Policy driven vulnerability identification and remediation
A system for policy based vulnerability management of a network equipment of an enterprise is disclosed. A plurality of vulnerabilities associated with an end user device and a plurality of policies associated with the plurality of vulnerabilities is identified. Security risks associated with the plurality of vulnerabilities based on a type of the plurality of vulnerabilities are identified. Remediation for the plurality of vulnerabilities is determined based on the plurality of policies and prioritized based on the vulnerabilities, the security risks, and the policies. The plurality of policies is based on a cloud service selected from the end user device, a tenant, and a role associated with the end user device. A route corresponding to the plurality of policies and the cloud service is identified. The route specifies the end user device or a mid-link server. The cloud service is provided to the end user device via the route.
1. A cloud-based multi-tenant system for policy based vulnerability management of a network equipment of an enterprise, the cloud-based multi-tenant system comprising:
an application running on an end user device of a plurality of end user devices that selects a cloud service from a plurality of cloud services;
a plurality of routes through the cloud-based multi-tenant system to deliver the plurality of cloud services to the plurality of end user devices, wherein:
the plurality of routes is specified for a plurality of policies; and
a mid-link server configured to:
identify a plurality of vulnerabilities associated with a plurality of firmware of the end user device;
identify security risks associated with the plurality of vulnerabilities based on a type of the plurality of vulnerabilities;
identify the plurality of policies associated with the plurality of vulnerabilities based on the type of the plurality of vulnerabilities and the end user device, wherein the plurality of policies is specified for the plurality of end user devices;
determine remediation for the plurality of vulnerabilities based on the plurality of policies, wherein:
the plurality of policies is set based on the cloud service, a tenant of the end user device, and/or a user role associated with the end user device;
identify a route from the plurality of routes corresponding to the plurality of policies and the cloud service, wherein the route specifies the end user device or the mid-link server;
prioritize the remediation of the plurality of firmware based on the type of the plurality of vulnerabilities, the security risks, and the plurality of policies;
execute the remediation of the plurality of firmware by upgrading the plurality of firmware based on the plurality of policies according to the prioritization; and
establish communication via the route between the application and the cloud service based on the plurality of policies.
2. The cloud-based multi-tenant system for the policy based vulnerability management of the network equipment of the enterprise as recited in claim 1 , wherein:
the plurality of vulnerabilities is identified based on a first machine learning algorithm; and
the remediation of the plurality of vulnerabilities is prioritized using a second machine learning algorithm.
3. The cloud-based multi-tenant system for the policy based vulnerability management of the network equipment of the enterprise as recited in claim 1 , wherein the plurality of vulnerabilities associated with the end user device include vulnerabilities associated with at least one of firmware, application software, system software, programs, operating systems, freeware, groupware, shareware, bundled software, or spreadsheets.
4. The cloud-based multi-tenant system for the policy based vulnerability management of the network equipment of the enterprise as recited in claim 1 , wherein the remediation is performed by an administrator through the mid-link server.
5. The cloud-based multi-tenant system for the policy based vulnerability management of the network equipment of the enterprise as recited in claim 1 , wherein the mid-link server is further configured to:
extract:
configuration items using Application Programming Interfaces (APIs) from a configuration database, wherein the configuration items include hostnames, IP addresses, models, make, roles, or software versions of the plurality of firmware, wherein the plurality of firmware is associated with the plurality of end user devices,
device configurations from a device configuration repository, wherein the device configurations include vendor specific information, and
external vulnerability information from a plurality of data sources including external websites, social media, and/or vendor websites;
correlate the configuration items, the device configurations, and the external vulnerability information; and
identify at least one vulnerability associated with the plurality of firmware based on the correlation.
6. The cloud-based multi-tenant system for the policy based vulnerability management of the network equipment of the enterprise as recited in claim 1 , wherein firmware of the plurality of end user devices that are lacking firewalls are assigned a higher priority for the remediation and firmware that is within a private network or the firmware that do not have public Internet Protocol (IP) addresses are assigned a lower priority of the remediation.
7. The cloud-based multi-tenant system for the policy based vulnerability management of the network equipment of the enterprise as recited in claim 1 , wherein the plurality of policies varies with each tenant of a plurality of tenants of the cloud-based multi-tenant system.
8. The cloud-based multi-tenant system for the policy based vulnerability management of the network equipment of the enterprise as recited in claim 1 , wherein at least one policy from the plurality of policies disables access to the cloud service based on a type of vulnerabilities associated with the end user device.
