Automated vulnerability assessment with policy-based mitigation

Patent metadata

Field	Value
Publication number	US-12101345-B2
Application number	US-202117452151-A
Country	US
Kind code	B2
Filing date	Oct 25, 2021
Priority date	Jan 16, 2019
Publication date	Sep 24, 2024
Grant date	Sep 24, 2024

Abstract

Disclosed are various approaches to automate vulnerability assessment implement policy-based mitigation. A plurality of vulnerability records from respective ones of a plurality of vulnerability feeds are aggregated. Each of the plurality of vulnerability records are stored in a standardized format. A plurality of enterprise-specific severity scores are generated by calculating an enterprise-specific severity score for each of the plurality of vulnerability records. Then, a web page can be created that includes at least a subset of the plurality of enterprise-specific severity scores and respective ones of the plurality of vulnerability records.

First claim

What is claimed is:

1. A system for automatically assessing and mitigating vulnerabilities, comprising:
a computing device comprising a processor and a memory; and
machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
aggregate a plurality of vulnerability records from a plurality of vulnerability feeds;
store the plurality of vulnerability records in the memory in a standardized format;
generate a plurality of enterprise-specific severity scores by calculating an enterprise-specific severity score for each of the plurality of vulnerability records;
identify a client device susceptible to a vulnerability identified by at least one of the plurality of vulnerability records based on the enterprise-specific severity score for each of the plurality of vulnerability records; and
select a policy applicable for the at least one of the plurality of vulnerability records, wherein the policy specifies an action to be performed by the client device to mitigate the vulnerability.

2. The system of claim 1 for automatically assessing and mitigating vulnerabilities, wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least:
place the policy in a command queue associated with the client device.

3. The system of claim 2 for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, causes the client device to install an update to address the vulnerability.

4. The system of claim 2 for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, causes the client device to disable functionality related to the vulnerability.

5. The system of claim 2 for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, blocks the client device from accessing a network resource until an update to address the vulnerability is installed.

6. The system of claim 1 for automatically assessing and mitigating vulnerabilities, wherein the machine-readable instructions that cause the computing device to aggregate the plurality of vulnerability records further cause the computing device to at least:
scrape one of the plurality of vulnerability records from a respective one of the plurality of vulnerability feeds; and
parse the scraped one of the plurality of vulnerability records for at least one of a vulnerability severity score, vulnerable application information, or vulnerable device information.

7. The system of claim 1 for automatically assessing and mitigating vulnerabilities, wherein calculating the enterprise-specific severity score for each of the plurality of vulnerability records further comprises causing the computing device to at least repeatedly:
determine a number of managed devices that are vulnerable to a vulnerability identified in one of the plurality of vulnerability records;
determine a vulnerability severity score for the vulnerability; and
multiply the number of managed devices that are vulnerable by the vulnerability severity score to calculate the enterprise-specific severity score.

8. A method for automatically assessing and mitigating vulnerabilities, comprising:
aggregating a plurality of vulnerability records from a plurality of vulnerability feeds;
storing the plurality of vulnerability records in a standardized format;
generating a plurality of enterprise-specific severity scores by calculating an enterprise-specific severity score for each of the plurality of vulnerability records;
identifying a client device susceptible to a vulnerability identified by at least one of the plurality of vulnerability records based on the enterprise-specific severity score for each of the plurality of vulnerability records; and
selecting a policy applicable for the at least one of the plurality of vulnerability records, wherein the policy specifies an action to be performed by the client device to mitigate the vulnerability.

9. The method of claim 8 for automatically assessing and mitigating vulnerabilities, further comprising:
placing the policy in a command queue associated with the client device.

10. The method of claim 9 for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, causes the client device to install an update to address the vulnerability.

11. The method of claim 9 for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, causes the client device to disable functionality related to the vulnerability.

12. The method of claim 9 for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, blocks the client device from accessing a network resource until an update to address the vulnerability is installed.

13. The method of claim 8 for automatically assessing and mitigating vulnerabilities, wherein aggregating the plurality of vulnerability records further comprises:
scraping one of the plurality of vulnerability records from a respective one of the plurality of vulnerability feeds; and
parsing the scraped one of the plurality of vulnerability records for at least one of a vulnerability severity score, vulnerable application information, or vulnerable device information.

14. The method of claim 8 for automatically assessing and mitigating vulnerabilities, wherein calculating the enterprise-specific severity score for each of the plurality of vulnerability records further comprises:
determining a number of managed devices that are vulnerable to a vulnerability identified in one of the plurality of vulnerability records;
determining a vulnerability severity score for the vulnerability; and
multiplying the number of managed devices that are vulnerable by the vulnerability severity score to calculate the enterprise-specific severity score.

15. A non-transitory computer-readable medium comprising machine-readable instructions for automatically assessing and mitigating vulnerabilities that, when executed by a processor, cause a computing device to at least:
aggregate a plurality of vulnerability records from a plurality of vulnerability feeds;
store the plurality of vulnerability records in a standardized format;
generate a plurality of enterprise-specific severity scores by calculating an enterprise-specific severity score for each of the plurality of vulnerability records;
identify a client device susceptible to a vulnerability identified by at least one of the plurality of vulnerability records based on the enterprise-specific severity score for each of the plurality of vulnerability records; and
select a policy applicable for the at least one of the plurality of vulnerability records, wherein the policy specifies an action to be performed by the client device to mitigate the vulnerability.

16. The non-transitory computer-readable medium of claim 15 , wherein the machine-readable instructions for automatically assessing and mitigating vulnerabilities, when executed by the processor, further cause the computing device to at least:
place the policy in a command queue associated with the client device.

17. The non-transitory computer-readable medium of claim 16 , wherein the policy, when retrieved by the client device from the command queue, caus

Assignees

• VMware LLC
• Omnissa Llc

Inventors

• Murthy Varun
• Roszak Jason
• Watts Blake Ryan
• Conover Matthew
• Ahuja Arvind

Classifications

• G06F8/65

  Updates (security arrangements therefor G06F21/57) · CPC title

• H04L63/0263

  Rule management · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title