for the entity.

76. The method of claim 67 comprising presenting to the user non-technical-asset information through the user interface.

77. The method of claim 76 in which the non-technical-asset information comprises information about the entities.

78. The method of claim 77 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts.

79. The method of claim 67 in which the tool enables the user to assign a technical asset to an entity.

80. The method of claim 67 comprising invoking external crowd-sourced services to aid in generating the map.

81. The method of claim 67 comprising enabling a separate review and approval of entities proposed to be included in the map.

82. The method of claim 67 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map.

83. The method of claim 67 comprising generating graphs of relationships among entities based on their associations with technical assets.

84. A method comprising:

generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically,

generating graphs of relationships among entities based on their associations with technical assets; and

enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities.

85. The method of claim 84 in which the technical assets comprise network-related information.

86. The method of any of claim 85 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements.

87. The method of claim 85 in which generating the map comprises online discovery of information about the technical assets.

88. The method of claim 85 in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or a Regional Internet Registry.

89. The method of claim 87 in which the information about the technical assets is discovered through passive DNS queries.

90. The method of claim 89 comprising identifying from the passive DNS queries associations between domain names and network addresses.

91. The method of claim 90 comprising tracking changes over time in the network addresses that are associated with a given domain name.

92. The method of claim 90 in which identifying from the passive DNS queries associations between domain names and network addresses comprises:

receiving a first domain name for an entity from the entities;

sending a first passive DNS query to identify first name servers for the first domain name;

receiving a list of the first name servers for the first domain;

sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative;

receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative;

sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names;

receiving a list of the host names and the Internet Protocol addresses for the host names; and

mapping each of the Internet Protocol addresses to an attribute for the entity.

93. The method of claim 84 comprising presenting to the user non-technical-asset information through the user interface.

94. The method of claim 93 in which the non-technical-asset information comprises information about the entities.

95. The method of claim 94 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts.

96. The method of claim 84 in which the tool enables the user to assign a technical asset to an entity.

97. The method of claim 84 comprising invoking external crowd-sourced services to aid in generating the map.

98. The method of claim 84 comprising enabling a separate review and approval of entities proposed to be included in the map.

99. The method of claim 84 comprising providing the map to an application for joining to event data or scoring the security state of the entities.

100. The method of claim 84 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map.