Method, system, and apparatus for managing, monitoring, auditing, cataloging, scoring, and improving vulnerability assessment tests, as well as automating retesting efforts and elements of tests

• US 20050138426A1
• Filed: 11/08/2004
• Published: 06/23/2005
• Est. Priority Date: 11/07/2003
• Status: Abandoned Application

• Current Assignee: Brian Styslinger
• Original Assignee: Brian Styslinger
• Inventors: Styslinger, Brian
• Application Number:
  US10/982,930
• Publication Number:
  US 20050138426A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A scalable method, system, and apparatus for non-intrusively auditing and improving security assessments includes capturing, storing, presenting, displaying, inspecting, monitoring, and analyzing data flow in client-server security assessments and/or network/infrastructure security assessments. The invention provides interested parties with a mechanism to non-intrusively audit in real-time the vulnerability test effort, as well as review, replay, and analyze all aspects of the security assessment during and after the test. For web application assessments, the data capture includes one of the following or some combination: an intermediary with all data passing through the intermediary; a sniffer that can passively extract all data being communicated between the application and tester; and a plurality of computing modules (e.g., software, appliances, etc.) installed in the tester environment or within the application system environment (e.g., software installed on the tester'"'"'s computer, or on the computer where the intermediary is running, or software installed on the application systems proxy or web server, or an appliance in either environment) for storing, processing, analyzing, reporting, and displaying the data.

Claims

1. A method for auditing a security test of a system, wherein a tester is in communication with the system via a communication link, the method comprising:

providing a data collector that accesses and gathers the data being communicated between the tester and the system being tested;

collecting and storing data passing between the tester and the system;

analyzing the collected data to determine the effectiveness of the vulnerability/penetration assessment test.

2. The method of claim 1, further including the step of displaying the data and information about the data, providing auditors with realtime information regarding the vulnerability/penetration assessment test.

3. The method of claim 2, further including the step of providing and making available to testers and auditors an assessment proxy.

4. The method of claim 3, further including the step of utilizing captured username/password pairs, and the request used to authenticate, in the generation of valid sessions on the fly for retests, and automated scanning tests.

5. The method of claim 4, further including the step of providing a scanning engine that can re-run captured requests to perform retests upon remediation of vulnerabilities.

6. The method of claim 1 further including the step of including an intermediary proxy as the data collector, said proxy collecting the data passing between the tester and the system being tested, and storing said collected data in a storage.

7. The method of claim 1 further including the step of including a sniffer as the data collector, said sniffer extracting from said communications channel the data passing between the tester and the system so that the data is collected and stored as collected data.

8. The method of claim 1 further including the step of including a software module that can be installed within the tester'"'"'s environment as a data collector, said software module providing remote connectivity and extracting the data passing between the tester and the system so that the data is collected and stored as collected data.

9. The method of claim 1 further including the step of providing the collected data to a transaction database for analysis.

10. The method of claim 1 further including the step of building other databases, including a superset vulnerability database, based upon the collected data.