Computer program product and apparatus for multi-path remediation

• US 10,021,124 B2
• Filed: 08/03/2015
• Issued: 07/10/2018
• Est. Priority Date: 07/01/2003
• Status: Expired due to Fees

• Current Assignee: SecurityProfiling, LLC
• Original Assignee: SecurityProfiling, LLC
• Inventors: Oliphant, Brett M., Blignaut, John P.
• Primary Examiner(s): Herzog, Madhuri
• Application Number:
  US14/816,960
• Publication Number:
  US 20160036846A1
• Time in Patent Office: 1,072 Days
• Field of Search: 726 1, 726 11- 14, 726 22- 25, 713187-188
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system, method, and computer program product are provided for a database associating a plurality of device vulnerabilities to which computing devices can be subject with a plurality of remediation techniques that collectively remediate the plurality of device vulnerabilities. Each of the device vulnerabilities is associated with at least one remediation technique. Each remediation technique associated with a particular device vulnerability remediates that particular vulnerability. Further, each remediation technique has a remediation type are selected from the type group consisting of patch, policy setting, and configuration option. Still yet, a first one of the device vulnerabilities is associated with at least two alternative remediation techniques.

Claims

1. An apparatus, comprising:

at least one data storage; and

at least one platform communicatively coupled to the at least one data storage;

said at least one data storage configured to store data on a plurality of mitigation techniques that mitigate effects of attacks that take advantage of vulnerabilities, where;

each mitigation technique is capable of mitigating an effect of an attack that takes advantage of a corresponding vulnerability, and

each mitigation technique has a mitigation type including at least one of a patch, a policy setting, or a configuration option;

said at least one platform configured to;

cause display of at least one mitigation technique for mitigating an effect of at least one attack that takes advantage of at least one vulnerability, and

allow receipt of user input for selecting the at least one mitigation technique to be applied for mitigating the effect of the at least one attack that takes advantage of the at least one vulnerability;

said apparatus configured to identify information in connection with at least one of a plurality of devices for use in identifying an attack in connection with the at least one device that takes advantage of the at least one vulnerability so that the at least one mitigation technique is utilized in at least mitigating an effect of the identified attack;

said apparatus configured such that one or more of the plurality of mitigation techniques is capable of being identified based on an identification of an operating system.

2. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including a firewall option for preventing at least one attack packet of the attack by terminating or dropping the at least one attack packet, and an intrusion detection or prevention option;

the apparatus is further configured such that, in response to first user input received prior to the attack, the firewall option is capable of being applied to a plurality of different devices for preventing the at least one attack packet at any of the different devices; and

the apparatus is further configured such that, in response to additional user input after the attack in connection with a particular single device of the plurality of different devices, the intrusion detection or prevention option is capable of being applied to the particular single device.

3. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including a firewall option for preventing at least one attack packet of the attack by terminating or dropping the at least one attack packet, and an intrusion detection or prevention option;

the apparatus is further configured such that, in response to first user input prior to the attack, the intrusion detection or prevention option is capable of being applied to a plurality of different devices at the plurality of different devices; and

the apparatus is further configured such that, in response to second user input after the attack in connection with a particular single device of the plurality of different devices, the firewall option is capable of being applied to the particular single device for preventing the at least one attack packet at the particular single device.

4. The apparatus of claim 1, wherein the apparatus is configured such that the one or more of the plurality of mitigation techniques is capable of being identified based on the identification of the operating system in connection with the displaying of the at least one mitigation technique, so that, in order to avoid false positives, relevant vulnerabilities prompt mitigation technique user selection among at least two of the mitigation techniques, which involve both firewall and intrusion prevention system actions, for providing diverse mitigation options in connection with the relevant vulnerabilities.

5. The apparatus of claim 1, wherein the apparatus is configured such that the one or more of the plurality of mitigation techniques is capable of being identified based on the identification of the operating system prior to causing the display of the at least one mitigation technique, so that which of the one or more of the mitigation techniques that is caused to be displayed is based on one or more actual vulnerabilities to which the at least one device is actually vulnerable so that only relevant one or more mitigation techniques are displayed for selection by a user for attack mitigation.

