Methods and systems for improved risk scoring of vulnerabilities

1. A method for security testing, comprising:

identifying a vulnerability in an asset;

executing a security tool, using one or more processors, to determine whether the vulnerability is exploitable, wherein the determination whether the vulnerability is exploitable is based at least partially on information from one or more security sources;

determining a risk level of the vulnerability based at least partially on whether the vulnerability is exploitable;

determining a new risk level for a future time based at least partially on factors utilized to determine the risk level; and

determining a remediation strategy for the vulnerability in the asset according to a determined priority of remediation of vulnerabilities based at least partially on any combination of the risk level, the new risk level, business importance, an overall risk, risk aggregation in relation to risk thresholds, cost of remediation, and/or uptime requirements; and

determining a residual risk of the vulnerability based on an effectiveness of the remediation strategy.

2. The method of claim 1 , the method further comprising:

notifying a user of the vulnerability and the risk level.

3. The method of claim 1 , wherein the asset comprises at least one of a physical computer system and a virtual machine.

4. The method of claim 1 , the method further comprising:

determining a future risk level based on historical fix rates of vulnerabilities.

5. The method of claim 1 , the method further comprising:

identifying that the vulnerability is utilized by a new malicious software program; and

determining a new risk level of the vulnerability based at least partially on the vulnerability being utilized by the new malicious software program.

6. A system for security testing, comprising:

a computer readable non-transitory storage medium storing instructions; and

a processor configured to execute the instructions to perform the method of claim 1 .

7. A computer readable non-transitory storage medium storing instructions that cause a processor to perform the method of claim 1 .

8. A method for security testing, comprising:

identifying a vulnerability in an asset;

identifying that the asset is hosting virtual machines or that the asset is a virtual machine;

identifying resources of the virtual machines or the virtual machine; and

determining, using one or more processors, a risk level of the vulnerability based at least partially on the resources of the virtual machines or the virtual machine;

executing a security tool, using the one or more processors, to determine whether the vulnerability is exploitable, wherein the determination whether the vulnerability is exploitable is based at least partially on information from one or more security sources;

determining a new risk level for a future time based at least partially on factors utilized to determine the risk level; and

determining a remediation strategy for the vulnerability in the asset according to a determined priority of remediation of vulnerabilities based at least partially on any combination of the risk level, the new risk level, business importance, an overall risk, risk aggregation in relation to risk thresholds, cost of remediation, and/or uptime requirements.

9. The method of claim 8 , the method further comprising:

notifying a user of the vulnerability and the risk level.

10. The method of claim 8 , the method further comprising:

identifying a number of the virtual machines potentially affected by the vulnerability,

wherein determining the risk level is further based at least partially on the number of virtual machines affected by the vulnerability.

11. The method of claim 8 , the method further comprising:

identifying that the vulnerability is located in one of the virtual machines; and

identifying that the one of the virtual machines activates and deactivates according to a schedule, wherein determining the risk level is further based at least partially on the schedule.

12. A system for security testing, comprising:

a computer readable non-transitory storage medium storing instructions; and

a processor configured to execute the instructions to perform the method of claim 8 .

13. A computer readable non-transitory storage medium storing instructions that cause a processor to perform the method of claim 8 .

14. A method for security testing, comprising:

maintaining a record of vulnerabilities associated with asset resources;

identifying, using one or more processors, a vulnerability in an asset by:

analyzing at least one of software resources and hardware resources of the asset; and

comparing the at least one of software resources and hardware resources to the record of vulnerabilities;

executing a security tool, using the one or more processors, to determine whether the vulnerability is exploitable, wherein the determination whether the vulnerability is exploitable is based at least partially on information from one or more security sources;

determining a risk level of the vulnerability based at least partially on the vulnerability's ability to affect the asset;

determining a classification of the asset based at least partially on a value of the asset;

determining an overall risk to the asset based at least partially on the risk level of the vulnerability and the classification of the asset;

determining a new risk level for a future time based at least partially on factors utilized to determine the risk level; and

determining a remediation strategy for the vulnerability in the asset according to a determined priority of remediation of vulnerabilities based at least partially on any combination of the risk level, the new risk level, business importance, an overall risk, risk aggregation in relation to risk thresholds, cost of remediation, and/or uptime requirements.

15. The method of claim 14 , the method further comprising:

notifying a user of at least one of the asset, the vulnerability, the risk level of the vulnerability, the classification of the asset, and the overall risk.

16. The method of claim 14 , wherein the asset comprises at least one of a physical computer system and a virtual machine.

17. The method of claim 14 , wherein the value of the asset comprises at least one of a value of data stored by the asset, competitive advantage loss associated with a failure of the asset, business loss associated with a failure of the asset, productivity loss associated with a failure of the asset, reputation loss associated with a failure of the asset, and a legal impact of a failure of the asset.

18. The method of claim 14 , wherein the overall risk is further based at least partially on a classification of a second asset connected to the asset.

19. The method of claim 18 , wherein the overall risk is further based at least partially on a level of connection between the asset and the second asset.

20. The method of claim 14 , the method further comprising:

identifying a frequency that the asset is scanned for vulnerabilities, wherein the overall risk is further based at least partially on the frequency.

21. The method of claim 14 , the method further comprising:

determining a confidence that all vulnerabilities on the asset were identified, wherein the overall risk is further based at least partially on the confidence.

22. The method of claim 14 , the method further comprising:

identifying an entity that is associated with the asset, wherein the entity operates other assets connected to the asset; and

determining a risk profile of the entity, wherein the overall risk is further based at least partially on the risk profile of the entity.

23. The method of claim 14 , the method further comprising:

determining a remediation to the vulnerability based on the overall risk.

24. The method of claim 14 , the method further comprising:

determining whether the asset is inactive, wherein the overall risk is further based at least partially on the determination whether the asset is inactive.

25. The method of claim 14 , the method further comprising:

determining a new overall risk for the future time based on the new risk level.

26. A system for security testing, comprising:

a computer readable non-transitory storage medium storing instructions; and

a processor configured to execute the instructions to perform the method of claim 14 .

27. A computer readable non-transitory storage medium storing instructions that cause a processor to perform the method of claim 14 .