Granted Patent B1

US 12,284,204 · App. 18/516,882 · Granted Apr 22, 2025

Inventors: Stefan Horst-Guenter Molls (Nuremberg, DE); Joshua M. Bryant (Pecatonica, IL); Keith A. Robertson (Wasilla, AK); John E. Foscue (Huntington Beach, CA)

Assignee: Tanium Inc.

H04L63/1433G06F8/65H04L63/102H04L63/104H04L63/1441

Abstract

Claims (87)

1. A method, performed by a server system for determining a risk assessment for a collection of machines coupled to the server system via one or more communication networks, the method comprising:

receiving by the server system via one or more communication interfaces, for each endpoint machine of a plurality of machines in the collection of machines, endpoint risk information, wherein each endpoint machine of the plurality of machines has an assigned importance rating;

for each vulnerability in a predefined set of vulnerabilities, calculating by the server system for each particular endpoint machine of the plurality of machines:

a direct vulnerability risk score for the particular endpoint machine, based on the received endpoint risk information for the particular endpoint machine; and

a derivative vulnerability risk score, based on the direct vulnerability risk score for the particular endpoint machine and lateral movement values for the particular endpoint machine, wherein each lateral movement value for the particular endpoint machine corresponds to a number of logically coupled machines that are logically coupled to the particular endpoint machine via lateral movement that comprises access to the particular endpoint machine via one or more other machines in the collection of machines using administrative rights that enable access by users of said one or more other machines in the collection of machines to the particular endpoint machine; and

sorting the vulnerabilities, in the predefined set of vulnerabilities, based at least in part on the derivative vulnerability risk scores, corresponding to those vulnerabilities, for the endpoint machines of the plurality of machines, so as to identify security risks in the collection of machines.

2. The method of claim 1 , including:

presenting in a first user interface a sorted list of endpoint machines that is sorted in accordance with the derivative vulnerability risk scores or direct vulnerability risk scores corresponding to one or more vulnerabilities in the predefined set of vulnerabilities; wherein the first user interface includes, for each individual machine in at least a subset of the machines listed in the first user interface, a link for accessing additional information about risk factors and a link for accessing one or more remediation tools for remediating one or more security risks; and

performing a respective security risk remediation action in accordance with user selection of a respective remediation tool of the one or more remediation tools.

3. The method of claim 1 , wherein receiving the endpoint risk information includes receiving at least some of the endpoint risk information responsive to one or more data requests sent to the plurality of machines via the one or more communication networks.

4. The method of claim 1 , wherein

the one or more communication networks comprise one or more linear communication orbits;

receiving the endpoint risk information includes receiving at least some of the endpoint risk information responsive to one or more data requests sent to the plurality of machines via the one or more linear communication orbits, including communicating a respective data request from machine to machine in a respective linear communication orbit of the one or more linear communication orbits via a forward or backward communication channel of the respective linear communication orbit.

5. The method of claim 1 , wherein the importance rating assigned to a respective endpoint machine of the plurality of machines is based on an extent to which the respective endpoint machine stores or has access to sensitive information.

6. The method of claim 1 , including:

presenting, in a second user interface, a graph representing lateral movement for a respective endpoint machine, wherein the graph displays one or more paths for gaining access to the respective endpoint based on a risk factor of the respective endpoint machine for a selected vulnerability of the predefined set of vulnerabilities.

7. The method of claim 1 , wherein calculating the derivative vulnerability risk score for the particular endpoint machine includes applying a weight to a number of machines affected by a respective vulnerability, wherein the weight is selected based on an importance rating of the machines affected by the respective vulnerability.

8. The method of claim 1 , including calculating group risk scores for a group of users identified by administrative rights information of the plurality of machines, including:

calculating a direct group risk assessment value for the group of users based on a number of machines that are accessible to the group of users using direct administrative rights; and

calculating a derivative group risk assessment for the group of users based on a number of machines that are accessible to the group of users using lateral movement.

9. The method of claim 1 , wherein the endpoint risk information for the particular endpoint machine includes one or more of:

a number of direct administrators of the particular machine;

a number of indirect administrators of the particular machine;

a first number of vulnerabilities present in the particular machine having vulnerability scores in a first score value range;

a second number of vulnerabilities present in the particular machine having vulnerability scores in a second score value range distinct from the first score value range;

a number of missing software patches; and

a number of open sessions between respective users and the particular machine.

