Systems and methods for managing vulnerability data

Patent metadata

Field	Value
Publication number	US-11947679-B2
Application number	US-202318303317-A
Country	US
Kind code	B2
Filing date	Apr 19, 2023
Priority date	Apr 29, 2020
Publication date	Apr 2, 2024
Grant date	Apr 2, 2024

Abstract

A method for managing vulnerability data may include: (1) ingesting, by a data ingestion engine, vulnerability data from a plurality of sources; (2) normalizing, by a data normalizer module, the vulnerability data into a plurality of data records; (3) generating, by a data processing module, a dynamic risk score for each data record; (4) storing, by a risk record register, a risk record for each data record, wherein the risk record may include the dynamic risk score, a priority level, an identifier for a software application, and a software dependency; (5) selecting, by a control policy selection engine, a control policy based on one of the dynamic risk scores; (6) implementing, by the risk record register, the selected control policy; (7) monitoring, by the risk record register, implementation of the control policy; and (8) updating, by the risk record register, the control policy selection engine based on the monitoring.

First claim

What is claimed is:

1. A method for managing vulnerability data, comprising:
ingesting, by a data ingestion engine, vulnerability data from a plurality of sources;
normalizing, by a data normalizer module, the vulnerability data into a plurality of data records, each data record having a predefined format and a plurality of pre-defined fields;
de-duplicating, by a data processing module, the data records;
generating, by the data processing module, a dynamic risk score for each de-duplicated data record, wherein the dynamic risk score is based on one or more rules;
storing, by a risk record register, a risk record for each data de-duplicated record, wherein the risk record comprises the dynamic risk score, a priority level, an identifier for a software application, and a software dependency;
selecting, by a control policy selection engine, a control policy based on one of the dynamic risk scores;
implementing, by the risk record register, the selected control policy;
monitoring, by the risk record register, implementation of the control policy; and
updating, by the risk record register, the control policy selection engine based on the monitoring.

2. The method of claim 1 , wherein the data ingestion engine, the data normalizer module, and the data processing module are triggered based on a state of the vulnerability record.

3. The method of claim 1 , wherein the data ingestion engine receives the vulnerability data as a data stream.

4. The method of claim 1 , wherein the data ingestion engine retrieves the vulnerability data from a plurality of data sources.

5. The method of claim 1 , further comprising:
enriching the data record with data identifying a software environment.

6. The method of claim 1 , wherein the dynamic risk score is further based on an asset sensitivity for an asset associated with a vulnerability associated with the de-duplicated data record, wherein the asset sensitivity is based on a confidentiality impact on the asset, an integrity impact on the asset, and an availability impact on the asset.

7. The method of claim 1 , further comprising:
generating a graphical output of a vulnerability across a plurality of systems; and
displaying, on a display, the graphical output.

8. The method of claim 1 , wherein the control policy is implemented at an enforcement point or a tollgate.

9. The method of claim 1 , wherein the control policy comprises a safeguard or countermeasure to minimize security risks.

10. A system for managing vulnerability data, comprising:
a data ingestion engine configured to ingest vulnerability data from a plurality of sources;
a data normalizer module configured to normalize the vulnerability data into a plurality of data records, each data record having a predefined format and a plurality of pre-defined fields;
a data processing module configured to de-duplicate the data records and to generate a dynamic risk score for each de-duplicated data record, wherein the dynamic risk score is based on one or more rules;
a risk record register configured to store a risk record for each de-duplicated data record, wherein the risk record comprises the dynamic risk score, a priority level, an identifier for a software application, and a software dependency; and
a control policy selection engine configured to select a control policy based on one of the dynamic risk scores, wherein the risk record register is configured to implement the selected control policy, monitor implementation of the control policy, and update the control policy selection engine based on the monitoring.

11. The system of claim 10 , wherein the data ingestion engine, the data normalizer module, and the data processing module are triggered based on a state of the vulnerability record.

12. The system of claim 10 , wherein the data ingestion engine is configured to receive the vulnerability data as a data stream.

13. The system of claim 10 , wherein the data ingestion engine is configured to receive the vulnerability data from a plurality of data sources.

14. The system of claim 10 , wherein the data processing module is further configured to enrich the data record with data identifying a software environment.

15. The system of claim 10 , wherein the dynamic risk score is further based on an asset sensitivity for an asset associated with a vulnerability associated with the data de-duplicated, wherein the asset sensitivity is based on a confidentiality impact on the asset, an integrity impact on the asset, and an availability impact on the asset.

16. The system of claim 10 , further comprising:
a dashboard engine configured to generate a graphical output of a vulnerability across a plurality of systems and display the graphical output.

17. The system of claim 10 , wherein the control policy is implemented at an enforcement point or a tollgate.

18. The system of claim 10 , wherein the control policy comprises a safeguard or countermeasure to minimize security risks.

Assignees

• Jpmorgan Chase Bank Na

Inventors

• Patel Samiksha
• Colvin Jessica
• Ward Patrick M
• Grant Jr Marty
• Everett David
• Legault Jean-Francois

Classifications

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F16/215

  Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title