System and method for management of system vulnerabilities
Methods and systems for managing vulnerabilities presented by data processing systems are disclosed. The vulnerabilities may be managed by identifying components of the data processing systems using different processes depending on the computing resource availabilities of the data processing systems. Once identified, corresponding vulnerabilities for the components may be identified. The identified vulnerabilities may then be managed by performing various actions.
1. A method for managing deployments, the method comprising:
identifying infrastructure of a deployment for vulnerability analysis;
identifying computing resource availability for the infrastructure;
making a determination, based on the computing resource availability, whether to perform an infrastructure based component analysis for the infrastructure that consumes at least a portion of computing resources of the infrastructure;
in a first instance of the determination where the infrastructure based component analysis is to be performed:
performing the infrastructure based component analysis of the infrastructure to obtain a first component inventory for the infrastructure;
performing the vulnerability analysis using the first component inventory to identify a first at least one vulnerability;
performing a remediation for the infrastructure based on the first at least one vulnerability;
in a second instance of the determination where the infrastructure based component analysis is not to be performed:
performing a historic component analysis of the infrastructure to obtain a second component inventory for the infrastructure, the historic component analysis not consuming any computing resources of the infrastructure;
performing the vulnerability analysis using the second component inventory to identify a second at least one vulnerability; and
performing a remediation for the infrastructure based on the second at least one vulnerability.
2. The method of claim 1 , wherein identifying the computing resource availability for the infrastructure comprises:
identifying types of data processing systems of the infrastructure; and
matching the types of the data processing systems to corresponding quantities of computing resources to identify the computing resource availability.
3. The method of claim 2 , wherein making the determination comprises:
making a comparison between the computing resource availability and a computing resource availability threshold;
in a first instance of the comparison where the computing resource availability exceeds the computing resource availability threshold:
determining to perform the infrastructure based component analysis; and
in a second instance of the comparison where the computing resource availability does not exceed the computing resource availability threshold:
determining to not perform the infrastructure based component analysis.
4. The method of claim 1 , wherein performing the historic component analysis of the infrastructure to obtain the second component inventory for the infrastructure comprises:
obtaining a first component list for the infrastructure, the first component list being based on a design for the infrastructure prior to the infrastructure being deployed;
obtaining a second component list for the infrastructure, the second component list being based on an operator provided report for the infrastructure after the infrastructure being deployed; and
identifying a third component list for the infrastructure using the first component list and the second component list.
5. The method of claim 4 , wherein performing the infrastructure based component analysis of the infrastructure to obtain the first component inventory for the infrastructure comprises:
scanning data processing systems of the infrastructure to obtain a fourth component list.
6. The method of claim 5 , wherein scanning the data processing systems comprises:
sending instructions to the data processing systems of the infrastructure to initiate performance of a self-inventory by the data processing systems;
receiving copies of self-inventories from the data processing systems; and
obtaining the fourth component list using the self-inventories, each of the self-inventories specifying self-identified components of the data processing systems.
7. The method of claim 6 , wherein performing the vulnerability analysis using the second component inventory to identify a second at least one vulnerability comprises:
for each component specified by the third component list:
matching at least one of a type of the component, and a version of the component against vulnerabilities in a vulnerability repository to identify the second at least one vulnerability.
8. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for managing deployments, the operations comprising:
identifying infrastructure of a deployment for vulnerability analysis;
identifying computing resource availability for the infrastructure;
making a determination, based on the computing resource availability, whether to perform an infrastructure based component analysis for the infrastructure that consumes at least a portion of computing resources of the infrastructure;
in a first instance of the determination where the infrastructure based component analysis is to be performed:
performing the infrastructure based component analysis of the infrastructure to obtain a first component inventory for the infrastructure;
performing the vulnerability analysis using the first component inventory to identify a first at least one vulnerability;
performing a remediation for the infrastructure based on the first at least one vulnerability;
in a second instance of the determination where the infrastructure based component analysis is not to be performed:
performing a historic component analysis of the infrastructure to obtain a second component inventory for the infrastructure, the historic component analysis not consuming any computing resources of the infrastructure;
performing the vulnerability analysis using the second component inventory to identify a second at least one vulnerability; and
performing a remediation for the infrastructure based on the second at least one vulnerability.
9. The non-transitory machine-readable medium of claim 8 , wherein identifying the computing resource availability for the infrastructure comprises:
identifying types of data processing systems of the infrastructure; and
matching the types of the data processing systems to corresponding quantities of computing resources to identify the computing resource availability.
