Enterprise vulnerability management
View Patent ↗An enterprise vulnerability management application (EVMA), enterprise vulnerability management process (EVMP) and system. In one embodiment, the EVMP may include executing computer software code on at least one computer hardware platform to receive login information from a user, inventory current information technology assets of the enterprise, conduct vulnerability scanning of the inventoried information technology assets, analyze vulnerability correlation and prioritization of the information technology assets, remediate one or more vulnerabilities of the information technology assets, and report to the user about the vulnerabilities and remediation undertaken. As part of the analysis, one or more vulnerability scores such as, for example, Common Vulnerability Scoring System (CVSS) scores, may be generated from base score metrics, temporal score metrics and environment score metrics.
1. A method for generating a vulnerability score associated with en-information technology assets of an enterprise, said method comprising:
collecting results of at least one vulnerability assessment conducted on the information technology assets by at least one vendor tool;
analyzing each result for base score metrics, wherein steps of said analyzing each result for base score metrics comprising:
retrieving National Vulnerability Database (NVD) information;
when Common Vulnerabilities and Exposures (CVE) is present, retrieving base score metrics from an NVD repository;
when Common Weakness Enumeration (CWE) is present and CWE is mapped to one or more CVEs, retrieving Common Vulnerability Scoring System (CVSS) base score metrics for associated one or more CVEs from the NVD repository;
when CWE is present and CWE is mapped to one or more CVEs and a plurality of CVEs are retrieved, using CVSS base score metrics to generate a pseudo-CVE from retrieved CVEs
when CWE is present and CWE is not mapped to one or more CVEs, using CVSS base score metrics to generate a pseudo-CVE based on result details; and
when CVE is not present and CWE is not present, using CVSS base score metrics to generate a pseudo-CVE based on result details;
analyzing each result for temporal score metrics;
analyzing each result for environment score metrics; and
generating a CVSS score for each result based on the base score metrics, temporal score metrics and environment score metrics for each result,
wherein one or more of said steps of collecting results of at least one vulnerability assessment, analyzing each result for base score metrics, analyzing each result for temporal score metrics, analyzing each result for environment score metrics, and
generating a CVSS score for each result are performed on a computer hardware platform having a processing module executing computer program code stored on a memory module of the computer hardware platform.
2. The method of claim 1 wherein said step of analyzing each result for temporal score metrics comprises: retrieving a CVE;
when a temporal score is indicated as being available from a NVD repository, retrieving CVSS temporal score metrics from the NVD repository;
when an NVD temporal score is not available, analyzing CVE links to determine if temporal score metrics are available from an outside repository and, when the outside repository has temporal score metrics, retrieving CVSS temporal score metrics from the outside repository;
when an NVD temporal score is not available and temporal score metrics are not available from an outside source, determining whether a temporal score can be calculated and if so, using CVSS temporal score metrics to generate a pseudo-CVE based on details of the result; an
when an NVD temporal score is not available and temporal score metrics are not available from an outside source and a temporal score cannot be calculated, using default temporal score metrics.
3. The method of claim 1 wherein said step of analyzing each result for environment score metrics comprises: retrieving an asset associated with the result; when a user provided environment score is indicated as being available, retrieving CVSS environment score metrics from an enterprise vulnerability management application (EVMA) repository, and when an asset evaluation algorithm (AVA) provided environment score is indicated as being available, retrieving CVSS environment score metrics from an EVMA\AVA repository and blending the environment score metrics retrieved from the EVMA repository and the AVA repository;
when a user provided environment score is not available and an AVA provided environment score is indicated as being available, retrieving CVSS environment score metrics from an EVMA\AVA repository; and
when a user provided environment score is not available and an AVA provided environment score is not available, using default environment score metrics.
4. The method of claim 1 wherein, in said step of analyzing each result for base score metrics, the base metrics comprise one or more of an access vector metric, an access complexity metric, an authentication metric, a confidentiality impact metric, an integrity impact metric, and an availability impact metric.
5. The method of claim 1 wherein, in said analyzing each result for temporal score metrics, the temporal score metrics comprise one or more of an exploitability metric, a remediation level metric, and a report confidence metric.