9. A vulnerability identification and remediation method for a network equipment in a cloud-based multi-tenant system of an enterprise, the method comprising:
receiving from an application running on an end user device of a plurality of end user devices, a selection of a cloud service from a plurality of cloud services;
identifying at a mid-link server, a plurality of vulnerabilities associated with a plurality of firmware of the end user device;
identifying security risks associated with the plurality of vulnerabilities based on a type of the plurality of vulnerabilities;
identifying at the mid-link server, a plurality of policies associated with the plurality of vulnerabilities based on the type of the plurality of vulnerabilities and the end user device, wherein the plurality of policies is specified for the plurality of end user devices;
determining at the mid-link server, remediation for the plurality of vulnerabilities based on the plurality of policies, wherein the plurality of policies is based on the cloud service, a tenant of the end user device, and/or a user role associated with the end user device;
identifying at the mid-link server, a route from a plurality of routes corresponding to the plurality of policies and the cloud service, wherein:
the route specifies the end user device or the mid-link server;
the plurality of routes is specified for the plurality of policies; and
the plurality of routes through the cloud-based multi-tenant system delivers the plurality of cloud services to the plurality of end user devices;
prioritizing at the mid-link server, the remediation of the plurality of firmware based on the type of the plurality of vulnerabilities, the security risks, and the plurality of policies;
executing remediation of the plurality of firmware by upgrading the plurality of firmware based on the plurality of policies according to the priority; and
establishing by the mid-link server, communication via the route between the application and the cloud service based on the plurality of policies.
10. The vulnerability identification and remediation method for the network equipment in the cloud-based multi-tenant system of the enterprise as recited in claim 9 , further comprising:
extracting:
configuration items using Application Programming Interfaces (APIs) from a configuration database, wherein the configuration items include hostnames, IP addresses, models, make, roles, or software versions of the plurality of firmware, wherein the plurality of firmware is associated with the plurality of end user devices,
device configurations from a device configuration repository, wherein the device configurations include vendor specific information, and
external vulnerability information from a plurality of data sources including external websites, social media, and/or vendor websites;
correlating the configuration items, the device configurations, and the external vulnerability information; and
identifying at least one vulnerability associated with the plurality of firmware based on the correlation.
11. The vulnerability identification and remediation method for the network equipment in the cloud-based multi-tenant system of the enterprise as recited in claim 9 , wherein firmware lacking firewall is assigned a higher priority for the remediation.
12. The vulnerability identification and remediation method for the network equipment in the cloud-based multi-tenant system of the enterprise as recited in claim 9 , wherein the plurality of vulnerabilities associated with the end user device include vulnerabilities associated with at least one of firmware, application software, system software, programs, operating systems, freeware, groupware, shareware, bundled software, or spreadsheets.
13. The vulnerability identification and remediation method for the network equipment in the cloud-based multi-tenant system of the enterprise as recited in claim 9 , wherein firmware that is within a private network or the firmware that do not have public Internet Protocol (IP) addresses are assigned a lower priority of remediation.
14. The vulnerability identification and remediation method for the network equipment in the cloud-based multi-tenant system of the enterprise as recited in claim 9 , wherein the plurality of policies varies with each tenant of a plurality of tenants of the cloud-based multi-tenant system.
15. The vulnerability identification and remediation method for the network equipment in the cloud-based multi-tenant system of the enterprise as recited in claim 9 , wherein the remediation is performed by an administrator through the mid-link server.
16. A cloud-based multi-tenant system for policy-based vulnerability management, the cloud-based multi-tenant system comprising one or more processors and one or more memories with code for:
extracting:
configuration items associated with a plurality of firmware of a plurality of end user devices from a configuration database using Application Programming Interfaces (APIs),
device configurations including vendor specific information from a device configuration repository, and
external vulnerability information including external websites, social media, and/or vendor web sites from a plurality of data sources;
correlating the configuration items, the device configurations, and the external vulnerability information; and
identifying a plurality of vulnerabilities associated with the plurality of firmware based on the correlation;
receiving from an application running on an end user device of the plurality of end user devices, a selection of a cloud service from a plurality of cloud services;
identifying security risks associated with the plurality of vulnerabilities based on a type of the plurality of vulnerabilities;
identifying a plurality of policies associated with the plurality of vulnerabilities based on the type of the plurality of vulnerabilities and the end user device, wherein the plurality of policies is specified for the plurality of end user devices;
determining remediation for the plurality of vulnerabilities based on the plurality of policies, wherein the plurality of policies is based on the cloud service, a tenant of the end user device, and/or a user role associated with the end user device;
identifying a route from a plurality of routes corresponding to the plurality of policies and the cloud service, wherein:
the route specifies the end user device or a mid-link server of the cloud-based multi-tenant system;
the plurality of routes is specified for the plurality of policies; and
the plurality of routes through the cloud-based multi-tenant system delivers the plurality of cloud services to the plurality of end user devices;
executing the remediation of the plurality of firmware by upgrading the plurality of firmware based on the plurality of policies; and
communicating via the route between the application and the cloud service based on the plurality of policies.
17. The cloud-based multi-tenant system for the policy-based vulnerability management as recited in claim 16 , further comprising prioritizing the remediation of the plurality of firmware based on the type of the plurality of vulnerabilities, the security risks, and the plurality of policies.
18. The cloud-based multi-tenant system for the policy-based vulnerability management as recited in claim 16 , wherein the plurality of policies varies with each tenant of a plurality of tenants of the cloud-based multi-tenant system.
19. The cloud-based multi-tenant system for the policy-based vulnerability management as recited in claim 16 , wherein the remediation is performed by an administrator through the mid-link server.
20. The cloud-based multi-tenant system for the policy-based vulnerability management as recited in claim 16 , wherein the configuration items include hostnames, IP addresses, models, make, roles, or software versions of the plurality of firmware.