Vulnerability and remediation database
A security information management system is described, wherein client-side devices preferably collect and monitor information describing the operating system, software, and patches installed on the device(s), as well as configuration thereof. A database of this information is maintained, along with data describing vulnerabilities of available software and associated remediation techniques available for it. The remediation techniques in the database include some that apply software patches, some that change the device's policy settings, and some that change one of the device's configuration files or registry.
1 . A remediation system, comprising:
a database comprising
a remediation table listing a plurality of remediation techniques; and
a vulnerabilities table listing a plurality of vulnerabilities, each having an identifier, and each being associated with at least one of the plurality of remediation techniques;
wherein a first remediation technique includes application of a software patch, a second remediation technique includes changing a system policy setting, and a third remediation technique includes changing a configuration registry setting;
a query signal comprising a first vulnerability identifier; and
a response signal, automatically generated in response to the query signal, comprising the at least one remediation technique associated with the vulnerability that has the first vulnerability identifier.
2 . In a system for remediating computing device vulnerabilities, wherein the system has a list of possible vulnerabilities and remediation techniques that may be applied to fix them, the improvement comprising:
a first remediation technique identifies a software patch that remediates a first vulnerability;
a second remediation technique identifies a policy change that remediates a second vulnerability; and
a third remediation technique identifies a software patch that remediates a third vulnerability.
3 . An apparatus comprising a database that stores:
configuration information for each of a plurality of computing devices connected to a network, where the configuration information include installed operating system, software, operating system and software patches, and security policy items;
a plurality of possible vulnerability exposures and
one or more remediation techniques for the possible vulnerability exposures;
wherein the configuration information is retrieved from a source selected from the group consisting of software agents and a security server.
4 . The apparatus of claim 3 , wherein the database also stores:
the vulnerabilities to which each of the devices are subject, if any; and
the ones of the one or more remediation techniques that would mitigate those vulnerabilities.