Method and system of attack surface detection
View Patent ↗The invention comprises a method of using sensor agents to collect information in a central location to determine the entire attack surface of all certificate based resources, which includes vulnerable, insecure, or unknown resources but also includes where all the secure resources are located and the attack surface for each certificate resource. If a vulnerable resource is detected, the system may initiated additional sensor agents to determine the threat caused by the vulnerability. The system can also assign a rating to the overall security of the network based on vulnerabilities and display the attack surface as a topographic format for easy review by administrators.
1. A method of creating an attack surface that maps threats to a network arising from the properties of unsecure, or vulnerable digital certificates (“certificates”) comprising:
a. utilizing sensor agents to scan a network for digital certificates,
b. where certificates are discovered, instructing sensor agents to scan located certificates to determine if the certificate properties are secure or vulnerable,
c. where certificates with unsecure or vulnerable properties are discovered, determining the size of the threat to the network posed by the vulnerable certificates,
d. creating an attack surface of the network based on the information provided by the sensor agents about the certificate properties.
2. A method according to claim 1 , where an organization makes a request to a service provider, such as a certificate authority, to scan the organization's network for the purposes of discovering certificate property information and creating an attack surface based on the information learned therein.
3. A method according to claim 2 , where the service provider authenticates the request from the organization to determine the organization's authority over the network and the certificates within the network:
a. using a verification engine,
b. following the service provider's established checks and processes, and
c. verifying the requesting organizations' control of the network using methods such as, but not limited to, a domain challenge and/or a WHOIS search.
4. A method according to claim 1 , where, upon authorization of the requesting organization, internal sensor agents scan internal networks within the organization and external sensor agents scan public facing networks of the organization to locate certificates.
5. A method according to claim 4 , where, after the sensor agents locate the certificates, additional sensor agents scan the properties of located certificates.
6. A method according to claim 4 , where certificate property information obtained by the sensor agents is sent to and collected in a repository dedicated to compiling certificate property information.
7. A method according to claim 1 , where the security or vulnerability of the certificate property information of the certificate is determined by employing a module in the repository.
8. A method accord to claim 7 , where employing a module in the repository includes initiating a sensor agent to determine if the certificate properties are vulnerable or insecure.
9. A method according to claim 8 , where another sensor agent uses any detected vulnerabilities in the certificate properties to scan the entire network to determine the extent of the vulnerability within the network.
10. A method according to claim 1 , comprising using information about the certificate properties in the network, including any vulnerabilities or insecurities detected about certificate properties, to prepare an attack surface of the network.
11. A method according to claim 10 , where information about the certificate properties provided by the attack surface is displayed as a topographic map of the network.
12. A method according to claim 11 , where certificate property information provided by the attack surface is provided to a network administrator.
13. A method for creating an attack surface that maps threats to a network based on missing, unsecure, or vulnerable certificates comprising:
a. initializing sensor agents to scan a network for certificates
b. utilizing sensor agents to scan located certificates for information about the certificate properties,
c. where sensor agents locate properties that are unsecure or vulnerable in the certificate, enabling the sensor agents to flag the certificate,
d. creating an attack surface of the network based on any missing certificates or any unsecure and vulnerable properties found in the certificate by the sensor agents.
14. A method according to claim 13 , further comprising assigning a rating to each certificate based on whether the certificate properties are secure or vulnerable.
15. A method according to claim 13 , where sensor agents scan the network for additional certificates that possess the same vulnerabilities as the vulnerability found in a located certificate.
16. A method according to claim 13 , where sensor agents use vulnerabilities in certificates to breach the network containing the certificates.
17. A method according to claim 13 , where creating the attack surface of the network comprises using information provided by the sensor agents from the certificates in the network.
18. A system for determining the attack surface of a network based on the certificates and certificate properties in the network comprising:
a. a sensor agent module configured to utilize one or more sensor agents to scan a network for digital certificates and, for at least of the discovered certificates, to identify insecurities or vulnerabilities in the certificate's properties;
b. a repository module configured to store the collected information about certificate properties; and
c. an attack surface generation module configured to generate an attack surface of the network based on the information provided by the sensor agents about the certificate properties.
19. The system of claim 18 , wherein the sensor agent module is further configured to initiate a second sensor agent to identify vulnerabilities in a certificate's properties after an initial sensor agent identifies a certificate in the network.
20. The system of claim 19 , further comprising a rating module configured to rate the security of the certificate properties of a network.
21. The system of claim 20 , wherein the rating module is further configured to modify the rating of the security of the certificate properties of a network as one or more sensor agents discover the extent of the vulnerabilities in certificate properties throughout the network and whether other systems may be at risk from the vulnerabilities in certificate properties.
22. The system of claim 19 , further comprising a patching module configured to patch insecurities or vulnerabilities in certificate properties as the system detects them or may patch them at the request of a system administrator.
23. The system of claim 19 , further comprising a display module configured to display the vulnerabilities located in the certificate properties as an attack surface of the network.
24. The system of claim 19 , wherein the repository module is located remotely from the network comprising the certificates.