Prioritizing network assets

• US 8,479,297 B1
• Filed: 11/23/2010
• Issued: 07/02/2013
• Est. Priority Date: 11/23/2010
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Edukulla, Santhosh Kumar, Rajanna, Suresh
• Primary Examiner(s): Zee, Edward
• Assistant Examiner(s): Paliwal, Yogesh
• Application Number:
  US12/952,787
• Time in Patent Office: 952 Days
• Field of Search: 726/25
• US Class Current: 726/25
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating composite priority factors. The system automates prioritization of assets based on metrics across many dimensions, allowing security and risk managers to uses a logical framework that is scalable for thousands of assets.

Claims

1. A system, comprising:

a data processing apparatus; and

a computer storage medium coupled to the data processing apparatus and including instructions that when executed by the data processing apparatus causes the data processing apparatus to perform operations comprising;

receiving asset identifiers and asset categorizations associated with the asset identifiers, each asset being a network computer processing apparatus, each asset identifier uniquely identifying a corresponding asset, and the asset categorizations associated with each corresponding asset categorizing the asset as belonging to one or more asset types;

receiving dimensional priority factors data for a plurality of dimensional priority factors, each dimensional priority factor including;

a dimensional dictionary defining a plurality of classification metrics specific to the dimensional priority factor, each classification metric defining a metric to classify an asset as belonging to a classification;

a plurality of dimensional rules for the dimensional priority factor, each dimensional rule defining one or more of the classification metrics and asset specific data for an asset as input and defining an asset factor for the asset based on the input;

receiving composite priority factor data, the composite priority factor data including;

a plurality of composite rules, each composite rule defining one or more asset factors determined from one or more corresponding dimensional rules as input and defining a composite factor based on the input; and

a composite priority factor rule that defines composite factors as input and a composite priority factor based on the input;

for each of the assets;

for each of the dimensional priority factors, determining corresponding asset factors for the asset based on the dimensional rules;

for each of the composite rules, determining composite factors for the asset based on the asset factors for the asset, wherein each composite factor has a Boolean value and an associated weight; and

determining a composite priority factor for the asset based on the composite factors for the asset, wherein determining a composite priority factor includes summing the associated weights of each composite factor having a true Boolean value; and

ranking the assets according to their corresponding composite priority factors to define an order by which the assets are to be subjected to one or more security processes.

2. The system of claim 1, wherein:

one of the dimensional priority factors is an asset type factor;

the classification metrics for the asset type factor define one or more asset types; and

each dimensional rule for the asset type factor defines an asset factor for an asset based on a matching of the asset types to which the asset is categorized to the one or more asset types defined by the dimensional rule.

3. The system of claim 2, wherein the asset types include DHCP server, mail server, database server, web server, public IP, and private IP.

4. The system of claim 1, wherein:

one of the dimensional priority factors is an environmental factor;

the classification metrics for the environmental factor define one or more environment types, each environmental type describing an operational environment in which an asset can be deployed; and

each dimensional rule for the environmental factor defines an asset factor for an asset based on a matching of one or more operational environments of an asset to the one or more environmental types defined by the dimensional rule.

5. The system of claim 4, wherein the environmental types include managed host, unmanaged host, and critical subnets.

6. The system of claim 1, wherein:

one of the dimensional priority factors is a traffic factor;

the classification metrics for the traffic factor define one or more traffic conditions, each traffic condition describing a traffic pattern that can be observed in an asset; and

each dimensional rule for the traffic factor defines an asset factor for an asset based on a matching of one or more observed traffic patterns in an asset to the one or more traffic conditions defined by the dimensional rule.

7. The system of claim 6, wherein the traffic types include worm activity, inbound attacks and output attacks.

8. The system of claim 1, wherein:

one of the dimensional priority factors is a vulnerability factor;

the classification metrics for the vulnerability factor define one or more vulnerability conditions, each vulnerability condition describing a vulnerability observed in an asset; and

each dimensional rule for the vulnerability factor defines an asset factor for an asset based on a matching of one or more observed vulnerabilities of an asset to the one or more vulnerabilities conditions defined by the dimensional rule.

