System and method for grouping computer vulnerabilities

Patent metadata

Field	Value
Publication number	US-9251351-B2
Application number	US-201113270946-A
Country	US
Kind code	B2
Filing date	Oct 11, 2011
Priority date	Sep 21, 2011
Publication date	Feb 2, 2016
Grant date	Feb 2, 2016

Abstract

A system and method in one embodiment includes modules for creating an asset tag including one or more conditions of an asset on a network, adding the asset tag to an asset report template, and generating an asset report from the asset report template. More specific embodiments include creating the asset tag by generating a query for the one or more conditions. The asset tag may include a second asset tag configured to be updated automatically, and a third asset tag configured to be updated manually, and the second asset tag may be updated automatically when the asset tag is updated. Other embodiments include creating a vulnerability set including a selection of vulnerabilities from a plurality of vulnerabilities, adding the vulnerability set to the asset report template, and scanning a plurality of assets on the network.

First claim

What is claimed is:

1. A method comprising:
providing a list of asset tags to be displayed by a graphical user interface (GUI) of a computer that includes a processor;
creating, by an asset tag module, a dynamic asset tag based on a query comprising a plurality of conditions associated with at least one asset on a network;
providing, by the asset tag module, a representation of the query comprising the plurality of conditions to be displayed by the GUI;
scanning, by a scan module, one or more assets of the network for vulnerable content, wherein the scanning includes searching each of the one or more assets for two or more vulnerabilities included in a first vulnerability set selected from a plurality of vulnerability sets, wherein the two or more vulnerabilities represent a proper subset of a plurality of vulnerabilities, each one of the plurality of vulnerabilities included in at least one of the plurality of vulnerability sets;
generating scan results based on the scanning;
adding the dynamic asset tag to an asset report template;
generating, by a report module, an asset report from the asset report template, wherein the asset report is based, at least in part, on the dynamic asset tag and the scan results;
editing the dynamic asset tag by modifying the plurality of conditions in the query and by adding a second vulnerability set to the dynamic asset tag; and
generating, by the report module, an updated asset report from the asset report template after the plurality of conditions in the query is modified, wherein the updated asset report is based on the modified plurality of conditions, the second vulnerability set, and the scan results.

2. The method of claim 1 , wherein at least one condition is selected from a group comprising asset location, asset criticality, asset group name, asset label, asset owner, asset status, asset tag, authentication statistics, banners, Common Vulnerabilities and Exposures (CVE) number, false positives, host domain name system (DNS) name, host netBIOS name, Information Assurance Vulnerability Alert (IAVA) Number, Internet Protocol (IP) Address, Microsoft Knowledge Base (KB) Number, open ports, operating system, protocol name, scan name, vulnerability name, vulnerability severity, and vulnerability set.

3. The method of claim 1 , wherein the updated asset report comprises a list of assets on the network meeting the modified plurality of conditions in the query.

4. The method of claim 1 , wherein the editing the dynamic asset tag includes adding a new condition to the query.

5. The method of claim 1 , wherein the dynamic asset tag comprises:
a second asset tag configured to be updated automatically; and
a third asset tag configured to be updated manually.

6. The method of claim 5 , further comprising updating the second asset tag automatically when the dynamic asset tag is updated.

7. The method of claim 1 , wherein the asset report corresponds to, at least, a pre-configured vulnerability set and the vulnerable content.

8. An apparatus comprising:
a memory including data stored therein;
a hardware processor operable to execute instructions associated with the data;
an asset tag module configured to run on the hardware processor for:
providing a list of asset tags to be displayed by a graphical user interface (GUI) of a computer that includes a processor;
creating a dynamic asset tag based on a query comprising a plurality of conditions associated with at least one asset on a network; and
providing a representation of the query comprising the plurality of conditions to be displayed;

a scan module configured to run on the hardware processor for:
scanning one or more assets of the network for vulnerable content, the scanning to include searching each of the one or more assets for two or more vulnerabilities included in a first vulnerability set selected from a plurality of vulnerability sets, wherein the two or more vulnerabilities represent a proper subset of a plurality of vulnerabilities, each one of the plurality of vulnerabilities included in at least one of the plurality of vulnerability sets; and
generating scan results based on the scanning; and

a report module configured to run on the hardware processor for:
adding the dynamic asset tag to an asset report template;
generating an asset report from the asset report template, wherein the asset report is based, at least in part, on the dynamic asset tag and the scan results; and
generating an updated asset report from the asset report template after the dynamic asset tag is edited by modifying the plurality of conditions in the query and by adding a second vulnerability set to the dynamic asset tag, wherein the updated asset report is based on the modified plurality of conditions, the second vulnerability set, and the scan results.

9. The apparatus of claim 8 , wherein at least one condition is selected from a group comprising asset location, asset criticality, asset group name, asset label, asset owner, asset status, asset tag, authentication statistics, banners, Common Vulnerabilities and Exposures (CVE) number, false positives, host domain name system (DNS) name, host netBIOS name, Information Assurance Vulnerability Alert (IAVA) Number, Internet Protocol (IP) Address, Microsoft Knowledge Base (KB) Number, open ports, operating system, protocol name, scan name, vulnerability name, vulnerability severity, and vulnerability set.

10. The apparatus of claim 8 , wherein the dynamic asset tag is to be edited by adding a new condition to the query.

11. Non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:
providing a list of asset tags to be displayed by a graphical user interface (GUI) of a computer that includes a processor;
creating a dynamic asset tag based on a query comprising a plurality of conditions associated with at least one asset on a network;
providing a representation of the query comprising the plurality of conditions to be displayed;
scanning one or more assets of the network for vulnerable content, the scanning to include searching each of the one or more assets for two or more vulnerabilities included in a first vulnerability set selected from a plurality of vulnerability sets, wherein the two or more vulnerabilities represent a proper subset of a plurality of vulnerabilities, each one of the plurality of vulnerabilities included in at least one of the plurality of vulnerability sets;
generating scan results based on the scanning;
adding the dynamic asset tag to an asset report template;
generating an asset report from the asset report template, wherein the asset report is based, at least in part, on the dynamic asset tag and the scan results;
editing the dynamic asset tag by modifying the plurality of conditions in the query and by adding a second vulnerability set to the dynamic asset tag; and
generating an updated asset report from the asset report template after the plurality of conditions in the query is modified, wherein the updated asset report is based on the modified plurality of conditions, the second vulnerability set, and the scan results.

12. The media of claim 11 , wherein at least one condition is selected from a group comprising asset location, asset criticality, asset group name, asset label, asset owner, asset status, asset tag, authentication statistics, banners, Common Vulnerabilities and Exposures (CVE) number, false positives, host domain name system (DNS) name, host netBIOS name, Information Assurance Vulnerability Alert (IAVA) Number, Internet Protocol (IP) Address, Microsoft Knowledge Base (KB) Number, open ports, operating system, prot

Assignees

• Hugard Iv James M
• Leroux Alexander Lawrence
• Mallabarapu Charles
• Muniz Jorge Armando
• Russell Braden C
• Wu Zengjue
• Mcafee Inc

Inventors

• Hugard Iv James M
• Leroux Alexander Lawrence
• Mallabarapu Charles
• Muniz Jorge Armando
• Russell Braden C
• Wu Zengjue

Classifications

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F11/3051

  Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247) · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title