Continuous vulnerability assessment system
The embodiments disclosed herein are directed to a continuous vulnerability assessment system for detecting exploitable vulnerabilities. For example, an agent executes on a plurality of computing devices. Each agent profiles various pieces of software executing on its respective device and obtains various characteristics thereof. For instance, each agent determines, among other things, the length of time certain software executes on the device. Each agent provides descriptors of the determined characteristics to a vulnerability assessment engine. The engine determines a cumulative length of time that each particular piece of software executed across the plurality of computing devices. The engine also determines whether a vulnerability exists with respect to each particular piece of software, assigns a security risk level for the software based at least on the determined vulnerability and the cumulative length of time, and performs an action to mitigate the determined vulnerability based on the security risk level.
1 . A method performed by a first computing device, comprising:
receiving, from each of a plurality of second computing devices communicatively coupled to the first computing device:
a first characteristic descriptor indicating a length of time that an instance of a software application executed on the computing device; and
a second characteristic descriptor of the instance of the software application;
determining, based on a respective first characteristic descriptor received from each of the plurality of second computing devices, a cumulative length of time that the instances of the software application executed on the plurality of second computing devices in a predetermined time frame;
obtaining, based on the second characteristic descriptor, a vulnerability score for the instance of the software application, wherein the vulnerability score indicates that a vulnerability exists for the instance of the software application;
assigning a security risk level to the instances of the software application based at least on the vulnerability score and the cumulative length of time; and
performing an action to mitigate the determined vulnerability in accordance with the security risk level.
2 . The method of claim 1 , wherein the second characteristic descriptor of the instance of the software application specifies one or more properties of the instance of the software application.
3 . The method of claim 1 , further comprising:
for each of the plurality of second computing devices, receiving, from the second computing device a third characteristic descriptor specifying one or more configuration settings of the instance of the software application.
4 . The method of claim 3 , wherein assigning the security risk level is further based on the one or more configuration settings of the instances of the software application.
5 . The method of claim 3 , wherein the one or more configuration settings of the instance of the software application comprises at least one of:
one or more firewall settings of the instance of the software application;
one or more administrative settings of the instance of the software application; or
one or more encryption settings of the instance of the software application.
6 . The method of claim 1 , performing the action to mitigate the determined vulnerability in accordance with the security risk level comprises at least one of:
providing a notification specifying the security risk level for the instances of the software application;
displaying the security risk level for the instances of the software application via a user interface;
providing a first command to each of the plurality of second computing devices that causes an update to be installed for the instances of the software applications that patches the vulnerability;
providing a second command to each of the plurality of second computing devices that causes one or more configuration settings to be changed for the instances of the software application that mitigates the vulnerability; or
providing a third command to each of the plurality of second computing devices that causes the instances of the software applications to be uninstalled.
7 . The method of claim 1 , wherein assigning the security risk level is further based on at least one of:
a number of the plurality of second computing devices on which the instances of the software application executed;
a frequency at which the instances of the software application is executed on the plurality of second computing devices;
a device type of each of the plurality of second computing devices; or
a type of a user of each of the plurality of second computing devices.
8 . A system, comprising:
one or more processing units; and
a memory coupled to the one or more processing units, the memory storing program code for execution by the one or more processing units, the program code comprising:
a vulnerability assessment engine configured to:
receive, from each of a plurality of second computing devices communicatively coupled to the system:
a first characteristic descriptor indicating a length of time that an instance of a software application executed on the computing device; and
a second characteristic descriptor of the instance of the software application;
determine, based on a respective first characteristic descriptor received from each of the plurality of computing devices, a cumulative length of time that the instances of the software application executed on the plurality of computing devices in a predetermined time frame;
obtain, based on the second characteristic descriptor, a vulnerability score for the instance of the software application, wherein the vulnerability score indicates that a vulnerability exists for the instance of the software application;
assign a security risk level to the instances of the software application based at least on the vulnerability score and the cumulative length of time; and
perform an action to mitigate the determined vulnerability in accordance with the security risk level.