9. The system of claim 1, wherein:

one of the dimensional priority factors is a compliance factor;

the classification metrics for the compliance factor define one or more compliance conditions, each compliance condition describing a compliance requirement for an asset; and

each dimensional rule for the compliance factor defines an asset factor for an asset based on a matching of one or more compliance requirements for an asset to the one or more compliance requirements defined by the dimensional rule.

10. The system of claim 9, wherein the compliance requirements include regulatory compliance defined by regulatory entities.

11. The system of claim 1, wherein:

one of the dimensional priority factors is a data loss prevention factor;

the classification metrics for the data loss prevention factor define one or more data loss prevention conditions, each data loss prevention condition describing a data loss prevention that can be observed in an asset; and

each dimensional rule for the data loss prevention condition defines an asset factor for an asset based on a matching of one or more data loss prevention conditions observed in an asset to the one or more data loss prevention conditions defined by the dimensional rule.

12. The system of claim 1, wherein:

one of the dimensional priority factors is an service type factor;

the classification metrics for the service type factor define one or more service types, each service type describing a network service that the asset performs; and

each dimensional rule for the service type factor defines an asset factor for an asset based on a matching of the of one or more network services the asset performs to the one or more service types defined by the dimensional rule.

13. The system of claim 12, wherein the service types include SMTP service, SNMP service, and LDAP service.

14. The system of claim 1, wherein:

each dimensional rule is a Boolean rule and each asset factor is a Boolean value;

each composite rule is a Boolean rule.

15. The system of claim 1, wherein:

each asset factor is a rational number;

each composite factor is rational number; and

determining a composite priority factor for the asset based on the composite factors for the asset comprises summing the composite factors for the asset.

16. The system of claim 1, wherein:

the dimensional priority factors include an asset type factor, an environmental factor, a traffic factor, and a vulnerability factor;

the classification metrics for the asset type factor define one or more asset types;

each dimensional rule for the asset type factor defines an asset factor for an asset based on a matching of the asset types to which the asset is categorized to the one or more asset types defined by the dimensional rule;

the classification metrics for the environmental factor define one or more environment types, each environmental type describing an operational environment in which an asset can be deployed;

each dimensional rule for the environmental factor defines an asset factor for an asset based on a matching of one or more operational environments of an asset to the one or more environmental types defined by the dimensional rule;

the classification metrics for the traffic factor define one or more traffic conditions, each traffic condition describing a traffic pattern that can be observed in an asset;

each dimensional rule for the traffic factor defines an asset factor for an asset based on a matching of one or more observed traffic patterns in an asset to the one or more traffic conditions defined by the dimensional rule;

the classification metrics for the vulnerability factor define one or more vulnerability conditions, each vulnerability condition describing a vulnerability observed in an asset; and

each dimensional rule for the vulnerability factor defines an asset factor for an asset based on a matching of one or more observed vulnerabilities of an asset to the one or more vulnerabilities conditions defined by the dimensional rule.

17. A computer-implemented method comprising:

receiving asset identifiers and asset categorizations associated with the asset identifiers, each asset being a network computer processing apparatus, each asset identifier uniquely identifying a corresponding asset, and the asset categorizations associated with each corresponding asset categorizing the asset as belonging to one or more asset types;

receiving dimensional priority factors data for a plurality of dimensional priority factors, each dimensional priority factor including;

a dimensional dictionary defining a plurality of classification metrics specific to the dimensional priority factor, each classification metric defining a metric to classify an asset as belonging to a classification;

a plurality of dimensional rules for the dimensional priority factor, each dimensional rule defining one or more of the classification metrics and asset specific data for an asset as input and defining an asset factor for the asset based on the input;

receiving composite priority factor data, the composite priority factor data including;

