Method and system for dynamic and comprehensive vulnerability management

• US 9,516,064 B2
• Filed: 12/15/2015
• Issued: 12/06/2016
• Est. Priority Date: 10/14/2013
• Status: Active Grant

• Current Assignee: Intuit, Inc.
• Original Assignee: Intuit, Inc.
• Inventors: Lietz, M. Shannon, Cabrera, Luis Felipe, Nisly, Barry J., Neher, Ted R. III, Godinez, Javier, Jain, Ankur
• Primary Examiner(s): Ho, Dao
• Assistant Examiner(s): Huang, Cheng-Feng
• Application Number:
  US14/969,617
• Publication Number:
  US 20160112457A1
• Time in Patent Office: 357 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

One or more relevant scanners used to identify asset vulnerabilities are identified, obtained, and logically arranged for deployment on an asset in accordance with a vulnerability management policy and a scanner deployment policy such that the relevant scanners are deployed at, or before, a determined ideal time to minimize the resources necessary to correct the vulnerabilities, if found. The relevant scanners are then automatically deployed in accordance with the scanner deployment policy and, if a vulnerability is identified, one or more associated remedies or remedy procedures are applied to the asset. At least one of the one or more relevant scanners are then re-deployed on the asset to determine if the identified vulnerability has been corrected and, if the vulnerability is not corrected at, or before, a defined time, protective measures are automatically taken.

Claims

1. A system for dynamic and comprehensive vulnerability management comprising:

at least one processor; and

at least one memory unit coupled to the at least one processor, the at least one memory unit having stored therein instructions which when executed by any set of the one or more processors, perform a process for dynamic and comprehensive vulnerability management, the process for dynamic and comprehensive vulnerability management including;

obtaining vulnerability management data, the vulnerability management data including one or more levels of security that must be associated with one or more accounts or assets;

amending, following receiving modifications specified by one or more parties associated with an asset being managed by the vulnerability management data, the vulnerability management data;

obtaining scanner data representing one or more scanners configured to detect and monitor vulnerabilities and vulnerability characteristics reflected in the vulnerability management data, at least one scanner of the scanner data including a plurality of scanner tests configured to detect a plurality of vulnerabilities;

obtaining remedy data representing two or more remedies associated with vulnerabilities scanned for by the scanners, the two or more remedies including a first remedy of automatic re-sizing of buffers and buffer pools and a second remedy of automatic re-setting or changing a response time;

correlating the remedy data with vulnerabilities discoverable by the scanner tests;

obtaining asset data associated with an asset;

analyzing the vulnerability management data and the asset data to automatically identify a relevant scanner test in the scanner data to be applied to the asset;

determining an ideal time to deploy the relevant scanner test on the asset;

automatically deploying the relevant scanner test on the asset at, or before, the ideal time;

identifying, by the relevant scanner test, a vulnerability of the asset;

identifying a remedy in the remedy data, the identified remedy being associated with the identified vulnerability;

automatically applying the identified remedy to the asset;

automatically re-deploying the relevant scanner on the asset to determine whether the identified vulnerability is still present; and

upon a determination that the identified vulnerability is present after the identified remedy has been applied, taking protective action to mitigate the vulnerability.

2. The system for dynamic and comprehensive vulnerability management of claim 1 further wherein the one or more levels of security that must be associated with one or more accounts or assets include at least one characteristic selected from a group consisting of

multifactor authentication;

specific password lengths; and

password content.

3. The system for dynamic and comprehensive vulnerability management of claim 1 further comprising

classifying the one or more scanners according to one or more scanner characteristics;

further wherein the one or more scanner characteristics are selected from a group of scanner characteristics consisting of

a scanner type associated with the scanner;

one or more vulnerabilities scanned for by the scanner;

one or more scanner tests included in the scanner;

desirable scanning tests included in the scanner;

a deployment profile/time for the scanner;

whether the scanner is a continuously deployed scanner; and

whether the scanner is synchronous or asynchronous.