6. The apparatus of claim 1, wherein the apparatus is configured such that the user input is capable of being received via at least one user interface of the at least one platform for different devices, for allowing different attack mitigation actions including at least one intrusion prevention action and at least one firewall action to be selectively applied to the different devices for different actual vulnerabilities determined to be actually relevant based on the identification of the operating system in connection with the different devices.

7. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including a first mitigation technique that utilizes a firewall action and a second mitigation technique that utilizes an intrusion prevention action.

8. The apparatus of claim 7, wherein the apparatus is configured such that different user input is capable of being received via the at least one platform for different devices, for allowing different mitigation techniques including the first mitigation technique and the second mitigation technique to be selectively applied by a user to the different devices for different actual vulnerabilities, such that the different user input is capable of resulting in:

only the first mitigation technique being selectively applied by the user to at least one first device, only the second mitigation technique being selectively applied by the user to at least one second device, and both the first mitigation technique and the second mitigation technique being selectively applied by the user to at least one third device.

9. The apparatus of claim 7, wherein the apparatus is configured such that the at least one mitigation technique further includes a third mitigation technique that utilizes a policy compliance action, wherein the apparatus is configured such that different user input is capable of being received via the at least one platform for different devices, for allowing different mitigation techniques including the first mitigation technique, the second mitigation technique, and the third mitigation technique to be selectively applied by a user to the different devices for different actual vulnerabilities, such that the different user input is capable of resulting in:

only the first mitigation technique being selectively applied by the user to at least one first device;

only the second mitigation technique being selectively applied by the user to at least one second device; and

the first mitigation technique, the second mitigation technique, and the third mitigation technique being selectively applied by the user to at least one third device.

10. The apparatus of claim 7, wherein the apparatus is configured such that the first mitigation technique is automatically applied utilizing a first communication from an integrated firewall/intrusion prevention system platform component of the at least one platform to firewall-supporting code, and the second mitigation technique is automatically applied utilizing a second communication from the integrated firewall/intrusion prevention system platform component of the at least one platform to intrusion prevention system-supporting code, where the firewall-supporting code and the intrusion prevention system-supporting code are part of a single agent.

11. The apparatus of claim 1, wherein the apparatus is configured such that the identification of the operating system is a result of a vulnerability assessment scan caused by the at least one platform.

12. The apparatus of claim 1, wherein the at least one platform includes intrusion prevention functionality for supporting a first mitigation technique and firewall functionality for supporting a second mitigation technique, the at least one platform further capable of receiving actual vulnerability information to conditionally display, as a function of an existence of one or more actual vulnerabilities, one or more of the plurality of mitigation techniques to allow selective utilization of the intrusion prevention functionality and the firewall functionality, so that only relevant mitigation techniques are displayed for selection to reduce false positives in connection with both the intrusion prevention functionality and the firewall functionality.

13. The apparatus of claim 1, wherein the at least one platform utilizes router-based functionality for supporting a first mitigation technique and firewall functionality for supporting a second mitigation technique.

14. The apparatus of claim 13, wherein the apparatus is configured for receiving actual vulnerability information to conditionally display, as a function of an existence of one or more actual vulnerabilities, one or more of the plurality of mitigation techniques to allow selective utilization of the router-based functionality and the firewall functionality, so that only relevant mitigation techniques are displayed for selection to reduce false positives in connection with both the router-based functionality and the firewall functionality.

15. The apparatus of claim 1, wherein at least one of:

said at least one data storage includes at least one database;

said at least one data storage is accessed utilizing an operation including at least one of;

receiving at least one update therefrom;

pulling at least one update therefrom, communicating therewith, or synchronizing therewith;

said mitigation techniques include remediation techniques;

each mitigation technique has a mitigation type including the patch;

each mitigation technique has a mitigation type including the policy setting;

each mitigation technique has a mitigation type including the configuration option;

each mitigation technique is capable of mitigating the effect of the attack that takes advantage of the corresponding vulnerability, by dropping packets associated with the attack or removing the corresponding vulnerability;

said information is capable of being used to determine an intended destination of a connection request;

or

said information includes a vulnerability identifier;

wherein the apparatus is operable for use with at least one network operations center (NOC) server, a data warehouse, and a software development kit (SDK) for allowing access to information associated with at least one vulnerability and at least one remediation technique; and

wherein the apparatus is operable for determining which devices have vulnerabilities by directly querying a firmware or operating system of the devices.

23. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including an intrusion detection or prevention system option and a patch option;

the apparatus is further configured such that, in response to first user input received prior to the attack, the intrusion detection or prevention system option is capable of being applied to a plurality of different devices for preventing at least one attack packet at any of the different devices; and

the apparatus is further configured such that, in response to additional user input after the attack in connection with a particular single device of the plurality of different devices, the patch option is capable of being applied to the particular single device.

24. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including an intrusion detection or prevention system option and a patch option;

the apparatus is further configured such that, in response to first user input prior to the attack, the patch option is capable of being applied to a plurality of different devices at the plurality of different devices;

and the apparatus is further configured such that, in response to second user input after the attack in connection with a particular single device of the plurality of different devices, the intrusion detection or prevention system option is capable of being applied to the particular single device for preventing at least one attack packet at the particular single device.

25. The apparatus of claim 1, wherein the apparatus is configured such that the one or more of the plurality of mitigation techniques is capable of being identified based on the identification of the operating system in connection with the displaying of the at least one mitigation technique, so that, in order to avoid false positives, relevant vulnerabilities prompt mitigation technique user selection among at least two of the mitigation techniques, which involve both patch and intrusion detection or prevention system actions, for providing diverse mitigation options in connection with the relevant vulnerabilities.

26. The apparatus of claim 1, wherein the apparatus is configured such that the user input is capable of being received via at least one user interface of the at least one platform for different devices, for allowing different attack mitigation actions including at least one patch action and at least one intrusion detection or prevention system action to be selectively applied to the different devices for different actual vulnerabilities determined to be actually relevant based on the identification of the operating system in connection with the different devices.

27. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including a first mitigation technique that utilizes an intrusion detection or prevention system action and a second mitigation technique that utilizes a patch action.

28. The apparatus of claim 27, wherein the apparatus is configured such that different user input is capable of being received via the at least one platform for different devices, for allowing different mitigation techniques including the first mitigation technique and the second mitigation technique to be selectively applied by a user to the different devices for different actual vulnerabilities, such that the different user input is capable of resulting in:

only the first mitigation technique being selectively applied by the user to at least one first device, only the second mitigation technique being selectively applied by the user to at least one second device, and both the first mitigation technique and the second mitigation technique being selectively applied by the user to at least one third device.

29. The apparatus of claim 27, wherein the apparatus is configured such that the at least one mitigation technique further includes a third mitigation technique that utilizes a policy compliance action, wherein the apparatus is configured such that different user input is capable of being received via the at least one platform for different devices, for allowing different mitigation techniques including the first mitigation technique, the second mitigation technique, and the third mitigation technique to be selectively applied by a user to the different devices for different actual vulnerabilities, such that the different user input is capable of resulting in:

only the first mitigation technique being selectively applied by the user to at least one first device;

only the second mitigation technique being selectively applied by the user to at least one second device; and

the first mitigation technique, the second mitigation technique, and the third mitigation technique being selectively applied by the user to at least one third device.

30. The apparatus of claim 27, wherein the apparatus is configured such that the first mitigation technique is automatically applied utilizing a first communication from an integrated intrusion detection or prevention system/patch platform component of the at least one platform to intrusion detection or prevention system-supporting code, and the second mitigation technique is automatically applied utilizing a second communication from the integrated intrusion detection or prevention system/patch platform component of the at least one platform to patch-supporting code, where the intrusion detection or prevention system- supporting code and the patch-supporting code are part of a single agent.

31. The apparatus of claim 1, wherein the at least one platform includes patch functionality for supporting a first mitigation technique and intrusion detection or prevention system functionality for supporting a second mitigation technique, the at least one platform further capable of receiving actual vulnerability information to conditionally display, as a function of an existence of one or more actual vulnerabilities, one or more of the plurality of mitigation techniques to allow selective utilization of the patch functionality and the intrusion detection or prevention system functionality, so that only relevant mitigation techniques are displayed for selection to reduce false positives in connection with both the patch functionality and the intrusion detection or prevention system functionality.

32. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including an intrusion detection or prevention system option and a scan option;

the apparatus is further configured such that, in response to first user input received prior to the attack, the intrusion detection or prevention system option is capable of being applied to a plurality of different devices for preventing at least one attack packet at any of the different devices; and

the apparatus is further configured such that, in response to additional user input after the attack in connection with a particular single device of the plurality of different devices, the scan option is capable of being applied to the particular single device.

33. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including an intrusion detection or prevention system option and a scan option;

the apparatus is further configured such that, in response to first user input prior to the attack, the scan option is capable of being applied to a plurality of different devices at the plurality of different devices; and

the apparatus is further configured such that, in response to second user input after the attack in connection with a particular single device of the plurality of different devices, the intrusion detection or prevention system option is capable of being applied to the particular single device for preventing at least one attack packet at the particular single device.

34. The apparatus of claim 1, wherein the apparatus is configured such that the one or more of the plurality of mitigation techniques is capable of being identified based on the identification of the operating system in connection with the displaying of the at least one mitigation technique, so that, in order to avoid false positives, relevant vulnerabilities prompt mitigation technique user selection among at least two of the mitigation techniques, which involve both scan and intrusion detection or prevention system actions, for providing diverse mitigation options in connection with the relevant vulnerabilities.

35. The apparatus of claim 1, wherein the apparatus is configured such that the user input is capable of being received via at least one user interface of the at least one platform for different devices, for allowing different attack mitigation actions including at least one scan action and at least one intrusion detection or prevention system action to be selectively applied to the different devices for different actual vulnerabilities determined to be actually relevant based on the identification of the operating system in connection with the different devices.

36. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including a first mitigation technique that utilizes an intrusion detection or prevention system action and a second mitigation technique that utilizes a scan action.

37. The apparatus of claim 36, wherein the apparatus is configured such that different user input is capable of being received via the at least one platform for different devices, for allowing different mitigation techniques including the first mitigation technique and the second mitigation technique to be selectively applied by a user to the different devices for different actual vulnerabilities, such that the different user input is capable of resulting in:

only the first mitigation technique being selectively applied by the user to at least one first device, only the second mitigation technique being selectively applied by the user to at least one second device, and both the first mitigation technique and the second mitigation technique being selectively applied by the user to at least one third device.

38. The apparatus of claim 36, wherein the apparatus is configured such that the at least one mitigation technique further includes a third mitigation technique that utilizes a policy compliance action, wherein the apparatus is configured such that different user input is capable of being received via the at least one platform for different devices, for allowing different mitigation techniques including the first mitigation technique, the second mitigation technique, and the third mitigation technique to be selectively applied by a user to the different devices for different actual vulnerabilities, such that the different user input is capable of resulting in:

only the first mitigation technique being selectively applied by the user to at least one first device;

only the second mitigation technique being selectively applied by the user to at least one second device; and

the first mitigation technique, the second mitigation technique, and the third mitigation technique being selectively applied by the user to at least one third device.

39. The apparatus of claim 36, wherein the apparatus is configured such that the first mitigation technique is automatically applied utilizing a first communication from an integrated intrusion detection or prevention system/scan platform component of the at least one platform to intrusion detection or prevention system-supporting code, and the second mitigation technique is automatically applied utilizing a second communication from the integrated intrusion detection or prevention system/scan platform component of the at least one platform to scan-supporting code, where the intrusion detection or prevention system-supporting code and the scan-supporting code are part of a single agent.

40. The apparatus of claim 1, wherein the at least one platform includes scan functionality for supporting a first mitigation technique and intrusion detection or prevention system functionality for supporting a second mitigation technique, the at least one platform further capable of receiving actual vulnerability information to conditionally display, as a function of an existence of one or more actual vulnerabilities, one or more of the plurality of mitigation techniques to allow selective utilization of the scan functionality and the intrusion detection or prevention system functionality, so that only relevant mitigation techniques are displayed for selection to reduce false positives in connection with both the scan functionality and the intrusion detection or prevention system functionality.

41. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including a firewall option for preventing at least one attack packet of the attack by terminating or dropping the at least one attack packet, and a scan option;

the apparatus is further configured such that, in response to first user input received prior to the attack, the firewall option is capable of being applied to a plurality of different devices for preventing the at least one attack packet at any of the different devices; and

the apparatus is further configured such that, in response to additional user input after the attack in connection with a particular single device of the plurality of different devices, the scan option is capable of being applied to the particular single device.

42. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including a firewall option for preventing at least one attack packet of the attack by terminating or dropping the at least one attack packet, and a scan option;

the apparatus is further configured such that, in response to first user input prior to the attack, the scan option is capable of being applied to a plurality of different devices at the plurality of different devices; and

the apparatus is further configured such that, in response to second user input after the attack in connection with a particular single device of the plurality of different devices, the firewall option is capable of being applied to the particular single device for preventing the at least one attack packet at the particular single device.

43. The apparatus of claim 1, wherein the apparatus is configured such that the one or more of the plurality of mitigation techniques is capable of being identified based on the identification of the operating system in connection with the displaying of the at least one mitigation technique, so that, in order to avoid false positives, relevant vulnerabilities prompt mitigation technique user selection among at least two of the mitigation techniques, which involve both firewall and scan actions, for providing diverse mitigation options in connection with the relevant vulnerabilities.

44. The apparatus of claim 1, wherein the apparatus is configured such that the user input is capable of being received via at least one user interface of the at least one platform for different devices, for allowing different attack mitigation actions including at least one scan action and at least one firewall action to be selectively applied to the different devices for different actual vulnerabilities determined to be actually relevant based on the identification of the operating system in connection with the different devices.

45. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including a first mitigation technique that utilizes a firewall action and a second mitigation technique that utilizes a scan action.

46. The apparatus of claim 45, wherein the apparatus is configured such that different user input is capable of being received via the at least one platform for different devices, for allowing different mitigation techniques including the first mitigation technique and the second mitigation technique to be selectively applied by a user to the different devices for different actual vulnerabilities, such that the different user input is capable of resulting in:

only the first mitigation technique being selectively applied by the user to at least one first device, only the second mitigation technique being selectively applied by the user to at least one second device, and both the first mitigation technique and the second mitigation technique being selectively applied by the user to at least one third device.

47. The apparatus of claim 45, wherein the apparatus is configured such that the at least one mitigation technique further includes a third mitigation technique that utilizes a policy compliance action, wherein the apparatus is configured such that different user input is capable of being received via the at least one platform for different devices, for allowing different mitigation techniques including the first mitigation technique, the second mitigation technique, and the third mitigation technique to be selectively applied by a user to the different devices for different actual vulnerabilities, such that the different user input is capable of resulting in:

only the first mitigation technique being selectively applied by the user to at least one first device;

only the second mitigation technique being selectively applied by the user to at least one second device; and

the first mitigation technique, the second mitigation technique, and the third mitigation technique being selectively applied by the user to at least one third device.

48. The apparatus of claim 45, wherein the apparatus is configured such that the first mitigation technique is automatically applied utilizing a first communication from an integrated firewall/scan platform component of the at least one platform to firewall-supporting code, and the second mitigation technique is automatically applied utilizing a second communication from the integrated firewall/scan platform component of the at least one platform to scan-supporting code, where the firewall-supporting code and the scan-supporting code are part of a single agent.

49. The apparatus of claim 1, wherein the at least one platform includes scan functionality for supporting a first mitigation technique and firewall functionality for supporting a second mitigation technique, the at least one platform further capable of receiving actual vulnerability information to conditionally display, as a function of an existence of one or more actual vulnerabilities, one or more of the plurality of mitigation techniques to allow selective utilization of the scan functionality and the firewall functionality, so that only relevant mitigation techniques are displayed for selection to reduce false positives in connection with both the scan functionality and the firewall functionality.

50. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including a firewall option for preventing at least one attack packet of the attack by terminating or dropping the at least one attack packet, and a patch option;

the apparatus is further configured such that, in response to first user input received prior to the attack, the firewall option is capable of being applied to a plurality of different devices for preventing the at least one attack packet at any of the different devices; and

the apparatus is further configured such that, in response to additional user input after the attack in connection with a particular single device of the plurality of different devices, the patch option is capable of being applied to the particular single device.

51. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including a firewall option for preventing at least one attack packet of the attack by terminating or dropping the at least one attack packet, and a patch option;

the apparatus is further configured such that, in response to first user input prior to the attack, the patch option is capable of being applied to a plurality of different devices at the plurality of different devices; and

the apparatus is further configured such that, in response to second user input after the attack in connection with a particular single device of the plurality of different devices, the firewall option is capable of being applied to the particular single device for preventing the at least one attack packet at the particular single device.

52. The apparatus of claim 1, wherein the apparatus is configured such that the one or more of the plurality of mitigation techniques is capable of being identified based on the identification of the operating system in connection with the displaying of the at least one mitigation technique, so that, in order to avoid false positives, relevant vulnerabilities prompt mitigation technique user selection among at least two of the mitigation techniques, which involve both firewall and patch actions, for providing diverse mitigation options in connection with the relevant vulnerabilities.

53. The apparatus of claim 1, wherein the apparatus is configured such that the user input is capable of being received via at least one user interface of the at least one platform for different devices, for allowing different attack mitigation actions including at least one patch action and at least one firewall action to be selectively applied to the different devices for different actual vulnerabilities determined to be actually relevant based on the identification of the operating system in connection with the different devices.

54. The apparatus of claim 1, wherein the apparatus is configured such that the at least one mitigation technique includes at least two mitigation techniques including a first mitigation technique that utilizes a firewall action and a second mitigation technique that utilizes a patch action.

55. The apparatus of claim 54, wherein the apparatus is configured such that different user input is capable of being received via the at least one platform for different devices, for allowing different mitigation techniques including the first mitigation technique and the second mitigation technique to be selectively applied by a user to the different devices for different actual vulnerabilities, such that the different user input is capable of resulting in:

only the first mitigation technique being selectively applied by the user to at least one first device, only the second mitigation technique being selectively applied by the user to at least one second device, and both the first mitigation technique and the second mitigation technique being selectively applied by the user to at least one third device.

56. The apparatus of claim 54, wherein the apparatus is configured such that the at least one mitigation technique further includes a third mitigation technique that utilizes a policy compliance action, wherein the apparatus is configured such that different user input is capable of being received via the at least one platform for different devices, for allowing different mitigation techniques including the first mitigation technique, the second mitigation technique, and the third mitigation technique to be selectively applied by a user to the different devices for different actual vulnerabilities, such that the different user input is capable of resulting in:

only the first mitigation technique being selectively applied by the user to at least one first device;

only the second mitigation technique being selectively applied by the user to at least one second device; and

the first mitigation technique, the second mitigation technique, and the third mitigation technique being selectively applied by the user to at least one third device.

57. The apparatus of claim 54, wherein the apparatus is configured such that the first mitigation technique is automatically applied utilizing a first communication from an integrated firewall/patch platform component of the at least one platform to firewall-supporting code, and the second mitigation technique is automatically applied utilizing a second communication from the integrated firewall/patch platform component of the at least one platform to patch- supporting code, where the firewall-supporting code and the patch-supporting code are part of a single agent.

58. The apparatus of claim 1, wherein the at least one platform includes patch functionality for supporting a first mitigation technique and firewall functionality for supporting a second mitigation technique, the at least one platform further capable of receiving actual vulnerability information to conditionally display, as a function of an existence of one or more actual vulnerabilities, one or more of the plurality of mitigation techniques to allow selective utilization of the patch functionality and the firewall functionality, so that only relevant mitigation techniques are displayed for selection to reduce false positives in connection with both the patch functionality and the firewall functionality.

16. A method, comprising:

identifying a plurality of mitigation techniques that mitigate effects of attacks that take advantage of vulnerabilities associated with an operating system, where;

each mitigation technique is capable of mitigating an effect of an attack that takes advantage of a corresponding vulnerability, and

each mitigation technique has a mitigation type including at least one of a patch, a policy setting, or a configuration option;

causing display of at least two of the mitigation techniques for mitigating an effect of at least one attack that takes advantage of at least one vulnerability, and

allowing receipt of at least one user input in connection with one or more of the at least two mitigation techniques; and

automatically applying the one or more of the at least two of the plurality of mitigation techniques including at least one first mitigation technique of a first mitigation type and at least one second mitigation technique of a second mitigation type to at least one device to at least mitigate the effect of at least one attack that is identified in connection with the at least one device;

wherein the at least two mitigation techniques are displayed based on an identification of an operating system.

