System and method for grouping computer vulnerabilities

• US 9,811,667 B2
• Filed: 09/21/2011
• Issued: 11/07/2017
• Est. Priority Date: 09/21/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hugard, IV, James M., Leroux, Alexander Lawrence, Mallabarapu, Charles, Muniz, Jorge Armando, Russell, Braden C., Wu, Zengjue
• Primary Examiner(s): DOAN, TRANG T
• Application Number:
  US13/239,271
• Publication Number:
  US 20130247206A1
• Time in Patent Office: 2,239 Days
• Field of Search: None
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method in one embodiment includes modules for creating a vulnerability set including one or more vulnerabilities, adding the vulnerability set to a program, and updating the program by adding a new vulnerability to the vulnerability set. More specific embodiments include a program that includes a scan, creating the vulnerability set by generating a query including one or more conditions associated with the vulnerabilities, and creating the vulnerability set by selecting one or more vulnerabilities from a plurality of vulnerabilities. Other embodiments include a program that includes a report template, adding a vulnerability set to the report template by generating a query to include a condition associated with the vulnerability set, running a scan, and generating a report including one or more results from the scan meeting the condition associated with the vulnerability set.

Claims

1. A method comprising:

providing a query including at least one condition defining at least one vulnerability, the query to be displayed by a graphical user interface (GUI) of a computer that includes a processor;

creating a vulnerability set based on the query;

adding the vulnerability set to a program;

running the query upon execution of the program to dynamically select one or more vulnerability checks to apply to one or more assets in a network, wherein the at least one condition in the query indicates a level of severity of vulnerabilities, and wherein a vulnerability check is selected for the program based, at least in part, on one or more vulnerabilities associated with the vulnerability check meeting the level of severity indicated by the at least one condition;

updating the program by updating the query to add at least one other condition defining at least one other vulnerability and running the updated query upon a subsequent execution of the program;

producing scan results based on the subsequent execution of the program; and

generating an asset report that includes data based on the scan results indicating a vulnerability of at least one asset of the one or more assets.

2. The method of claim 1, wherein the subsequent execution of the program comprises identifying the vulnerability of the at least one asset indicated in the asset report.

3. The method of claim 1, wherein the program comprises a report template.

4. The method of claim 1, further comprising:

running a second program comprising the vulnerability set; and

generating a report, such that the report comprises at least one result from the second program meeting the at least one condition associated with the vulnerability set.

5. The method of claim 1, wherein:

the creating the vulnerability set comprises generating the query including the at least one condition associated with the at least one vulnerability; and

the updating the query comprises generating the updated query including the at least one other condition associated with the at least one other vulnerability.

6. The method of claim 5, wherein the at least one condition is selected from a group comprising a vulnerability module, a vulnerability category, a Common Vulnerabilities and Exposures (CVE) Number, a Common Weakness Enumeration (CWE), an intrusive check, a Microsoft (MS) Number, a risk, a vulnerability name, and a vulnerability severity.

7. The method of claim 1, wherein the query further comprises a nested condition expression using at least one operator selected from a group comprising AND, OR, Equals (EQ), Not Equals (NE), Greater Than (GT), Less Than (LT), Contains, Does not Contain, Greater Than or Equal (GE), and Less Than or Equal (LE).

8. The method of claim 1, wherein the creating the vulnerability set comprises selecting the at least one vulnerability from a plurality of vulnerabilities.

9. An apparatus comprising:

a memory element configured to store data; and

a processor operable to execute instructions associated with the data, wherein the apparatus is configured for;

providing a query including at least one condition defining at least one vulnerability, the query to be displayed by a graphical user interface (GUI) of a computer that includes the processor;

creating a vulnerability set based on the query;

adding the vulnerability set to a program;

running the query upon execution of the program to dynamically select one or more vulnerability checks to apply to one or more assets in a network, wherein the at least one condition in the query indicates a level of severity of vulnerabilities, and wherein a vulnerability check is selected for the program based, at least in part, on one or more vulnerabilities associated with the vulnerability check meeting the level of severity indicated by the at least one condition;

updating the program by updating the query to add at least one other condition defining at least one other vulnerability and running the updated query upon a subsequent execution of the program;

producing scan results based on the subsequent execution of the program; and

generating an asset report that includes data based on the scan results indicating a vulnerability of at least one asset of the one or more assets.

10. The apparatus of claim 9, wherein the subsequent execution of the program comprises identifying the vulnerability of the at least one asset indicated in the asset report.

11. The apparatus of claim 9, wherein:

the program comprises a report template; and

wherein the apparatus is configured for generating the query to include the at least one condition associated with the vulnerability set.

12. The apparatus of claim 11, further comprising:

running a second program comprising the vulnerability set; and

generating a report, such that the report comprises at least one result from the second program meeting the at least one condition associated with the vulnerability set.

13. The apparatus of claim 9, wherein:

the creating the vulnerability set comprises generating the query including the at least one condition associated with the at least one vulnerability; and

the updating the query comprises generating the updated query including the at least one other condition associated with the at least one other vulnerability.

14. The apparatus of claim 9, wherein creating the vulnerability set comprises selecting the at least one vulnerability from a plurality of vulnerabilities.

15. One or more non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

providing a query including at least one condition defining at least one vulnerability, the query to be displayed by a graphical user interface (GUI) of a computer that includes the processor;

creating a vulnerability set based on the query;

adding the vulnerability set to a program;

running the query upon execution of the program to dynamically select one or more vulnerability checks to apply to one or more assets in a network, wherein the at least one condition in the query indicates a level of severity of vulnerabilities, and wherein a vulnerability check is selected for the program based, at least in part, on one or more vulnerabilities associated with the vulnerability check meeting the level of severity indicated by the at least one condition;

updating the program by updating the query to add at least one other condition defining at least one other vulnerability and running the updated query upon a subsequent execution of the program;

producing scan results based on the subsequent execution of the program; and

generating an asset report that includes data based on the scan results indicating a vulnerability of at least one of the one or more assets.

16. The one or more non-transitory media of claim 15, wherein the subsequent execution of the program comprises identifying the vulnerability of the at least one asset indicated in the asset report.

17. The one or more non-transitory media of claim 15, wherein:

the program comprises a report template; and

the code, when executed by the processor, is operable to perform further operations comprising generating the query to include the at least one condition associated with the vulnerability set.

18. The one or more non-transitory media of claim 17, wherein the code, when executed by the processor, is operable to perform further operations comprising:

running a second program comprising the vulnerability set; and

generating a report, such that the report comprises at least one result from the second program meeting the at least one condition associated with the vulnerability set.

19. The one or more non-transitory media of claim 15, wherein:

the creating the vulnerability set comprises generating the query including the at least one condition associated with the at least one vulnerability; and

the updating the query comprises generating the updated query including the at least one other condition associated with the at least one other vulnerability.