System, method and computer readable medium for evaluating a security characteristic
View Patent ↗A method, system and computer program product for evaluating an IDP entity, the method includes evaluating an effect of at least one IDP rule applied by the IDP entity on legitimate traffic, based upon a network model; evaluating an effect of at least one IDP rule applied by the IDP entity based upon a network model and an attack model; determining an effectiveness of the IDP entity in response to the evaluated effects.
1. A method for evaluating a security characteristic of a network, the method comprising: (a) generating, by a server computer, a network model representative of a topology of the network and of vulnerabilities of network nodes; (b) generating, by the server computer, an attack dictionary representative of attack actions on at least one network node of the network model; (c) determining, by the server computer, access and Intrusion Detection and Prevention (IDP) information representative of communication paths through the network model and of IDP rules applied through the communication paths; (d) evaluating, by the server computer, at least one first result of at least one attack on at least one network node, based on the network model; (e) evaluating, by the server computer, a security characteristic in response to the at least one first result; (f) altering, by the server computer, a location of at least one IDP entity in the network model; and (g) evaluating at least one second result of at least one attack on at least one network node.
2. The method according to claim 1 wherein the security characteristic of the network relates to a security level of the network.
3. The method according to claim 1 wherein the security characteristic relates to a number and a severity of exploitable vulnerabilities of the network.
4. The method according to claim 1 wherein the security characteristic relates to a number and a severity of violations of a security policy defined for the network.
5. The method according to claim 1 wherein the IDP parameter is a IDP rule applied by at least one IDP entity.
6. The method according to claim 1 wherein the security characteristic relates to a risk that successful attacks cause to network nodes or to business assets, the risk is responsive to a potential damage caused by the successful attacks and likelihood of the successful attacks.
7. The method according to claim 1 wherein the evaluating comprises determining, by the server computer, a possibility to perform attack actions between nodes in the network.
8. A method for evaluating a security effectiveness of an Intrusion Detection and Prevention (IDP) entity of a network, the method comprises: generating, by a server computer, a network model representative of a topology of the network and of vulnerabilities of network nodes; generating, by the server computer, an attack dictionary representative of attack actions on at least one network node of the network model; evaluating, by the server computer, at least one first result of at least one attack on at least one network node, based on the network model; evaluating, by the server computer, an effect of at least one IDP rule applied by the IDP entity based upon the network model and an attack model; and determining an effectiveness of the IDP entity in response to a coverage rate of security problems of the IDP entity.
9. The method according to claim 8 , comprising identifying, by the server computer, security problems that are associated with the IDP entity which are not addressed by the IDP entity.
10. The method according to claim 8 , comprising: evaluating, by the server computer, effects of at least one IDP rule applied by multiple IDP entities of the network based upon the network model and an attack model; and determining, by the server computer, an effectiveness of the IDP entities in response to the evaluated effects.
11. The method according to claim 8 , comprising identifying, by the server computer, a change in a configuration of at least one IDP entity of the multiple IDP entities that will prevent an attacking action.
12. The method according to claim 8 , comprising evaluating, by the server computer, whether IDP entities in the network can protect against an attack in which a specified vulnerability is involved, and identifying, by the server computer, rules that can be added to the configuration of IDP entities to protect against a potential attack in which a specified vulnerability is involved.
13. The method according to claim 8 further comprising determining, by the server computer, access and IDP information representative of possible communication paths through the network and of IDP rules applied during the possible communication paths.
14. The method according to claim 8 further comprising altering, by the server computer, at least one IDP parameter and repeating the steps of evaluating and the step of determining.
15. A computer program product comprising a non-transitory computer usable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to generate a network model representative of a topology of the network and of vulnerabilities of network nodes; generate an attack dictionary representative of attack actions on at least one network node of the network model; determine access and Intrusion Detection and Prevention (IDP) information representative of communication paths through the network model and of IDP rules applied through the communication paths; evaluate at least one first result of at least one attack on at least one network node, based on the network model; evaluate a security characteristic in response to the at least one first result; alter, by the server computer, a location of at least one IDP entity in the network model; and evaluate at least one second result of at least one attack on at least one network node.
16. A system for evaluating a security characteristic, the system comprises: at least one data base adapted to store a network model representative of a topology of a network and of vulnerabilities of network nodes, an attack dictionary representative of attack actions on at least one node of the network model; and a server computer that comprises a server software that comprises at least one module adapted to: determine access and Intrusion Detection and Prevention (IDP) information representative of communication paths through the network model and of IDP rules applied through the communication paths; evaluate at least one first result of at least one attack on at least one network node, based on the network model; evaluate a security characteristic in response to the at least one first result; alter a location of at least one IDP entity in the network model; and evaluate at least one second result of at least one attack on at least one network node.
17. The computer program product according to claim 15 wherein the security characteristic relates to a risk that successful attacks cause to network nodes or to business assets, the risk is responsive to a potential damage caused by the successful attacks and likelihood of the successful attacks.
18. The computer program product according to claim 15 wherein the security characteristic relates to a number and a severity of violations of a security policy defined for the network.
19. The computer program product according to claim 15 wherein the security characteristic relates to a number and a severity of exploitable vulnerabilities of the network.