17. The method of claim 16, wherein the at least one first mitigation technique is automatically applied utilizing a first communication to firewall-supporting code, and the at least one second mitigation technique is automatically applied utilizing a second communication to other supporting code;

wherein the method utilizes firewall functionality for supporting the at least one first mitigation technique and other functionality for supporting the at least one second mitigation technique, such that the other functionality and the firewall functionality are both supported by at least one component that also supports identification of attacks in connection with the at least one device, the method further comprising;

receiving actual vulnerability information to conditionally make available for user selection, as a function of an existence of one or more actual vulnerabilities, the at least two of the mitigation techniques to allow selective utilization of the other functionality and the firewall functionality, so that only relevant mitigation techniques are made available for the user selection to reduce false positives in connection with both the other functionality and the firewall functionality;

wherein different user selections are capable of being received for different devices, for allowing different mitigation techniques including the at least one first mitigation technique and the at least one second mitigation technique to be selectively applied to the different devices for different actual vulnerabilities, such that the different user selections are capable of resulting in;

only the at least one first mitigation technique being selectively applied to at least one first device, only the at least one second mitigation technique being selectively applied to at least one second device, and both the at least one first mitigation technique and the at least one second mitigation technique being selectively applied to at least one third device.

18. An apparatus, comprising:

at least one data storage; and

at least one hardware processor configured for being communicatively coupled to the at least one data storage;

said at least one data storage configured to store data on a plurality of mitigation techniques that mitigate effects of attacks that take advantage of vulnerabilities, where;

each mitigation technique is capable of mitigating an effect of an attack that takes advantage of a corresponding vulnerability, and

each mitigation technique has a mitigation type including at least one of a patch, a policy setting, or a configuration option;

said apparatus configured to;

cause display of at least one mitigation technique for mitigating an effect of at least one attack that takes advantage of at least one vulnerability, and

allow receipt of user input for selecting the at least one mitigation technique to be applied for mitigating the effect of the at least one attack that takes advantage of the at least one vulnerability;

said apparatus further configured to identify information in connection with at least one of a plurality of devices for use in identifying an attack in connection with the at least one device that takes advantage of the at least one vulnerability so that the at least one mitigation technique at least mitigates an effect of the identified attack;

said apparatus further configured such that one or more of the plurality of mitigation techniques is capable of being identified based on an identification of an operating system.

19. The apparatus of claim 18, wherein the apparatus is configured such that the at least one mitigation technique includes at least one first mitigation technique of a first mitigation type and at least one second mitigation technique of a second mitigation type, which utilize different underlying security technology types that are both supported by at least one agent.

20. The apparatus of claim 19, wherein the apparatus is configured such that the at least one agent is further capable of supporting a vulnerability assessment scan for the identification of the operating system.

21. The apparatus of claim 18, wherein the apparatus is configured such that the at least one mitigation technique includes a first mitigation technique and a second mitigation technique;

wherein the apparatus includes firewall functionality for supporting the first mitigation technique and other functionality for supporting the second mitigation technique, such that the firewall functionality and the other functionality are both supported by at least one agent that also supports the identification of the attack in connection with the at least one device, the apparatus further capable of receiving actual vulnerability information to conditionally make available for the user selection, as a function of an existence of one or more actual vulnerabilities, the first mitigation technique and the second mitigation technique to allow selective utilization of the firewall functionality and the other functionality, so that only relevant mitigation techniques are made available for the user selection to reduce false positives in connection with both the firewall functionality and the other functionality;

wherein the apparatus is further configured such that different user selections are capable of being received for different devices, for allowing different mitigation techniques including the first mitigation technique and the second mitigation technique to be selectively applied by a user to the different devices for different actual vulnerabilities, such that the different user selections are capable of resulting in;

only the first mitigation technique being selectively applied by the user to at least one first device, only the second mitigation technique being selectively applied by the user to at least one second device, and both the first mitigation technique and the second mitigation technique being selectively applied by the user to at least one third device.

22. The apparatus of claim 21, wherein the apparatus is configured such that the other functionality includes a scan functionality.