10. The method of claim 1 , wherein the lateral movement values are determined by generating one or more graphs representing relationships between users, groups of users, and endpoint machines.

11. A server system, comprising:

one or more communications interfaces for coupling the server system to machines in a collection of machines via one or more communication networks;

one or more processors; and

memory storing one or more programs, wherein the one or more programs include instructions for:

receiving by the server via the one or more communication interfaces, for each endpoint machine of a plurality of machines in the collection of machines, endpoint risk information, wherein each endpoint machine of the plurality of machines has an assigned importance rating;

for each vulnerability in a predefined set of vulnerabilities, calculating by the server system for each particular endpoint machine of the plurality of machines:

a direct vulnerability risk score for the particular endpoint machine, based on the received endpoint risk information for the particular endpoint machine; and

a derivative vulnerability risk score, based on the direct vulnerability risk score for the particular endpoint machine and lateral movement values for the particular endpoint machine, wherein each lateral movement value for the particular endpoint machine corresponds to a number of logically coupled machines that are logically coupled to the particular endpoint machine via lateral movement that comprises access to the particular endpoint machine via one or more other machines in the collection of machines using administrative rights that enable access by users of said one or more other machines in the collection of machines to the particular endpoint machine; and

sorting the vulnerabilities, in the predefined set of vulnerabilities, based at least in part on the derivative vulnerability risk scores, corresponding to those vulnerabilities, for the endpoint machines of the plurality of machines, so as to identify security risks in the collection of machines.

12. The server system of claim 11 , the one or more programs further including instructions for:

presenting in a first user interface a sorted list of endpoint machines that is sorted in accordance with the derivative vulnerability risk scores or direct vulnerability risk scores corresponding to one or more vulnerabilities in the predefined set of vulnerabilities; wherein the first user interface includes, for each individual machine in at least a subset of the machines listed in the first user interface, a link for accessing additional information about risk factors and a link for accessing one or more remediation tools for remediating one or more security risks; and

performing a respective security risk remediation action in accordance with user selection of a respective remediation tool of the one or more remediation tools.

13. The server system of claim 11 , wherein receiving the endpoint risk information includes receiving at least some of the endpoint risk information responsive to one or more data requests sent to the plurality of machines via the one or more communication networks.

14. The server system of claim 11 , wherein:

the one or more communication networks comprise one or more linear communication orbits;

receiving the endpoint risk information includes receiving at least some of the endpoint risk information responsive to one or more data requests sent to the plurality of machines via the one or more linear communication orbits, including communicating a respective data request from machine to machine in a respective linear communication orbit of the one or more linear communication orbits via a forward or backward communication channel of the respective linear communication orbit.

15. The server system of claim 11 , wherein the importance rating assigned to a respective endpoint machine of the plurality of machines is based on an extent to which the respective endpoint machine stores or has access to sensitive information.

16. The server system of claim 11 , the one or more programs further including instructions for:

presenting, in a second user interface, a graph of lateral movement for a respective endpoint machine, wherein the graph displays one or more paths for gaining access to the respective endpoint based on a risk factor of the respective endpoint machine for a selected vulnerability of the predefined set of vulnerabilities.

17. The server system of claim 11 , wherein calculating the derivative vulnerability risk score for the particular endpoint machine includes applying a weight to a number of machines affected by a respective vulnerability, wherein the weight is selected based on an importance rating of the machines affected by the respective vulnerability.

18. The server system of claim 11 , the one or more programs further including instructions for calculating group risk scores for a group of users identified by administrative rights information of the plurality of machines, including:

calculating a direct group risk assessment value for the group of users based on a number of machines that are accessible to the group of users using direct administrative rights; and

calculating a derivative group risk assessment for the group of users based on a number of machines that are accessible to the group of users using lateral movement.

19. The server system of claim 11 , wherein the endpoint risk information for the particular endpoint machine includes one or more of:

a number of direct administrators of the particular machine;

a number of indirect administrators of the particular machine;

a first number of vulnerabilities present in the particular machine having vulnerability scores in a first score value range;

a second number of vulnerabilities present in the particular machine having vulnerability scores in a second score value range distinct from the first score value range;

a number of missing software patches; and

a number of open sessions between respective users and the particular machine.

20. The server system of claim 11 , wherein the lateral movement values are determined by generating one or more graphs representing relationships between users, groups of users, and endpoint machines.