4. The system for dynamic and comprehensive vulnerability management of claim 1 further wherein

obtaining scanner data representing one or more scanners configured to detect and monitor vulnerabilities and vulnerability characteristics reflected in the vulnerability management data, at least one scanner of the scanner data including a plurality of scanner tests configured to detect a plurality of different vulnerabilities further comprises

obtaining, from a plurality of third party unrelated sources, scanner data representing one or more scanners configured to detect and monitor vulnerabilities and vulnerability characteristics reflected in the vulnerability management data, at least one scanner of the scanner data including a plurality of scanner tests configured to detect a plurality of different vulnerabilities;

determining that two or more of the scanner tests obtained from a plurality of third party unrelated sources are directed to detecting a same vulnerability;

selecting a single one of the two or more scanner tests directed to detecting the same vulnerability, the selected single scanner being a scanner test of the determined two or more scanner tests determined to yield a least number of false positive detections; and

discarding nonselected tests of the two or more scanner tests directed to detecting the same vulnerability and employing the selected scanner test.

5. The system for dynamic and comprehensive vulnerability management of claim 1 wherein at least one of the vulnerabilities discoverable by the one or more scanner tests are vulnerabilities included in the group of vulnerabilities consisting of:

the existence of a known weakness pattern in the asset;

an incorrect buffer length;

the inability of the asset to patch correctly;

a lack of security requirements, or insufficient security requirements associated with the asset;

the existence of a known vulnerable version of software or code;

code written in a language, or version of a language, known to be vulnerable to attack;

lack of encryption, or the proper level of encryption;

no checks of buffer lengths;

no checks of the integrity of arguments; and

any combination thereof.

6. The system for dynamic and comprehensive vulnerability management of claim 1 wherein at least one of the remedies associated with vulnerabilities discoverable by the scanner tests is selected from the group of remedies consisting of:

automatic application of a software patch;

automatic installation of a software version update;

automatic deletion of an asset component;

automatic replacement of an asset component;

automatic notification of a contact entity associated with the asset of the vulnerability and the need to correct the vulnerability;

an automatic change to a configuration;

automatic re-sizing of buffers and buffer pools;

automatic re-setting or changing a response time; and

any combination thereof.

7. The system for dynamic and comprehensive vulnerability management of claim 1 wherein at least one of the one or more assets is selected from the group of assets consisting of:

a file;

an application development process;

an application;

a virtual machine;

an instance in a cloud infrastructure;

storage capability allocated to an instance in a cloud infrastructure;

processing capability allocated to an instance in a cloud infrastructure;

hardware allocated to an instance in a cloud infrastructure;

software allocated to an instance in a cloud infrastructure;

a cloud infrastructure access system; and

any combination thereof.

8. The system for dynamic and comprehensive vulnerability management of claim 1 wherein the ideal time to deploy the relevant scanner test on the asset is determined based on deploying the relevant scanner test at a time where minimum resources are required to correct the vulnerability the scanner test is configured to detect.

9. The system for dynamic and comprehensive vulnerability management of claim 1 wherein the protective action taken is selected from the group of protective actions consisting of:

closing one or more accounts associated with the asset;

closing down a service that is the asset or is associated with the asset;

closing down an instance that is the asset or is associated with the asset;

destroying a data store that is the asset or is associated with the asset;

blocking Internet access to the asset;

closing down any communication channels that are the asset or are associated with the asset;

upgrading the asset;

replacing the asset; and

any combination thereof.

10. A system for dynamic and comprehensive vulnerability management comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for dynamic and comprehensive vulnerability management, the process for dynamic and comprehensive vulnerability management including;

obtaining vulnerability management data representing one or more vulnerability management policies, vulnerabilities, and vulnerability characteristics to be monitored, the vulnerability management data including one or more levels of security that must be associated with one or more accounts or assets;

amending, following receiving modifications specified by one or more parties associated with an asset being managed by the vulnerability management data, the vulnerability management data;

obtaining scanner data representing one or more scanners configured to detect and monitor vulnerabilities and vulnerability characteristics reflected in the vulnerability management data, at least one scanner of the scanner data including a plurality of scanner tests configured to detect a plurality of vulnerabilities;

classifying the one or more scanners and identifying duplicate scanner tests;

storing the scanner data and scanner classification data in a scanner database;