9 . The system of claim 8 , wherein the second characteristic descriptor of the instance of the software application specifies one or more properties of the instance of the software application.
10 . The system of claim 8 , wherein the vulnerability assessment engine is further configured to:
for each of the plurality of computing devices, receive, from the computing device a third characteristic descriptor specifying one or more configuration settings of the instance of the software application.
11 . The system of claim 10 , wherein the vulnerability assessment engine is further configured to assign the security risk level is based on the one or more configuration settings of the instances of the software application.
12 . The system of claim 10 , wherein the one or more configuration settings of the instance of the software application comprises at least one of:
one or more firewall settings of the instance of the software application;
one or more administrative settings of the instance of the software application; or
one or more encryption settings of the instance of the software application.
13 . The system of claim 8 , wherein the vulnerability assessment engine is configured to perform the action to mitigate the determined vulnerability in accordance with the security risk level by performing at least one of:
providing a notification specifying the security risk level for the instances of the software application;
displaying the security risk level for the instances of the software application via a user interface;
providing a first command to each of the plurality of computing devices that causes an update to be installed for the instances of the software applications that patches the vulnerability;
providing a second command to each of the plurality of computing devices that causes one or more configuration settings to be changed for the instances of the software application that mitigates the vulnerability; or
providing a third command to each of the plurality of computing devices that causes the instances of the software applications to be uninstalled.
14 . The system of claim 8 , wherein the vulnerability assessment engine is further configured to assign the security risk level based on at least one of:
a number of the plurality of computing devices on which the instances of the software application executed;
a frequency at which the instances of the software application is executed on the plurality of computing devices;
a device type of each of the plurality of computing devices; or
a type of a user of each of the plurality of computing devices.
15 . A computer-readable storage medium having program instructions recorded thereon that, when executed by a processor of a first computing device, perform a method, the method comprising:
receiving, from each of a plurality of second computing devices communicatively coupled to the first computing device:
a first characteristic descriptor indicating a length of time that an instance of a software application executed on the second computing device; and
a second characteristic descriptor of the instance of the software application;
determining, based on a respective first characteristic descriptor received from each of the plurality of second computing devices, a cumulative length of time that the instances of the software application executed on the plurality of second computing devices in a predetermined time frame;
obtaining, based on the second characteristic descriptor, a vulnerability score for the instance of the software application, wherein the vulnerability score indicates that a vulnerability exists for the instance of the software application;
assigning a security risk level to the instances of the software application based at least on the vulnerability score and the cumulative length of time; and
performing an action to mitigate the determined vulnerability in accordance with the security risk level.
16 . The computer-readable storage medium of claim 15 , wherein the second characteristic descriptor of the instance of the software application specifies one or more properties of the instance of the software application.
17 . The computer-readable storage medium of claim 15 , the method further comprising:
for each of the plurality of second computing devices, receiving, from the second computing device a third characteristic descriptor specifying one or more configuration settings of the instance of the software application.
18 . The computer-readable storage medium of claim 17 , assigning the security risk level is further based on the one or more configuration settings of the instances of the software application.
19 . The computer-readable storage medium of claim 15 , wherein performing the action to mitigate the determined vulnerability in accordance with the security risk level comprises at least one of:
providing a notification specifying the security risk level for the instances of the software application;
displaying the security risk level for the instances of the software application via a user interface;
providing a first command to each of the plurality of second computing devices that causes an update to be installed for the instances of the software applications that patches the vulnerability;
providing a second command to each of the plurality of second computing devices that causes one or more configuration settings to be changed for the instances of the software application that mitigates the vulnerability; or
providing a third command to each of the plurality of second computing devices that causes the instances of the software applications to be uninstalled.
20 . The computer-readable storage medium of claim 15 , wherein assigning the security risk level is further based on at least one of:
a number of the plurality of second computing devices on which the instances of the software application executed;
a frequency at which the instances of the software application is executed on the plurality of second computing devices;
a device type of each of the plurality of second computing devices; or
a type of a user of each of the plurality of second computing devices.