Real-time vulnerability monitoring
A security information management system is described, wherein client-side devices preferably collect and monitor information describing the operating system, software, and patches installed on the device(s), as well as configuration thereof. A database of this information is maintained, along with data describing vulnerabilities of available software and associated remediation techniques available for it. The system exposes an API to support security-related decisions by other applications. For example, an intrusion detection system (IDS) accesses the database to determine whether an actual threat exists and should be (or has been) blocked.
1 . A system, comprising:
a plurality of computing devices, each comprising at least one processor and memory, wherein the memory is encoded with programming instructions executable by the processor;
a database of device status information that characterizes the zero or more vulnerabilities to which each of the computing devices is subject, where the device status information is kept current in substantially real time; and
an application that
transmits a query signal to the database;
receives a result signal, responsive to the query signal, from the database;
makes a security-related determination based on the result signal.
2 . The system of claim 1 , wherein the application is an intrusion detection system, and the security-related determination is whether to produce an alarm signal.
3 . The system of claim 1 , wherein:
the application is selected from the group of applications consisting of a firewall, a proxy, and a router; and
the security-related determination is whether to allow a connection to pass.
4 . The system of claim 1 , wherein the security-related determination is selected from the group consisting of:
whether to block a connection attempt;
whether to pass a communication from one device to another through a network; and
whether to permit software to be installed.