obtaining remedy data representing two or more remedies or remedy procedures associated with vulnerabilities scanned for by the one or more scanner tests, the two or more remedies including a first remedy of automatic re-sizing of buffers and buffer pools and a second remedy of automatic re-setting or changing a response time;

correlating the remedy data with the scanner data and the vulnerabilities scanned for by the one or more scanner tests;

obtaining asset data associated with an asset indicating an asset type and operational characteristics associated with the asset;

analyzing the asset data to identify asset vulnerability characteristics data associated with the asset;

analyzing the vulnerability management data and the vulnerability characteristics data associated with the asset to automatically select one or more relevant scanner tests represented in the scanner data to be applied to the asset;

generating scanner deployment procedure data indicating when the one or more relevant scanner tests are to be applied to the asset;

automatically applying the one or more relevant scanner tests to the asset in accordance with the scanner deployment procedure data;

de-duplicating results data received from the one or more relevant scanner tests;

determining whether a vulnerability is indicated in the de-duplicated results data from the one or more relevant scanner tests;

upon a determination that a vulnerability is indicated in the de-duplicated results data from the one or more relevant scanner tests, automatically identifying the remedy or remedy procedure associated with the identified vulnerability in the remedy data;

automatically implementing the identified remedy or remedy procedure;

automatically re-deploying at least the scanner tests associated with the identified vulnerability to the asset to determine whether the identified vulnerability has been corrected; and

upon a determination that the identified vulnerability is present after the remedy or remedy procedure associated with the identified vulnerability has been applied, or after a defined vulnerability correction time period has elapsed, automatically taking protective action to mitigate the vulnerability.

11. The system for dynamic and comprehensive vulnerability management of claim 10 further wherein the one or more levels of security that must be associated with one or more accounts or assets include at least one characteristic selected from a group consisting of

multifactor authentication;

specific password lengths; and

password content.

12. The system for dynamic and comprehensive vulnerability management of claim 10 wherein

the one or more scanners are classified according to one or more scanner characteristics;

further wherein the one or more scanner characteristics are selected from a group of scanner characteristics consisting of

a scanner type associated with the scanner;

one or more vulnerabilities scanned for by the scanner,

one or more scanner tests included in the scanner;

desirable scanning tests included in the scanner;

a deployment profile/time for the scanner;

whether the scanner is a continuously deployed scanner; and

whether the scanner is synchronous or asynchronous.

13. The system for dynamic and comprehensive vulnerability management of claim 10 wherein at least one of the vulnerabilities discoverable by the one or more scanner tests are vulnerabilities included in the group of vulnerabilities consisting of:

the existence of a known weakness pattern in the asset;

an incorrect buffer length;

the inability of the asset to patch correctly;

a lack of security requirements, or insufficient security requirements associated with the asset;

the existence of a known vulnerable version of software or code;

code written in a language, or version of a language, known to be vulnerable to attack;

lack of encryption, or the proper level of encryption;

no checks of buffer lengths;

no checks of the integrity of arguments; and

any combination thereof.

14. The system for dynamic and comprehensive vulnerability management of claim 10 wherein at least one of the one or more remedies associated with vulnerabilities scanned for by the one or more scanner tests is selected from the group of remedies consisting of:

automatic application of a software patch;

automatic installation of a software version update;

automatic deletion of an asset component;

automatic replacement of an asset component;

an automatic change to a configuration;

automatic re-sizing of buffers and buffer pools;

automatic re-setting or changing a response time; and

any combination thereof.

15. The system for dynamic and comprehensive vulnerability management of claim 10 wherein at least one of the one or more remedy procedures associated with vulnerabilities scanned for by the one or more scanner tests includes providing a contact entity associated with the asset information indicating the identified vulnerability, a vulnerability correction time period, and that once the vulnerability correction time period has elapsed, protective action will automatically be taken.

16. The system for dynamic and comprehensive vulnerability management of claim 10 wherein at least one of the one or more assets is selected from the group of assets consisting of:

an application development process;

a file;

an application;

a virtual machine;

an instance in a cloud infrastructure;

storage capability allocated to an instance in a cloud infrastructure;

processing capability allocated to an instance in a cloud infrastructure;

hardware allocated to an instance in a cloud infrastructure;

software allocated to an instance in a cloud infrastructure;

a cloud infrastructure access system;

and

any combination thereof.