21. A non-transitory computer readable storage medium storing one or more programs for execution by one or more processors of a server system coupled via one or more communication networks to machines in a collection of machines, the one or more programs including instructions for:

receiving by the server via the one or more communication interfaces, for each endpoint machine of a plurality of machines in the collection of machines, endpoint risk information, wherein each endpoint machine of the plurality of machines has an assigned importance rating;

for each vulnerability in a predefined set of vulnerabilities, calculating by the server system for each particular endpoint machine of the plurality of machines:

a direct vulnerability risk score for the particular endpoint machine, based on the received endpoint risk information for the particular endpoint machine; and

a derivative vulnerability risk score, based on the direct vulnerability risk score for the particular endpoint machine and lateral movement values for the particular endpoint machine, wherein each lateral movement value for the particular endpoint machine corresponds to a number of logically coupled machines that are logically coupled to the particular endpoint machine via lateral movement that comprises access to the particular endpoint machine via one or more other machines in the collection of machines using administrative rights that enable access by users of said one or more other machines in the collection of machines to the particular endpoint machine; and

sorting the vulnerabilities, in the predefined set of vulnerabilities, based at least in part on the derivative vulnerability risk scores, corresponding to those vulnerabilities, for the endpoint machines of the plurality of machines, so as to identify security risks in the collection of machines.

22. The non-transitory computer readable storage medium of claim 21 , the one or more programs further including instructions for:

presenting in a first user interface a sorted list of endpoint machines that is sorted in accordance with the derivative vulnerability risk scores or direct vulnerability risk scores corresponding to one or more vulnerabilities in the predefined set of vulnerabilities; wherein the first user interface includes, for each individual machine in at least a subset of the machines listed in the first user interface, a link for accessing additional information about risk factors and a link for accessing one or more remediation tools for remediating one or more security risks; and

performing a respective security risk remediation action in accordance with user selection of a respective remediation tool of the one or more remediation tools.

23. The non-transitory computer readable storage medium of claim 21 , wherein receiving the endpoint risk information includes receiving at least some of the endpoint risk information responsive to one or more data requests sent to the plurality of machines via the one or more communication networks.

24. The non-transitory computer readable storage medium of claim 21 , wherein:

the one or more communication networks comprise one or more linear communication orbits;

receiving the endpoint risk information includes receiving at least some of the endpoint risk information responsive to one or more data requests sent to the plurality of machines via the one or more linear communication orbits, including communicating a respective data request from machine to machine in a respective linear communication orbit of the one or more linear communication orbits via a forward or backward communication channel of the respective linear communication orbit.

25. The non-transitory computer readable storage medium of claim 21 , wherein the importance rating assigned to a respective endpoint machine of the plurality of machines is based on an extent to which the respective endpoint machine stores or has access to sensitive information.

26. The non-transitory computer readable storage medium of claim 21 , the one or more programs further including instructions for:

presenting, in a second user interface, a graph of lateral movement for a respective endpoint machine, wherein the graph displays one or more paths for gaining access to the respective endpoint based on a risk factor of the respective endpoint machine for a selected vulnerability of the predefined set of vulnerabilities.

27. The non-transitory computer readable storage medium of claim 21 , wherein calculating the derivative vulnerability risk score for the particular endpoint machine includes applying a weight to a number of machines affected by a respective vulnerability, wherein the weight is selected based on an importance rating of the machines affected by the respective vulnerability.

28. The non-transitory computer readable storage medium of claim 21 , the one or more programs further including instructions for calculating group risk scores for a group of users identified by administrative rights information of the plurality of machines, including:

calculating a direct group risk assessment value for the group of users based on a number of machines that are accessible to the group of users using direct administrative rights; and

calculating a derivative group risk assessment for the group of users based on a number of machines that are accessible to the group of users using lateral movement.

29. The non-transitory computer readable storage medium of claim 21 , wherein the endpoint risk information for the particular endpoint machine includes one or more of:

a number of direct administrators of the particular machine;

a number of indirect administrators of the particular machine;

a first number of vulnerabilities present in the particular machine having vulnerability scores in a first score value range;

a second number of vulnerabilities present in the particular machine having vulnerability scores in a second score value range distinct from the first score value range;

a number of missing software patches; and

a number of open sessions between respective users and the particular machine.

30. The non-transitory computer readable storage medium of claim 21 , wherein the lateral movement values are determined by generating one or more graphs representing relationships between users, groups of users, and endpoint machines.

Continuity (2)

References Cited (382)