Method and system for prioritizing and remediating security vulnerabilities based on adaptive scoring

1. A method for remediating a vulnerability on a computing resource asset located in a computer network that has a plurality of other computing resource assets each having at least one vulnerability, where a Common Vulnerability Scoring System (CVSS) score is determined for said vulnerability, the method comprising:

scanning, using a vulnerability scanner, the computing resource asset and the plurality of other computing resource assets on the computer network;

generating, using the vulnerability scanner, vulnerability scanning results data corresponding to the computing resource asset and the plurality of other computing resource assets on the computer network, the vulnerability scanning results data including the vulnerability and the CVSS score;

receiving, from the vulnerability scanner, the vulnerability scanning results data;

analyzing the vulnerability scanning results data with respect to each of a plurality of environmentally-dependent factors for said computing resource asset or the computer network;

determining an environmental factor weighting score value for each of the plurality of environmentally-dependent factors;

aggregating the environmental factor weighting score values for the plurality of environmentally-dependent factors and the CVSS score to generate an adjusted environmental factor weighting score aggregate value;

determining a prioritization score value for said vulnerability on the computing resource asset according to

SV Total =Σ( SV ENVF +SV NETF +SV CRIF +SV CONF +SV INTF +SV AVAF +SV URGF +SV CVSS )/Σ CSV Max ×100,

where

SV Total is the prioritization score value,

SV ENVF is an environmental factor (ENVF) score value,

SV NETF is a network connectivity factor (NETF) score value,

SV CRIF is a criticality factor (CRIF) score value,

SV CONF is a confidentiality factor (CONF) score value,

SV INTF is an integrity factor (INTF) score value,

SV AVAF is an availability factor (AVAF) score value,

SV URGF is an urgency factor (URGF) score value, and

SV CVSS is a Common Vulnerability Scoring System (CVSS) score value; and

remediating said vulnerability on the computing resource asset and the vulnerabilities on each of the plurality of other computing resource assets according to the prioritization score value.

2. The method in claim 1 , wherein determining the prioritization score value comprises:

calculating an aggregate maximum score value (CSV Max ) by adding a maximum value attainable for the CVSS score and all environmentally-dependent factors; and

calculating the prioritization score value by normalizing the adjusted environmental factor weighting score aggregate value,

wherein normalizing the adjusted environmental factor weighting score aggregate value includes dividing the adjusted environmental factor weighting score aggregate value by the aggregate maximum score value.

3. The method in claim 1 , wherein the plurality of environmentally-dependent factors comprise at least one of:

an environmental factor (ENVF);

a network connectivity factor (NETF);

a criticality factor (CRIF);

a confidentiality factor (CONF);

an integrity factor (INTF);

an availability factor (AVAF); and

an urgency factor (URGF).

4. The method in claim 1 , wherein remediating said vulnerability on the computing resource asset and the vulnerabilities on each of the plurality of other computing resource assets according to the prioritization score value includes sending remediation instructions or data to a communicating device on the computer network.

5. The method in claim 4 , wherein the communicating device is arranged to interact with a user.

6. The method in claim 1 , wherein each of the plurality of environmentally-dependent factors comprises at least two categories.

7. The method in claim 3 , wherein each of the plurality of environmentally-dependent factors comprise at least two categories, and wherein:

the environmental factor (ENVF) comprises a production category and a non-production category;

the network connectivity factor (NETF) comprises an extranet category, an intranet category and a separate network category; and

each of the criticality factor (CRIF), confidentiality factor (CONF), integrity factor (INTF), and availability factor (AVAF) comprise at least three categories.

8. A system for remediating a vulnerability on a computing resource asset located in a computer network that has a plurality of other computing resource assets each having at least one vulnerability, where a Common Vulnerability Scoring System (CVSS) score is determined for said vulnerability, the system comprising:

a vulnerability scanner arranged to

scan the computing resource asset and the plurality of other computing resource assets on the computer network, and

generate vulnerability scanning results data corresponding to the computing resource asset and the plurality of other computing resource assets on the computer network, the vulnerability scanning results data including the vulnerability and the CVSS score;

an environmental factor weighting (EFW) determiner suite arranged to

receive the vulnerability scanning results data from the vulnerability scanner,

analyze the vulnerability scanning results data with respect to each of a plurality of environmentally-dependent factors for said computing resource asset or the computer network, and

determine an environmental factor weighting score value for each of the plurality of environmentally-dependent factors; and

a vulnerability remediator arranged to

aggregate the environmental factor weighting score values for the plurality of environmentally-dependent factors and the CVSS score to generate an adjusted environmental factor weighting score aggregate value,

determine a prioritization score value for said vulnerability on the computing resource asset according to

SV Total =Σ( SV ENVF +SV NETF +SV CRIF +SV CONF +SV INTF +SV AVAF +SV URGF +SV CVSS )/Σ CSV Max ×100,

where

SV Total is the prioritization score value,

SV ENVF is an environmental factor (ENVF) score value,

SV NETF is a network connectivity factor (NETF) score value,

SV CRIF is a criticality factor (CRIF) score value,

SV CONF is a confidentiality factor (CONF) score value,

SV INTF is an integrity factor (INTF) score value,

SV AVAF is an availability factor (AVAF) score value,

SV URGF is an urgency factor (URGF) score value, and

SV CVSS is a Common Vulnerability Scoring System (CVSS) score value, and

remediate said vulnerability on the computing resource asset and the vulnerabilities on each of the plurality of other computing resource assets according to the prioritization score value.