17. The system for dynamic and comprehensive vulnerability management of claim 10 wherein the asset data is obtained from an asset management system associated with the asset.

18. The system for dynamic and comprehensive vulnerability management of claim 10 wherein generating scanner deployment procedure data includes generating scanner deployment pipeline data indicating the ideal stage or time to deploy each of the relevant scanner tests on the asset to minimize the resources required to correct the vulnerability being scanned for, and/or to minimize the chance of the vulnerability becoming a chained vulnerability.

19. The system for dynamic and comprehensive vulnerability management of claim 10 wherein the protective action taken is selected from the group of protective actions consisting of:

closing one or more accounts associated with the asset;

closing down a service that is the asset or is associated with the asset;

closing down an instance that is the asset or is associated with the asset;

destroying a data store that is the asset or is associated with the asset;

blocking Internet access to the asset;

closing down any communication channels that are the asset or are associated with the asset;

upgrading the asset;

replacing the asset; and

any combination thereof.

20. A system for dynamic and comprehensive application development process vulnerability management comprising:

at least one processor; and

at least one memory unit coupled to the at least one processor, the at least one memory unit having stored therein instructions which when executed by any set of the one or more processors, perform a process for dynamic and comprehensive vulnerability management, the process for dynamic and comprehensive vulnerability management including;

obtaining vulnerability management data representing one or more vulnerability management policies, vulnerabilities, and vulnerability characteristics to be monitored, the vulnerability management data including one or more levels of security that must be associated with one or more accounts or assets;

amending, following receiving modifications specified by one or more parties associated with an asset being managed by the vulnerability management data, the vulnerability management data;

obtaining scanner data representing one or more scanners, each of the scanners including one or more scanner tests for detecting a vulnerability in an asset associated with an application development process, at least one scanner of the scanner data including a plurality of scanner tests configured to detect a plurality of vulnerabilities;

classifying the one or more scanners and identifying duplicate scanner tests;

storing the scanner data and scanner classification data in a scanner database;

obtaining remedy data representing two or more remedies or remedy procedures associated with vulnerabilities scanned for by the one or more scanner tests, the two or more remedies including a first remedy of automatic re-sizing of buffers and buffer pools and a second remedy of automatic re-setting or changing a response time;

correlating the remedy data with the scanner data and the vulnerabilities scanned for by the one or more scanner tests;

obtaining asset data associated with one or more assets used by the application development process indicating asset types and operational characteristics associated with the assets;

analyzing the asset data to identify asset vulnerability characteristics data associated with the assets indicating potential vulnerabilities associated with application development process;

analyzing the vulnerability management data and the vulnerability characteristics data associated with the assets to select one or more relevant scanner tests in the scanner data to be applied to the application development process;

generating scanner deployment procedure data indicating what stage in the application development process the one or more relevant scanner tests are to be applied;

automatically applying the one or more relevant scanner tests to the assets associated with the application development process in accordance with the scanner deployment procedure data;

de-duplicating results data received from the one or more relevant scanner tests;

identifying, by the relevant scanner test, a vulnerability of the asset;

identifying a remedy in the remedy data, the identified remedy being associated with the identified vulnerability;

automatically implementing the identified remedy or remedy procedure;

automatically re-deploying at least one scanner test associated with the identified vulnerability to determine whether the identified vulnerability has been corrected; and

upon a determination that the identified vulnerability is present after the remedy or remedy procedure associated with the identified vulnerability has been applied, or after a defined vulnerability correction time period has elapsed, automatically taking protective action to mitigate the vulnerability.

21. The system for dynamic and comprehensive vulnerability management of claim 20 further wherein the one or more levels of security that must be associated with one or more accounts or assets include at least one characteristic selected from a group consisting of

multifactor authentication;

specific password lengths; and

password content.

