Security countermeasure management platform
A management platform that allows security and compliance users to view risks and vulnerabilities in their environment with the added context of what other mitigating security countermeasures are associated with that vulnerability and that are applicable and/or available within the overall security architecture. Additionally, the platform allows users to take one or more actions from controlling the operation of a security countermeasure for mitigation purposes to documenting the awareness of a security countermeasure that is in place.
1. A method to improve an operation of a countermeasure computing system in a computing environment, comprising:
configuring a set of agents to collect information security risk data from one or more sources in the computing environment;
implementing a security countermeasure workflow to address a security exposure identified by the information security risk data from one or more sources by:
receiving the information security risk data from one or more sources in each of one or more distinct risk categories, each risk category associated with a distinct type;
augmenting the received information security risk data with other data to generate an aggregate risk entity, the other data being one of: information security standards data, and risk impact attribute data;
processing the aggregate risk entity against a vulnerability-to-countermeasure knowledge base that includes countermeasure attribute data to discover, with respect to the aggregate risk entity, one or more countermeasures applicable to address a security exposure as represented in the aggregate risk entity, the vulnerability-to-countermeasure knowledge base grouping vulnerabilities to impact categories that correspond to countermeasures; and
with respect to particular security exposure represented in the aggregate risk entity, presenting information regarding the one or more countermeasures, the information identifying (i) an expected cost of implementing a countermeasure, (ii) an expected effectiveness of implementing a countermeasure, (iii) an indication of whether a countermeasure is available in the computing environment, (iv) a list of one or more recommended countermeasure configuration settings, and (v) when multiple countermeasures are identified, an ordered ranking of the multiple countermeasures according to their respective effectiveness; and
based at least in part on the security countermeasure workflow, controlling a countermeasure mechanism in the countermeasure computing system to address the security exposure by performing at least one of the one or more presented countermeasures.
2. The method as described in claim 1 further including:
receiving additional data defining a policy-based countermeasure workflow associated with the one or more countermeasures to address the particular security exposure represented in the aggregate risk; and
implementing the policy-based countermeasure workflow.
3. The method as described in claim 2 wherein the policy based countermeasure workflow provides for one of: control of the particular countermeasure for remediation of mitigation of the vulnerability risk, documentation of the particular countermeasure for awareness purposes, and documentation of the particular countermeasure for configuration, compliance, audit and reporting purposes.
4. The method as described in claim 1 wherein the vulnerability-to-countermeasure knowledge base comprises a set of countermeasure data that is organized as a taxonomy.
5. The method as described in claim 1 wherein the information security risk data is received from one or more sources in each of two or more distinct risk categories, the information security risk data from at least a source in a first risk category being distinct from an uncorrelated to the information security risk data from a source in a second risk category.
6. The method as described in claim 5 wherein at least two of the sources are located across multiple layers of the multi-later OSI protocol stack.
7. The method as described in claim 2 where in policy-based countermeasure workflow automates a process of discovering a risk and addressing the risk using one of the available countermeasures based on a defined policy.
8. The method as described in claim 1 wherein the sources are one of: a network vulnerability scanner, a web application scanner, a software security testing tool, a database scanner, a malware detector, an anti-virus scanner, a zero-day intelligence source, and a configuration assessment tool.
9. The method as described in claim 1 wherein the countermeasure mechanism is one of: a network-based IDS/IPS, a host-based IDS/IPS, a secure e-mail gateway, a secure web gateway, an integrated security appliance, a web application firewall, a network access control, an endpoint protection platform, a virtual private network, a switch, a router, an application control device, a data loss prevention (DLP) device, a managed file transfer device, a file integrity monitor, an e-mail encryption device, a database encryption device, and an application hardening and shield device.
10. The method as described in claim 1 wherein the indication of whether the countermeasure is available in the computing environment includes presenting as greyed-out an applicable but unavailable countermeasure.
11. A method to improve an operation of countermeasure computing system in a computing environment, comprising:
configuring a set of agents to collect information security risk data from one or more sources in the computing environment;
implementing a security countermeasure workflow to address a security exposure identified by the information security risk data collected from the one or more sources by:
receiving the information security risk data from one or more sources in each of one or more distinct risk categories, each risk category associated with a distinct type;
augmenting the received information security risk data with other data to generate an aggregate risk entity, the other data being one of: information security standards data, and risk impact attribute data;
processing the aggregate risk entity against a vulnerability-to-countermeasure knowledge base that includes countermeasure attribute data to discover, with respect to the aggregate risk entity, one or more countermeasures applicable to address a security exposure as represented in the aggregate risk entity, the vulnerability-to-countermeasure knowledge base grouping vulnerabilities to impact categories that correspond to countermeasures; and
with respect to a particular security exposure represented in the aggregate risk entity, providing information regarding the one or more countermeasures, the information identifying one of: (i) an expected cost of implementing a countermeasure, (ii) an expected effected of implementing a countermeasure, (iii) an indication of whether a countermeasure is available in the computing environment, (iv) a list of one or more recommended countermeasure configuration settings, and (v) when multiple countermeasures are identified, an ordered ranking of the multiple countermeasures according to their respective effectiveness; and
receiving additional data defining a policy-based countermeasure workflow associated with the one or more countermeasures to attempt to address the particular security exposure represented in the aggregate risk; and
based at least in the part on the policy-based security countermeasure workflow, controlling a countermeasure mechanism in the countermeasure computing system to address the security exposure by performing at least one of the one or more countermeasures.
12. The method as described in claim 11 wherein the sources are one of: a network vulnerability scanner, a web application scanner, a software security testing tool, a database scanner, a malware detector, an anti-virus scanner, a zero-day intelligence source, and a configuration assessment tool.
13. The method as described in claim 11 wherein the countermeasure mechanism is one of: a network-based IDS/IPS, a host-based IDS/IPS, a secure e-mail gateway, a secure web gateway, an integrated security appliance, a web application firewall, a network access control, an endpoint protection platform, a virtual private network, a switch, a router, an application control device, a data loss prevention (DLP) device, a managed file transfer device, a file integrity monitor, an e-mail encryption device, a database encryption device, and an application hardening and shielding device.
14. The method as described in claim 11 wherein the indication of whether the countermeasure is available in the computing environment includes presenting as greyed-out an applicable but unavailable countermeasure.