Cloud-based security profiling, threat analysis and intelligence

• US 9,900,339 B2
• Filed: 02/27/2017
• Issued: 02/20/2018
• Est. Priority Date: 09/12/2014
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Bach, Timothy, Dolph, James
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US15/442,986
• Publication Number:
  US 20170180410A1
• Time in Patent Office: 358 Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

An automated software vulnerability scanning and notification system and method provide an automated detection and notification regarding a software vulnerability. The operation of the system and the method includes obtaining software vulnerability information, periodically scanning a web application and a corresponding web server associated with an operator, and evaluating the periodic scans relative to the software vulnerability information to detect software vulnerabilities. Upon detection of a software vulnerability, a notification message is provided automatically to the operator regarding the software vulnerability.

Claims

1. An apparatus to identify a software vulnerability, comprising:

a processor; and

one or more stored sequences of instructions which, when executed by the processor, cause the processor to;

identify software vulnerability information;

periodically scan at least one of a network application and a network server for information about software associated with the network application and the network server and for information about upgraded versions of the software;

store the information about the software and the upgraded versions of the software, the information including information for versions of the software with undetected vulnerabilities; and

periodically evaluate the information about the software and the upgraded versions of the software relative to the software vulnerability information to detect a software vulnerability in at least one of the software and upgraded versions of the software;

provide a notification message to a user device regarding the software vulnerability; and

provide with the notification message steps for remediation or protection against the software vulnerability.

2. The apparatus of claim 1 in which the one or more stored sequences of instructions which, when executed by the processor, cause the processor to receive information through a user interface that includes the software vulnerability information.

3. The apparatus of claim 1 further including one or more stored sequences of instructions which, when executed by the processor, cause the processor to store each periodic scan of the network application and network server.

4. The apparatus of claim 1 in which the one or more stored sequences of instructions which, when executed by the processor, cause the processor to periodically scan both the network application and the network server on which the network application runs.

5. The apparatus of claim 1 in which the one or more stored sequences of instructions which, when executed by the processor, cause the processor to access a database to identify the software vulnerability information.

6. The apparatus of claim 1 further comprising:

multiple scanners each including processors and one or more stored sequences of instructions which, when executed by the processors, cause the processors to;

periodically scan different network applications and network servers for information about software, and upgraded versions of the software, associated with the different network application and network servers; and

store the information about the software and the upgraded versions of the software.

7. A non-transitory machine-readable medium carrying one or more sequences of instructions, when executed by one or more processors, cause the one or more processors to perform operations comprising:

obtaining software vulnerability information;

periodically scanning at least one of a web application and a web server for information about types and versions of software associated with the at least one web application and web server, wherein the at least one web application and web server operate within a cloud-based database system;

storing multiple ones of the periodically scanned information to provide a history of the types and versions of the software associated with the at least one web application and web server including the types and versions of the software with undetected or undisclosed vulnerabilities;

periodically evaluating the stored multiple ones of the periodically scanned information relative to the software vulnerability information to detect software vulnerabilities in the types and versions of the software; and

upon detection of a software vulnerability, providing a notification message regarding the software vulnerability.

8. The machine-readable medium of claim 7 in which the one or more sequences of instructions, when executed by one or more processors, cause the one or more processors to provide with the notification message performance information associated with the at least one web application and web server.

9. The machine-readable medium of claim 7 in which the one or more sequences of instructions, when executed by one or more processors, cause the one or more processors to perform operations comprising receiving user inputs including at least some of the software vulnerability information.

10. The machine-readable medium of claim 7 in which the one or more sequences of instructions, when executed by one or more processors, cause the one or more processors to perform operations comprising providing the notification message to a network portal.

11. The apparatus of claim 7 further including one or more sequences of instructions, when executed by one or more processors, cause the one or more processors to perform operations comprising storing the information for each periodic scan of the web application and web server.

12. The machine-readable medium of claim 7 wherein different processors in different scanners each periodically scan different web applications and web servers for information about types and versions of software associated with the different web applications and web servers.

13. A method for identifying a software vulnerability, comprising:

obtaining, by a processor, software vulnerability information;

periodically scanning, by the processor, a cloud-based database system for information about types and versions of software and information about upgraded types and versions of the software;

storing, by the processor, each of the scanned information, including types and versions of the software with undetected or undisclosed vulnerabilities;

periodically evaluating, by the processor, the stored information, including previously scanned and stored information, relative to the software vulnerability information to detect software vulnerabilities; and

upon detection of a software vulnerability, by the processor, providing a notification message regarding the software vulnerability.

14. The method of claim 13 further comprising providing performance or usage information for the software with the notification message.

15. The method of claim 13 further comprising receiving the software vulnerability information from a user system.

16. The method of claim 13 further comprising storing the scanned information for each periodic scan of the cloud-based database system.