22. The system for dynamic and comprehensive vulnerability management of claim 20 further wherein

obtaining scanner data representing one or more scanners configured to detect and monitor vulnerabilities and vulnerability characteristics reflected in the vulnerability management data, at least one scanner of the scanner data including a plurality of scanner tests configured to detect a plurality of different vulnerabilities further comprises

obtaining, from a plurality of third party unrelated sources, scanner data representing one or more scanners configured to detect and monitor vulnerabilities and vulnerability characteristics reflected in the vulnerability management data, at least one scanner of the scanner data including a plurality of scanner tests configured to detect a plurality of different vulnerabilities;

determining that two or more of the scanner tests obtained from a plurality of third party unrelated sources are directed to detecting a same vulnerability;

selecting a single one of the two or more scanner tests directed to detecting the same vulnerability, the selected single scanner being a scanner test of the determined two or more scanner tests determined to yield the least number of false positive detections; and

discarding nonselected tests of the two or more scanner tests directed to detecting the same vulnerability and employing the selected scanner test.

23. The system for dynamic and comprehensive vulnerability management of claim 20 wherein the one or more scanners are classified according to at least one scanner classification parameter selected from the group of scanner classification parameters consisting of:

the scanner type;

the vulnerabilities scanned for by the scanner tests included in the scanner;

the desired scanning test included in the scanner;

the deployment profile/time for the scanner;

whether the scanner is a continuously deployed scanner or another type of scanner;

whether the scanner is synchronous or asynchronous; and

any combination thereof.

24. The system for dynamic and comprehensive vulnerability management of claim 20 wherein at least one of the vulnerabilities discoverable by the one or more scanner tests are vulnerabilities included in the group of vulnerabilities consisting of:

the existence of a known weakness pattern in the asset;

a non-existent or incorrect buffer length;

inserting the inability of the asset to patch correctly;

a lack of security requirements, or insufficient security requirements associated with the asset;

the existence of a known vulnerable version of software or code;

code written in a language, or version of a language, known to be vulnerable to attack;

lack of encryption, or the proper level of encryption;

no checks of buffer lengths;

no checks of the integrity of arguments; and

any combination thereof.

25. The system for dynamic and comprehensive vulnerability management of claim 20 wherein at least one of the one or more remedies associated with vulnerabilities scanned for by the one or more scanner tests is selected from the group of remedies consisting of:

automatic application of a software patch;

automatic installation of a software version update;

automatic deletion of an asset component;

automatic replacement of an asset component;

an automatic change to a configuration;

automatic re-sizing of buffers and buffer pools;

automatic re-setting or changing a response time; and

any combination thereof.

26. The system for dynamic and comprehensive vulnerability management of claim 20 wherein at least one of the one or more remedy procedures associated with vulnerabilities scanned for by the one or more scanner tests includes providing a contact entity associated with the application development process information indicating the identified vulnerability, a vulnerability correction time period, and that once the vulnerability correction time period has elapsed, protective action to mitigate the vulnerability will automatically be taken.

27. The system for dynamic and comprehensive vulnerability management of claim 20 wherein at least one of the one or more assets associated with the application development process is selected from the group of assets consisting of:

a virtual machine;

an instance in a cloud infrastructure;

storage capability allocated to an instance in a cloud infrastructure;

processing capability allocated to an instance in a cloud infrastructure;

hardware allocated to an instance in a cloud infrastructure;

software allocated to an instance in a cloud infrastructure;

a cloud infrastructure access system; and

any combination thereof.

28. The system for dynamic and comprehensive vulnerability management of claim 20 wherein the asset data is obtained from an asset management system associated with the application development process.

29. The system for dynamic and comprehensive vulnerability management of claim 20 wherein generating scanner deployment procedure data includes generating scanner deployment pipeline data indicating the ideal stage in the application development process to deploy each of the relevant scanner tests in order to minimize the resources required to correct the vulnerability being scanned for, and/or to minimize the chance of the vulnerability becoming a chained vulnerability.

30. The system for dynamic and comprehensive vulnerability management of claim 20 wherein the protective action is selected from the group of protective actions consisting of:

closing one or more accounts associated with the asset and/or the application development process;

closing down a service that is the asset or is associated with the application development process;

closing down an instance that is the asset or is associated with the application development process;

destroying a data store that is the asset or is associated with the application development process;

blocking Internet access to an asset associated with the application development process;

closing down any communication channels that are the asset or are associated with the application development process;

upgrading an asset associated with the application development process;

replacing an asset associated with the application development process; and

any combination thereof.