10. The non-transitory machine-readable medium of claim 9 , wherein making the determination comprises:
making a comparison between the computing resource availability and a computing resource availability threshold;
in a first instance of the comparison where the computing resource availability exceeds the computing resource availability threshold:
determining to perform the infrastructure based component analysis; and
in a second instance of the comparison where the computing resource availability does not exceed the computing resource availability threshold:
determining to not perform the infrastructure based component analysis.
11. The non-transitory machine-readable medium of claim 8 , wherein performing the historic component analysis of the infrastructure to obtain the second component inventory for the infrastructure comprises:
obtaining a first component list for the infrastructure, the first component list being based on a design for the infrastructure prior to the infrastructure being deployed;
obtaining a second component list for the infrastructure, the second component list being based on an operator provided report for the infrastructure after the infrastructure being deployed; and
identifying a third component list for the infrastructure using the first component list and the second component list.
12. The non-transitory machine-readable medium of claim 11 , wherein performing the infrastructure based component analysis of the infrastructure to obtain the first component inventory for the infrastructure comprises:
scanning data processing systems of the infrastructure to obtain a fourth component list.
13. The non-transitory machine-readable medium of claim 12 , wherein scanning the data processing systems comprises:
sending instructions to the data processing systems of the infrastructure to initiate performance of a self-inventory by the data processing systems;
receiving copies of self-inventories from the data processing systems; and
obtaining the fourth component list using the self-inventories, each of the self-inventories specifying self-identified components of the data processing systems.
14. The non-transitory machine-readable medium of claim 13 , wherein performing the vulnerability analysis using the second component inventory to identify a second at least one vulnerability comprises:
for each component specified by the third component list:
matching at least one of a type of the component, and a version of the component against vulnerabilities in a vulnerability repository to identify the second at least one vulnerability.
15. A deployment manager, comprising:
a processor; and
a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations for managing deployments, the operations comprising:
identifying infrastructure of a deployment for vulnerability analysis;
identifying computing resource availability for the infrastructure;
making a determination, based on the computing resource availability, whether to perform an infrastructure based component analysis for the infrastructure that consumes at least a portion of computing resources of the infrastructure;
in a first instance of the determination where the infrastructure based component analysis is to be performed:
performing the infrastructure based component analysis of the infrastructure to obtain a first component inventory for the infrastructure;
performing the vulnerability analysis using the first component inventory to identify a first at least one vulnerability;
performing a remediation for the infrastructure based on the first at least one vulnerability;
in a second instance of the determination where the infrastructure based component analysis is not to be performed:
performing a historic component analysis of the infrastructure to obtain a second component inventory for the infrastructure, the historic component analysis not consuming any computing resources of the infrastructure;
performing the vulnerability analysis using the second component inventory to identify a second at least one vulnerability; and
performing a remediation for the infrastructure based on the second at least one vulnerability.
16. The deployment manager of claim 15 , wherein identifying the computing resource availability for the infrastructure comprises:
identifying types of data processing systems of the infrastructure; and
matching the types of the data processing systems to corresponding quantities of computing resources to identify the computing resource availability.
17. The deployment manager of claim 16 , wherein making the determination comprises:
making a comparison between the computing resource availability and a computing resource availability threshold;
in a first instance of the comparison where the computing resource availability exceeds the computing resource availability threshold:
determining to perform the infrastructure based component analysis; and
in a second instance of the comparison where the computing resource availability does not exceed the computing resource availability threshold:
determining to not perform the infrastructure based component analysis.
18. The deployment manager of claim 17 , wherein performing the historic component analysis of the infrastructure to obtain the second component inventory for the infrastructure comprises:
obtaining a first component list for the infrastructure, the first component list being based on a design for the infrastructure prior to the infrastructure being deployed;
obtaining a second component list for the infrastructure, the second component list being based on an operator provided report for the infrastructure after the infrastructure being deployed; and
identifying a third component list for the infrastructure using the first component list and the second component list.
19. The deployment manager of claim 15 , wherein performing the infrastructure based component analysis of the infrastructure to obtain the first component inventory for the infrastructure comprises:
scanning data processing systems of the infrastructure to obtain a fourth component list.
20. The deployment manager of claim 19 , wherein scanning the data processing systems comprises:
sending instructions to the data processing systems of the infrastructure to initiate performance of a self-inventory by the data processing systems;
receiving copies of self-inventories from the data processing systems; and
obtaining the fourth component list using the self-inventories, each of the self-inventories specifying self-identified components of the data processing systems.