Hierarchical risk assessment and remediation of threats in mobile networking environment
Mobile device security techniques are described. For a specific computing device, for each of a plurality of distinct security categories, a risk score is determined. The determined risk scores are aggregated to obtain an overall risk score.
1. A method, comprising:
receiving, by a vulnerability scoring engine executing on a processor, vulnerabilities detected in different vulnerability categories, the different vulnerability categories including a first vulnerability category for vulnerabilities detected from aspects of a mobile device, a second vulnerability category for vulnerabilities detected from communication between the mobile device and a server computer, and a third vulnerability category for vulnerabilities detected from communication between the mobile device and a network service;
scoring, by the vulnerability scoring engine, each respective vulnerability of the vulnerabilities, wherein the scoring comprises:
mapping, utilizing the different vulnerability categories, the respective vulnerability to different groups of vulnerability characteristics, each of the vulnerability characteristics having an associated metric value;
determining, based on the associated metric value, a score for each group of vulnerability characteristics from the mapping; and
generating, based on the score determined for each group of vulnerability characteristics, risk scores for the vulnerabilities across the different groups of vulnerability characteristics; and
providing, by the vulnerability scoring engine to a remediation engine, the vulnerabilities thus scored, wherein the risk scores are utilized by the remediation engine for remediation policy enforcement.
2. The method according to claim 1 , further comprising:
detecting the vulnerabilities through a plurality of vulnerability detection engines, each of the plurality of vulnerability detection engines in one of the different vulnerability categories.
3. The method according to claim 1 , wherein the different vulnerability categories include a mobile device integrity vulnerability category, a mobile device data integrity vulnerability category, a mobile device application integrity vulnerability category, a mobile device malware vulnerability category, a security service vulnerability category, an application access vulnerability category, an environmental factor vulnerability category, and an active directory access vulnerability category.
4. The method according to claim 1 , wherein the mapping further comprises mapping the respective vulnerability to a base metric characteristic, a temporal characteristic, and an environmental characteristic.
5. The method according to claim 1 , further comprising:
generating a report containing the vulnerabilities thus scored for presentation on a user device.
6. The method according to claim 1 , further comprising:
generating a dashboard for adjusting a remediation type, a remediation degree, or both that will be selected and performed automatically by the remediation engine.
7. The method according to claim 1 , further comprising:
for each respective vulnerability of the vulnerabilities thus scored, determining a vulnerability policy or placing the respective vulnerability in a queue.
8. A system, comprising:
a processor;
a non-transitory computer-readable medium; and
instructions stored on the non-transitory computer-readable medium and translatable by the processor for:
receiving vulnerabilities detected in different vulnerability categories, the different vulnerability categories including a first vulnerability category for vulnerabilities detected from aspects of a mobile device, a second vulnerability category for vulnerabilities detected from communication between the mobile device and a server computer, and a third vulnerability category for vulnerabilities detected from communication between the mobile device and a network service;
scoring each respective vulnerability of the vulnerabilities, wherein the scoring comprises:
mapping, utilizing the different vulnerability categories, the respective vulnerability to different groups of vulnerability characteristics, each of the vulnerability characteristics having an associated metric value;
determining, based on the associated metric value, a score for each group of vulnerability characteristics from the mapping; and
generating, based on the score determined for each group of vulnerability characteristics, risk scores for the vulnerabilities across the different groups of vulnerability characteristics; and
providing, to a remediation engine, the vulnerabilities thus scored, wherein the risk scores are utilized by the remediation engine for remediation policy enforcement.
9. The system of claim 8 , wherein the instructions are further translatable by the processor for:
detecting the vulnerabilities through a plurality of vulnerability detection engines, each of the plurality of vulnerability detection engines in one of the different vulnerability categories.
10. The system of claim 8 , wherein the different vulnerability categories include a mobile device integrity vulnerability category, a mobile device data integrity vulnerability category, a mobile device application integrity vulnerability category, a mobile device malware vulnerability category, a security service vulnerability category, an application access vulnerability category, an environmental factor vulnerability category, and an active directory access vulnerability category.
11. The system of claim 8 , wherein the mapping further comprises mapping the respective vulnerability to a base metric characteristic, a temporal characteristic, and an environmental characteristic.
12. The system of claim 8 , wherein the instructions are further translatable by the processor for:
generating a report containing the vulnerabilities thus scored for presentation on a user device.
13. The system of claim 8 , wherein the instructions are further translatable by the processor for:
generating a dashboard for adjusting a remediation type, a remediation degree, or both that will be selected and performed automatically by the remediation engine.
14. The system of claim 8 , wherein the instructions are further translatable by the processor for:
for each respective vulnerability of the vulnerabilities thus scored, determining a vulnerability policy or placing the respective vulnerability in a queue.
15. A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor for:
receiving vulnerabilities detected in different vulnerability categories, the different vulnerability categories including a first vulnerability category for vulnerabilities detected from aspects of a mobile device, a second vulnerability category for vulnerabilities detected from communication between the mobile device and a server computer, and a third vulnerability category for vulnerabilities detected from communication between the mobile device and a network service;
scoring each respective vulnerability of the vulnerabilities, wherein the scoring comprises:
mapping, utilizing the different vulnerability categories, the respective vulnerability to different groups of vulnerability characteristics, each of the vulnerability characteristics having an associated metric value;
determining, based on the associated metric value, a score for each group of vulnerability characteristics from the mapping; and
generating, based on the score determined for each group of vulnerability characteristics, risk scores for the vulnerabilities across the different groups of vulnerability characteristics; and
providing, to a remediation engine, the vulnerabilities thus scored, wherein the risk scores are utilized by the remediation engine for remediation policy enforcement.
16. The computer program product of claim 15 , wherein the instructions are further translatable by the processor for:
detecting the vulnerabilities through a plurality of vulnerability detection engines, each of the plurality of vulnerability detection engines in one of the different vulnerability categories.
17. The computer program product of claim 15 , wherein the different vulnerability categories include a mobile device integrity vulnerability category, a mobile device data integrity vulnerability category, a mobile device application integrity vulnerability category, a mobile device malware vulnerability category, a security service vulnerability category, an application access vulnerability category, an environmental factor vulnerability category, and an active directory access vulnerability category.
18. The computer program product of claim 15 , wherein the mapping further comprises mapping the respective vulnerability to a base metric characteristic, a temporal characteristic, and an environmental characteristic.
19. The computer program product of claim 15 , wherein the instructions are further translatable by the processor for:
generating a report containing the vulnerabilities thus scored for presentation on a user device.
20. The computer program product of claim 15 , wherein the instructions are further translatable by the processor for:
generating a dashboard for adjusting a remediation type, a remediation degree, or both that will be selected and performed automatically by the remediation engine.