a plurality of composite rules, each composite rule defining one or more asset factors determined from one or more corresponding dimensional rules as input and defining a composite factor based on the input; and

a composite priority factor rule that defines composite factors as input and a composite priority factor based on the input;

for each of the assets;

for each of the dimensional priority factors, determining, using at least one data processing apparatus, corresponding asset factors for the asset based on the dimensional rules;

for each of the composite rules, determining, using at least one data processing apparatus, composite factors for the asset based on the asset factors for the asset, wherein each composite factor has a Boolean value and an associated weight; and

determining, using at least one data processing apparatus, a composite priority factor for the asset based on the composite factors for the asset, wherein determining a composite priority factor includes summing the associated weights of each composite factor having a true Boolean value; and

ranking, using at least one data processing apparatus, the assets according to their corresponding composite priority factors to define an order by which the assets are to be subjected to one or more security processes.

18. The method of claim 17, wherein:

the dimensional priority factors include an asset type factor, an environmental factor, a traffic factor, and a vulnerability factor;

the classification metrics for the asset type factor define one or more asset types;

each dimensional rule for the asset type factor defines an asset factor for an asset based on a matching of the asset types to which the asset is categorized to the one or more asset types defined by the dimensional rule;

the classification metrics for the environmental factor define one or more environment types, each environmental type describing an operational environment in which an asset can be deployed;

each dimensional rule for the environmental factor defines an asset factor for an asset based on a matching of one or more operational environments of an asset to the one or more environmental types defined by the dimensional rule;

the classification metrics for the traffic factor define one or more traffic conditions, each traffic condition describing a traffic pattern that can be observed in an asset;

each dimensional rule for the traffic factor defines an asset factor for an asset based on a matching of one or more observed traffic patterns in an asset to the one or more traffic conditions defined by the dimensional rule;

the classification metrics for the vulnerability factor define one or more vulnerability conditions, each vulnerability condition describing a vulnerability observed in an asset; and

each dimensional rule for the vulnerability factor defines an asset factor for an asset based on a matching of one or more observed vulnerabilities of an asset to the one or more vulnerabilities conditions defined by the dimensional rule.

19. The method of claim 17, wherein:

each dimensional rule is a Boolean rule and each asset factor is a Boolean value; and

each composite rule is a Boolean rule.

20. Software instructions stored on a computer readable memory storage device executable by a data processing apparatus and upon such execution cause the data processing apparatus to perform operations comprising:

receiving asset identifiers and asset categorizations associated with the asset identifiers, each asset being a network computer processing apparatus, each asset identifier uniquely identifying a corresponding asset, and the categorizations associated with each corresponding asset categorizing the asset as belonging to one or more asset types;

receiving dimensional priority factors data for a plurality of dimensional priority factors, each dimensional priority factor including;

a dimensional dictionary defining a plurality of classification metrics specific to the dimensional priority factor, each classification metric defining a metric to classify an asset as belonging to a classification;

a plurality of dimensional rules for the dimensional priority factor, each dimensional rule defining one or more of the classification metrics and asset specific data for an asset as input and defining an asset factor for the asset based on the input;

receiving composite priority factor data, the composite priority factor data including;

a plurality of composite rules, each composite rule defining one or more asset factors determined from one or more corresponding dimensional rules as input and defining a composite factor based on the input; and

a composite priority factor rule that defines composite factors as input and a composite priority factor based on the input;

for each of the assets;

for each of the dimensional priority factors, determining corresponding asset factors for the asset based on the dimensional rules;

for each of the composite rules, determining composite factors for the asset based on the asset factors for the asset, wherein each composite factor has a Boolean value and an associated weight; and

determining a composite priority factor for the asset based on the composite factors for the asset, wherein determining a composite priority factor includes summing the associated weights of each composite factor having a true Boolean value; and

ranking the assets according to their corresponding composite priority factors to define an order by which the assets are to be subjected to one or more security processes.