Enterprise assessment management
Systems, methods, and computer programs for managing vulnerability assessment of a computer network are provided. One embodiment is an enterprise assessment management system, which comprises: a plurality of scanning tools including at least one web application scanning tool; and an enterprise assessment management server comprising a scanner manager that controls the plurality of scanning tools.
1 . An enterprise assessment management system comprising:
a plurality of scanning tools including at least one web application scanning tool; and
an enterprise assessment management server comprising a scanner manager that controls the plurality of scanning tools.
2 . The enterprise assessment management system of claim 1 , further comprising a repository that provides storage and retrieval services for scanning data corresponding to the plurality of scanning tools.
3 . The enterprise assessment management system of claim 2 , further comprising an application interface for importing the scanning data corresponding to the plurality of scanning tools.
4 . The enterprise assessment management system of claim 3 , wherein the application interface comprises a translation component configured to receive the scanning data from the plurality of scanning tools in a native data format.
5 . The enterprise assessment management system of claim 3 , further comprising a reporting module that merges the scanning data from the plurality of scanning tools into a central reporting mechanism.
6 . The enterprise assessment management system of claim 1 , further comprising a user interface that controls communication with at least one user console.
7 . The enterprise assessment management system of claim 6 , wherein the enterprise assessment management server comprises a user authentication module for controlling user access via the at least one user console.
8 . The enterprise assessment management system of claim 7 , wherein the enterprise assessment management server enforces user roles that define access permissions.
9 . The enterprise assessment management system of claim 1 , further comprising an automated scan scheduler that controls scan tasks to be implemented on the plurality of scanning tools.
10 . The enterprise assessment management system of claim 9 , wherein the automated scheduler manages conflicts between scan tasks.
11 . The enterprise assessment management system of claim 10 , wherein the automated scheduler supports a black-out contingency which defines a situation in which a corresponding scan task should not be scheduled.
12 . The enterprise assessment management system of claim 11 , wherein the black-out contingency is based on one of a time range, an IP address range, and an identified server.
13 . The enterprise assessment management system of claim 1 , wherein the plurality of scanning tools and the enterprise assessment management server communicate via a remote application program interface.
14 . The enterprise assessment management system of claim 1 , wherein the enterprise assessment management server comprises an application program interface that supports communications with at least one of the plurality of scanning tools via a scanner adapter which is integrated with the at least one of the plurality of scanning tools.
15 . The enterprise assessment management system of claim 14 , wherein the scanner adapter is configured with a network address corresponding to the enterprise assessment management server.
16 . The enterprise assessment management system of claim 1 , wherein at least one of the plurality of scanning tools comprises one of an application scanner, a system scanner, the web application scanner, a database scanner, and a network scanner.
17 . An enterprise assessment management platform comprising:
a scanner manager configured to control a plurality of scanning tools, at least one of the plurality of scanning tools comprising a web application scanning tool;
a repository for storing scanning data corresponding to the plurality of scanning tools; and
a user interface that controls communication with at least one user console.
18 . The enterprise assessment management platform of claim 17 , further comprising an application program interface for importing the scanning data corresponding to the plurality of scanning tools, the application program interface comprising a translation component configured to receive the scanning data in a native data format.
19 . The enterprise assessment management platform of claim 18 , further comprising a reporting mechanism that merges the scanning data from the plurality of scanning tools.
20 . The enterprise assessment management platform of claim 18 , wherein the application program interface supports communications with at least one of the plurality of scanning tools via a scanner adapter which is integrated with the at least one of the plurality of scanning tools.
21 . The enterprise assessment management platform of claim 20 , wherein the scanner adapter is configured with a network address corresponding to the scanner manager.
22 . The enterprise assessment management platform of claim 17 , wherein the scanner manager comprises a scan scheduler that controls scan tasks to be implemented on the plurality of scanning tools.
23 . A method for assessing the vulnerability of an enterprise network, the method comprising:
configuring a plurality of scanning tools for communication with a scanner manager, at least one of the plurality of scanning tools comprising a web application scanning tool;
connecting at least one of the plurality of scanning tools to the scanner manager;
requesting scheduling data from a repository; and
automatically scheduling a scan task to be implemented on the corresponding scanning tool based on the scheduling data retrieved from the repository.
24 . The method of claim 23 , wherein the configuring a plurality of scanning tools comprises integrating a scanner adapter with at least one of the plurality of scanning tools.
25 . The method of claim 23 , wherein the connecting at least one of the plurality of scanning tools to the scanner manager involves a remote application program interface.
26 . The method of claim 23 , further comprising receiving scan data from one of the plurality of scanning tools.
27 . The method of claim 26 , further comprising translating the scan data from a native format.
28 . The method of claim 26 , further comprising merging the scan data from the plurality of scanning tools into a central reporting mechanism.
29 . The method of claim 23 , further comprising establishing communication with a user console.
30 . The method of claim 29 , further comprising authenticating a user and enforcing user permissions associated with the user.
31 . The method of claim 23 , wherein the automatically scheduling a scan task involves resolving a scheduling conflict.