Granted Patent B2

US 12,299,619 · App. 16/894,627 · Granted May 13, 2025

Inventors: Mark Joseph Risoldi (Princeton, NJ); Sethuraman Balasubramanian (Monmouth Junction, NJ)

Assignee: Merck Sharp & Dohme LLC

G06Q10/0635G06F3/0482G06F21/577G06F30/20G06Q10/06375G06F2111/10G06F2221/033G06F2221/034H04L41/22

Abstract

Claims (49)

1. A method, comprising:

retrieving data corresponding to an asset, wherein the asset is a computing device or software application of an enterprise system;

identifying a set of vulnerabilities of the asset;

for each vulnerability in the set of vulnerabilities, determining whether a respective measure of effectiveness of a respective security control has breached a respective threshold measure of effectiveness of the respective security control;

for each vulnerability in a subset of the set of vulnerabilities, responsive to determining that the respective measure of effectiveness of the respective security control has breached the respective threshold measure of effectiveness of the respective security control, generating a targeted recommendation to implement a new security control on the asset for mitigating the vulnerability;

generating a user interface for the asset comprising a list including each targeted recommendation;

providing the user interface for display;

receiving user selection of a particular targeted recommendation in the list, the particular targeted recommendation mitigating a particular vulnerability of the subset of vulnerabilities; and

applying the security control identified by the particular targeted recommendation to the asset to mitigate the particular vulnerability.

2. The method of claim 1 , wherein the user interface comprises a risk factors and mitigations panel that lists tactics for mitigating risk for the asset.

3. The method of claim 1 , wherein the user interface comprises an installed applications panel listing software applications installed upon the asset.

4. The method of claim 1 , further comprising:

receiving a user interaction at a portion of a second user interface corresponding to the asset;

wherein the user interface for the asset is generated responsive to receiving the user interaction.

5. The method of claim 1 , wherein the user interface comprises a risk score for the asset.

6. The method of claim 5 , wherein the user interface comprises an indicator of a potential change in risk score if recommendations are implemented.

7. A non-transitory computer-readable storage medium comprising stored computer program instructions that, when executed by a computing device, cause the computing device to:

retrieve data corresponding to an asset, wherein the asset is a computing device or software application of an enterprise system;

identify a set of vulnerabilities of the asset;

for each vulnerability in the set of vulnerabilities, determine whether a respective measure of effectiveness of a respective security control has breached a respective threshold measure of effectiveness of the respective security control;

for each vulnerability in a subset of the set of vulnerabilities, responsive to determining that the respective measure of effectiveness of the respective security control has breached the respective threshold measure of effectiveness of the respective security control, generate a targeted recommendation to implement a new security control on the asset for mitigating the vulnerability;

generate a user interface for the asset comprising a list including each targeted recommendation;

provide the user interface for display;

receive user selection of a particular targeted recommendation in the list, the particular targeted recommendation mitigating a particular vulnerability of the subset of vulnerabilities; and

apply the security control identified by the particular targeted recommendation to the asset to mitigate the particular vulnerability.

8. The non-transitory computer-readable storage medium of claim 7 , wherein the user interface comprises a risk factors and mitigations panel that lists tactics for mitigating risk for the asset.

9. The non-transitory computer-readable storage medium of claim 7 , wherein the user interface comprises an installed applications panel listing software applications installed upon the asset.

10. The non-transitory computer-readable storage medium of claim 7 , wherein the computer program instructions further cause the computing device to:

receive a user interaction at a portion of a second user interface corresponding to the asset;

wherein the user interface for the asset is generated responsive to the user interaction.

11. The non-transitory computer-readable storage medium of claim 7 , wherein the user interface comprises a risk score for the asset.

12. The non-transitory computer-readable storage medium of claim 11 , wherein the user interface comprises an indicator of a potential change in risk score if recommendations are implemented.

13. A system, comprising:

a processor; and

a non-transitory computer-readable storage medium comprising stored computer program instructions that, when executed by the processor, cause the processor to:

retrieve data corresponding to an asset, wherein the asset is a computing device or software application of an enterprise system;

identify a set of vulnerabilities of the asset;

for each vulnerability in the set of vulnerabilities, determine whether a respective measure of effectiveness of a respective security control has breached a respective threshold measure of effectiveness of the respective security control;

for each vulnerability in a subset of the set of vulnerabilities, responsive to determining that the respective measure of effectiveness of the respective security control has breached the respective threshold measure of effectiveness of the respective security control, generate a targeted recommendation to implement a new security control on the asset for mitigating the vulnerability;

generate a user interface for the asset comprising a list including each targeted recommendation;

provide the user interface for display;

receive user selection of a particular targeted recommendation in the list, the particular targeted recommendation mitigating a particular vulnerability of the subset of vulnerabilities; and

apply the security control identified by the particular targeted recommendation to the asset to mitigate the particular vulnerability.

14. The system of claim 13 , wherein the user interface comprises a risk factors and mitigations panel that lists tactics for mitigating risk for the asset.

15. The system of claim 13 , wherein the computer program instructions further comprise:

receive a user interaction at a portion of a second user interface corresponding to the asset;

wherein the user interface for the asset is generated responsive to the user interaction.

16. The system of claim 13 , wherein the user interface comprises a risk score for the asset.

17. The system of claim 16 , wherein the user interface comprises an indicator of a potential change in risk score if recommendations are implemented.

Assignments (2)

Continuity (3)

References Cited (61)