System and method for a security asset manager
View Patent ↗Implementations of the present disclosure involve a system and/or method of performing security asset management. The system and/or method may schedule vulnerability scanners to scan the various portions of one or more networks and obtain the results of the vulnerability scans. IP addresses may be assigned to each of vulnerability scanners to scan. The system obtains the results of the vulnerability scans and may adjust the results of the scans according to configuration of the one or more networks that an IP address is associated with. The system and/or method may also assign and reassign IP addresses amongst the scanners to optimize scanning speed.
1. A security asset management system comprising:
a computing device including a processor coupled to a memory, the memory storing instructions for execution on the processor, the instructions configured to cause the processor to:
perform a first vulnerability scan on a first plurality of IP addresses on a first network using a first vulnerability scanner to identify a first vulnerability of a first computing device operating using one of the first plurality of IP addresses, wherein the first vulnerability is associated with a first severity rating;
perform a second vulnerability scan on a second plurality of IP addresses on a second network using a second vulnerability scanner to identify a second vulnerability of a second computing device operating using one of the second plurality of IP addresses, wherein the second vulnerability is associated with a second severity rating;
adjust the first severity rating according to at least one network configuration associated with the first network;
adjust the second severity rating according to at least one network configuration associated with the second network;
discover a new device operating at an IP address included in the first plurality of IP addresses by pinging the IP address and receiving a response;
perform a vulnerability scan on the new device; and
add the new device to a device inventory including a result from the vulnerability scan,
wherein the first vulnerability scan and the second vulnerability scan are performed according to a security asset manager policy comprising:
a scan schedule listing a date and time for scanning the first and second pluralities of IP addresses;
a first scanner policy corresponding to the at least one network configuration of the first network; and
a second scanner policy corresponding to the at least one network configuration of the second network.
2. The system of claim 1 , wherein the first scanner policy and the second scanner policy each comprise at least one vulnerability test to perform and at least one plugin to perform the vulnerability test.
3. The system of claim 2 , further comprising:
retrieve at least one update to an outdated plugin of the at least one plugin; and
install the at least one update on at least one of the first vulnerability scanner and second vulnerability scanner.
4. The system of claim 1 , wherein the first vulnerability scanner comprises a plurality of vulnerability scanners operating on each of a plurality of computing devices and the first plurality of IP addresses are divided between the plurality of computing devices for scanning.
5. The system of claim 4 , further comprising reassigning at least one IP address assigned to one of the plurality of computing devices to a different one of the plurality of computing devices according to a progress of the first vulnerability scan on each computing device.
6. The system of claim 1 , wherein the at least one IP address comprises each IP address in a subnet of a network and a block of IP address in the network.
7. The system of claim 1 , wherein the at least one network configuration associated with the first network comprises at least one of an accessibility of the first network from the Internet, a function of the first network, and a data stored on the first network.
8. A method of performing security asset management comprising:
obtaining, at a computing device comprising a processor coupled to a memory, a first set of results of a first vulnerability scan on a first plurality of IP addresses on a first network from a first vulnerability scanner, wherein the first set of results include a first vulnerability that is associated with a first severity rating;
obtaining, at the computing device, a second set of results of a second vulnerability scan on a second plurality of IP addresses on a second network from a second vulnerability scanner, wherein the second set of results include a second vulnerability that is associated with a second severity rating;
adjusting the first severity rating according to at least one network configuration associated with the first network using the computing device;
adjusting the second severity rating according to at least one network configuration associated with the second network using the computing device;
discovering a new device operating at an IP address included in the first plurality of IP addresses by pinging the IP address and receiving a response;
performing a vulnerability scan on the new device; and
adding the new device to a device inventory including a result from the vulnerability scan,
wherein the first vulnerability scan and the second vulnerability scan are performed according to a security asset manager policy comprising:
a scan schedule listing a date and time for scanning the first and second pluralities of IP addresses;
a first scanner policy corresponding to the at least one network configuration of the first network; and
a second scanner policy corresponding to the at least one network configuration of the second network.
9. The method of claim 8 , wherein the first scanner policy and the second scanner policy each comprise at least one vulnerability test to perform and at least one plugin to perform the vulnerability test.
10. The method of claim 9 , further comprising:
retrieve at least one update to an outdated plugin of the at least one plugin; and
install the at least one update on at least one of the first vulnerability scanner and second vulnerability scanner.
11. The method of claim 8 , wherein the first vulnerability scanner comprises a plurality of vulnerability scanners operating on each of a plurality of computing devices and the first plurality of IP addresses are divided between the plurality of computing devices for scanning.
12. The method of claim 11 , further comprising reassigning at least one IP address assigned to one of the plurality of computing devices to a different one of the plurality of computing devices according to a progress of the first vulnerability scan on each computing device.
13. The method of claim 8 , wherein the at least one IP address comprises each IP address in a subnet of a network and a block of IP address in the network.
14. The system of claim 8 , wherein the at least one network configuration associated with the first network comprises at least one of an accessibility of the first network from the Internet, a function of the first network, and a data stored on the first network.
15. A system for security asset manager comprising:
a computing device including a processor coupled to a memory, the memory storing instructions for execution on the processor, the instructions configured to cause the processor to:
perform a first vulnerability scan on a first plurality of IP addresses on a first network using a first plurality of vulnerability scanners to identify a first vulnerability of a first computing device operating using one of the first plurality of IP addresses, wherein the first vulnerability is associated with a first severity rating;
perform a second vulnerability scan on a second plurality of IP addresses on a second network using a second plurality of vulnerability scanners to identify a second vulnerability of a second computing device operating using one of the second plurality of IP addresses, wherein the second vulnerability is associated with a second severity rating;
adjust the first severity rating according to at least one network configuration associated with the first network;
adjust the second severity rating according to at least one network configuration associated with the second network
discover a new device operating at an IP address included in the first plurality of IP addresses by pinging the IP address and receiving a response;
perform a vulnerability scan on the new device; and
add the new device to a device inventory including a result from the vulnerability scan,
wherein the first vulnerability scan and the second vulnerability scan are performed according to a security asset manager policy comprising:
a scan schedule listing a date and time for scanning the first and second pluralities of IP addresses; and
a first scanner policy corresponding to the at least one network configuration of the first network; and
a second scanner policy corresponding to the at least one network configuration of the second network.
16. The system of claim 15 , wherein the first scanner policy and the second scanner policy each comprise at least one vulnerability test to perform and at least one plugin to perform the vulnerability test.
17. The system of claim 16 , further comprising:
retrieve at least one update to an outdated plugin on the list of plugins; and
install the at least one update on the vulnerability scanner.
18. The system of claim 15 , further comprising reassigning at least one IP address assigned to one of the first plurality of vulnerability scanners to a different vulnerability scanner of the first plurality of vulnerability scanners according to a progress of the first vulnerability scan on each vulnerability scanner.