Updating remote scan engines with custom vulnerability checks
Various embodiments include systems and methods of implementing vulnerability check synchronization. Vulnerability check synchronization may occur between computing resources at multiple different locations including a first location and a second location. Custom vulnerability check information associated with a particular security vulnerability may be received via a security console user interface that is located at the first location. A selection may be received, via the security console user interface, of a particular distributed engine to be utilized to perform a scan of one or more assets based at least in part on the custom vulnerability check information. Responsive to a determination to initiate the scan of the one or more assets, transfer of the custom vulnerability check information to the particular distributed engine via one or more networks may be automatically initiated.
1 . A system, comprising:
one or more computer devices that implement a security console, configured to:
receive, via a user interface of the security console, user input specifying a custom vulnerability check to be performed on assets located at a location remote from the security console;
store the custom vulnerability check as a plurality of extensible markup language (XML) files in a local file system of the security console, including:
(a) a vulnerability descriptor file that describes a type of vulnerability to be checked,
(b) a vulnerability check file that specifies instructions for a scan engine to check for the type of vulnerability, and
(c) a vulnerability solution file that specifies one or more remediation actions for the type of vulnerability;
receive, via the user interface, user input to initiate one or more scans of one or more of the assets, wherein the user input includes selection of one or more remote scan engines at the location to perform the one or more scans;
in response to a determination that a first remote scan engine is enabled for custom vulnerability checks:
transfer the XML files to the first remote scan engine;
cause the first remote scan engine to load the XML files; and
cause the first remote scan engine to perform a scan of a first asset with the custom vulnerability check; and
in response to a determination that a second remote scan engine is disabled for custom vulnerability checks:
refrain from transferring the XML files to the second remote scan engine; and
cause the second remote scan engine to perform a scan of a second asset without the custom vulnerability check.
2 . The system of claim 1 , wherein the vulnerability descriptor file includes information about the type of vulnerability, including two or more of:
a title or name of the vulnerability,
a description of the vulnerability, and
a severity of the vulnerability.
3 . The system of claim 2 , wherein the vulnerability descriptor file includes:
a Common Vulnerabilities and Exposure (CVE) identifier of the vulnerability, and
a Common Vulnerability Scoring System (CVSS) score of the vulnerability.
4 . The system of claim 1 , wherein the vulnerability check file specifies multiple tests to be performed during scans to check for the vulnerability.
5 . The system of claim 4 , wherein the vulnerability check file specifies:
a type of network service or network protocol to be tested,
a port number to be tested,
a scan request to use for a test, and
a scan response expression to match a response obtained for the test.
6 . The system of claim 4 , wherein the vulnerability check file specifies a particular test to check an operating system or one or more files of a particular asset for a software vulnerability.
7 . The system of claim 1 , wherein the vulnerability solution file includes a plurality of remediation actions that are common to different types of vulnerabilities.
8 . The system of claim 7 , wherein the security console is configured to:
display, via the user interface, one or more of the remediation steps in response to a determination that the type of vulnerability is detected on a particular asset.
9 . The system of claim 1 , wherein the security console is configured to:
send scan instructions to the one or more remote scan engine over Internet; and
receive scan results from the one or more remote scan engine over Internet.
10 . The system of claim 9 , wherein the security console is configured to:
display the scan results via the user interface.
11 . A method comprising:
executing a security console implemented by one or more computer devices, the execution comprising:
receiving, via a user interface of the security console, user input specifying a custom vulnerability check to be performed on assets located at a location remote from the security console;
storing the custom vulnerability check as a plurality of extensible markup language (XML) files in a local file system of the security console, including:
(a) a vulnerability descriptor file that describes a type of vulnerability to be checked,
(b) a vulnerability check file that specifies instructions for a scan engine to check for the type of vulnerability, and
(c) a vulnerability solution file that specifies one or more remediation actions for the type of vulnerability;
receiving, via the user interface, user input to initiate one or more scans of one or more of the assets, wherein the user input includes selection of one or more remote scan engines at the location to perform the one or more scans;
in response to a determination that a first remote scan engine is enabled for custom vulnerability checks:
transferring the XML files to the first remote scan engine;
causing the first remote scan engine to load the XML files; and
causing the first remote scan engine to perform a scan of a first asset with the custom vulnerability check; and
in response to a determination that a second remote scan engine is disabled for custom vulnerability checks:
refraining from transferring the XML files to the second remote scan engine; and
causing the second remote scan engine to perform a scan of a second asset without the custom vulnerability check.
12 . The method of claim 11 , wherein the vulnerability descriptor file includes information about the type of vulnerability, including two or more of:
a title or name of the vulnerability,
a description of the vulnerability, and
a severity of the vulnerability.
13 . The method of claim 12 , wherein the vulnerability descriptor file includes:
a Common Vulnerabilities and Exposure (CVE) identifier of the vulnerability, and
a Common Vulnerability Scoring System (CVSS) score of the vulnerability.
14 . The method of claim 11 , wherein the vulnerability check file specifies multiple tests to be performed during scans to check for the vulnerability.
15 . The method of claim 14 , wherein the vulnerability check file specifies:
a type of network service or network protocol to be tested,
a port number to be tested,
a scan request to use for a test, and
a scan response expression to match a response obtained for the test.
16 . The method of claim 14 , wherein the vulnerability check file specifies a particular test to check an operating system or one or more files of a particular asset for a software vulnerability.
17 . The method of claim 11 , wherein the vulnerability solution file includes a plurality of remediation actions that are common to different types of vulnerabilities.
18 . The method of claim 17 , further comprising the security console:
displaying, via the user interface, one or more of the remediation steps in response to a determination that the type of vulnerability is detected on a particular asset.
19 . The method of claim 11 , further comprising the security console:
sending scan instructions to the one or more remote scan engine over Internet; and
receiving scan results from the one or more remote scan engine over Internet.
20 . The method of claim 19 , further comprising the security console:
displaying the scan results via the user interface.