System and method for selecting and applying filters for intrusion protection system within a vulnerability management system
View Patent ↗A system for controlling selection of filters for protecting against vulnerabilities of a computer network includes a vulnerability management system analyzes the computer network and determines network vulnerabilities for the computer network. The vulnerability management system is configured to receive real-time data on a status of filters protecting against vulnerabilities of the computer network. A database contains a pre-generated mapping of network vulnerabilities to filters for protecting against the network vulnerabilities. The vulnerability management system enables user control of filters for protecting against vulnerabilities of the computer network based upon the determined network vulnerabilities of the computer network, the pre-generated mapping of network vulnerabilities to the filters for protecting against the network vulnerabilities and the real-time data on the status of the filters.
1. A system for controlling selection of filters for protecting against vulnerabilities of a computer network, comprising:
a vulnerability management system adapted to analyze the computer network and to determine network vulnerabilities for the computer network, wherein the vulnerability management system is configured to receive real-time data on a status of filters protecting against vulnerabilities of the computer network, wherein a filter comprises program code adapted to be implemented within an intrusion protection system to identify and prevent a particular type of attack from penetrating the computer network, the intrusion protection system being distinct from the vulnerability management system; and
a database that contains a pre-generated mapping of network vulnerabilities to filters for protecting against the network vulnerabilities;
the vulnerability management system outputting one or more recommended actions for selection of filters for the intrusion protection system based upon the determined network vulnerabilities of the computer network, the pre-generated mapping of network vulnerabilities to the filters for protecting against the network vulnerabilities, and the real-time data on the status of the filters.
2. The system of claim 1 , wherein the vulnerability management system generates one or more reports relating to the status of filters associated with the determined network vulnerabilities responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters, and the real-time data on the status of the filters.
3. The system of claim 2 , wherein the one or more reports include a mitigated risk report listing each of the determined network vulnerabilities that is protected from by an enabled filter responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters, and the real-time data on the status of the filters.
4. The system of claim 2 , wherein the one or more reports include an active risk report listing each of the determined network vulnerabilities that are at least partially unprotected from by one of the filters, further wherein the active risk report associates with each of the determined network vulnerabilities at least one filter that can protect from the determined network vulnerabilities and whether the at least one filter is enabled or disabled responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters, and the real-time data on the status of the filters.
5. The system of claim 2 , wherein the one or more reports include a list of determined network vulnerabilities that do not have an associated filter to protect from the vulnerability responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters, and the real-time data on the status of the filters.
6. The system of claim 2 , wherein the one or more reports include a mitigated risk report listing each of the determined network vulnerabilities that is protected from by an enabled filter responsive to the determined network vulnerabilities, the database of mapped vulnerabilities to filters, and the real-time data on the status of the filters and further wherein the determined network vulnerabilities in the mitigated risk report can be exempted from future mitigated risk reports.
7. The system of claim 1 , wherein the vulnerability management system further includes an interface to a security management system controlling the filters of the intrusion protection system, the interface enabling provision of commands to the security management system relating the control of the filters for protecting against vulnerabilities of the computer network.
8. The system of claim 1 , wherein the vulnerability management system further includes:
at least one scanning server for scanning for the network vulnerabilities within the computer network; and
a vulnerability management server for receiving the determined network vulnerabilities from the scanning server and controlling the filters for protecting against the vulnerabilities of the computer network based upon the determined network vulnerabilities of the computer network, the database of mapped vulnerabilities to filters, and the real-time data on the status of the filters.
9. The system of claim 1 , wherein the real-time data on the status of filters protecting against vulnerabilities of the computer network are provided from an intrusion protection system.
10. A method for controlling selection of filters for protecting against vulnerabilities of a computer network, comprising:
storing in a database a plurality of mapped network vulnerabilities of the computer network to filters for protecting against the network vulnerabilities, wherein a filter comprises program code adapted to be implemented within an intrusion protection system to identify and prevent a particular type of attack from penetrating the computer network;
determining network vulnerabilities for the computer network within a vulnerability management system executing in a computing entity having a hardware element;
receiving real-time data on a status of available filters protecting against vulnerabilities of the computer network at the vulnerability management system; and
outputting one or more recommended actions for selection of filters for the intrusion protection system to protect against vulnerabilities of the computer network based upon the determined network vulnerabilities of the computer network, the mapped network vulnerabilities to the filters for protecting against the network vulnerabilities, and the real-time data on the status of the filters from the vulnerability management system.
11. The method of claim 10 further including the step of generating one or more reports relating to the status of the filters associated with the determined network vulnerabilities responsive to the determined network vulnerabilities, the mapped network vulnerabilities to filters, and the real-time data on the status of the filters.
12. The method of claim 11 , wherein the step of generating reports further includes the step of generating a mitigated risk report listing each of the determined network vulnerabilities that is protected from by an enabled filter responsive to the determined network vulnerabilities, the mapped network vulnerabilities to filters, and the real-time data on the status of the filters.
13. The method of claim 11 , wherein the step of generating reports further includes the step of generating an active risk report listing each of the determined network vulnerabilities that are at least partially unprotected from by one of the filters, the active risk report associating with each of the determined network vulnerabilities at least one filter that can protect from the determined network vulnerabilities and whether the at least one filter is enabled or disabled responsive to the determined network vulnerabilities, the mapped network vulnerabilities to filters, and the real-time data on the status of the filters.
14. The method of claim 11 , wherein the step of generating reports further includes the step of generating a list of determined network vulnerabilities that do not have an associated filter to protect from the vulnerability responsive to the determined network vulnerabilities, the mapped network vulnerabilities to filters, and the real-time data on the status of the filters.
15. The method of claim 11 , wherein the steps of generating reports further includes:
generating a mitigated risk report listing each of the determined network vulnerabilities that is protected from by an enabled filter in the intrusion protection system;
selecting determined network vulnerabilities to be filtered out from future mitigated risk reports; and
exempting the selected vulnerabilities from the future mitigated risk reports.
16. The method of claim 10 , wherein the step of controlling further comprises:
transmitting commands controlling the filters to a security management system from the vulnerability management system; and
controlling the filters of at least one intrusion protection system for protecting against vulnerabilities of the computer network responsive to the commands to the security management system.
17. The method of claim 10 , wherein the step of determining further comprises:
scanning for the network vulnerabilities within the computer network using a scanning server;
receiving the determined network vulnerabilities at a control server from the scanning server; and
controlling the filters for protecting against the vulnerabilities of the computer network based upon the determined network vulnerabilities of the computer network, the mapped network vulnerabilities to filters, and the real-time data on the status of the filters.
18. The method of claim 10 , wherein the step of receiving further includes receiving the real-time data on the status of filters protecting against vulnerabilities of the computer network from an intrusion protection system.