9. The system in claim 8 , wherein the environmental factor weighting (EFW) determiner suite comprises at least one of:

an environmental factor (ENVF) determiner;

a network connectivity factor (NETF) determiner;

a criticality factor (CRIF) determiner;

a confidentiality factor (CONF) determiner;

an integrity factor (INTF) determiner;

an availability factor (AVAF) determiner; and

an urgency factor (URGF) determiner.

10. The system in claim 8 , wherein the vulnerability remediator is arranged to determine the prioritization score value by:

calculating an aggregate maximum score value (CSV Max ) by adding a maximum value attainable for the CVSS score and all environmentally-dependent factors; and

calculating the prioritization score value by normalizing the adjusted environmental factor weighting score aggregate value,

wherein normalizing the adjusted environmental factor weighting score aggregate value includes dividing the adjusted environmental factor weighting score aggregate value by the aggregate maximum score value.

11. The system in claim 8 , wherein vulnerability remediator is arranged to send remediation instructions or data to a communicating device on the computer network to remediate said vulnerability on the computing resource asset and the vulnerabilities on each of the plurality of other computing resource assets according to the prioritization score value.

12. The system in claim 11 , wherein the communicating device is arranged to interact with a user.

13. The system in claim 8 , wherein each of the plurality of environmentally-dependent factors comprises at least two categories.

14. The system in claim 9 , wherein each of the plurality of environmentally-dependent factors comprise at least two categories, and wherein:

the environmental factor (ENVF) comprises a production category and a non-production category;

the network connectivity factor (NETF) comprises an extranet category, an intranet category and a separate network category; and

each of the criticality factor (CRIF), confidentiality factor (CONF), integrity factor (INTF), and availability factor (AVAF) comprise at least three categories.

15. A non-transitory computer readable storage medium storing computer program instructions that, when executed by a security appliance, remediate a vulnerability on a computing resource asset located in a computer network that has a plurality of other computing resource assets each having at least one vulnerability, where a Common Vulnerability Scoring System (CVSS) score is determined for said vulnerability, the computer program instructions comprising:

scanning, using a vulnerability scanner, the computing resource asset and the plurality of other computing resource assets on the computer network;

generating, using the vulnerability scanner, vulnerability scanning results data corresponding to the computing resource asset and the plurality of other computing resource assets on the computer network, the vulnerability scanning results data including the vulnerability and the CVSS score;

receiving, from the vulnerability scanner, the vulnerability scanning results data;

analyzing the vulnerability scanning results data with respect to each of a plurality of environmentally-dependent factors for said computing resource asset or the computer network;

determining an environmental factor weighting score value for each of the plurality of environmentally-dependent factors;

aggregating the environmental factor weighting score values for the plurality of environmentally-dependent factors and the CVSS score to generate an adjusted environmental factor weighting score aggregate value;

determining a prioritization score value for said vulnerability on the computing resource asset according to

SV Total =Σ( SV ENVF +SV NETF +SV CRIF +SV CONF +SV INTF +SV AVAF +SV URGF +SV CVSS )/Σ CSV Max ×100,

where

SV Total is the prioritization score value,

SV ENVF is an environmental factor (ENVF) score value,

SV NETF is a network connectivity factor (NETF) score value,

SV CRIF is a criticality factor (CRIF) score value,

SV CONF is a confidentiality factor (CONF) score value,

SV INTF is an integrity factor (INTF) score value,

SV AVAF is an availability factor (AVAF) score value,

SV URGF is an urgency factor (URGF) score value, and

SV CVSS is a Common Vulnerability Scoring System (CVSS) score value; and

remediating said vulnerability on the computing resource asset and the vulnerabilities on each of the plurality of other computing resource assets according to the prioritization score value.

16. The non-transitory computer readable storage medium in claim 15 , wherein the plurality of environmentally-dependent factors comprise at least one of:

an environmental factor (ENVF);

a network connectivity factor (NETF);

a criticality factor (CRIF);

a confidentiality factor (CONF);

an integrity factor (INTF);

an availability factor (AVAF); and

an urgency factor (URGF).

17. The non-transitory computer readable storage medium in claim 15 , wherein determining the prioritization score value comprises:

calculating an aggregate maximum score value (CSV Max ) by adding a maximum value attainable for the CVSS score and all environmentally-dependent factors; and

calculating the prioritization score value by normalizing the adjusted environmental factor weighting score aggregate value,

wherein normalizing the adjusted environmental factor weighting score aggregate value includes dividing the adjusted environmental factor weighting score aggregate value by the aggregate maximum score value.