System and method for a user activated penetration test
View Patent ↗A system ( 100 ) and method ( 900 ) enabling a user ( 80 ) to initiate a penetration request ( 300 ) on an assessed computer ( 220 ). The penetration application ( 310 ) is communicated from a host computer ( 210 ) to the assessed computer ( 220 ) on a network ( 230 ). The penetration application ( 310 ) can be used to create vulnerability data ( 500 ) relating to the assessed computer ( 220 ). Different embodiments of the system ( 100 ) can involve a variety of different operating modes ( 110 ).
1. A computer-implemented method ( 900 ) that is initiated by a user ( 80 ) for acquiring a plurality of vulnerability data ( 500 ) for an assessed computer ( 220 ), the method ( 900 ) comprising:
receiving ( 910 ) on a host computer ( 210 ) a penetration request ( 300 ) from the assessed computer ( 220 );
running ( 920 ) a penetration application ( 310 ) from the host computer ( 210 ) on the assessed computer ( 220 ); and
collecting ( 930 ) the plurality of vulnerability data ( 500 ) from the assessed computer ( 220 ) with the penetration application ( 310 );
wherein said vulnerability data ( 500 ) includes a reused password ( 560 ) and a missing security tool ( 550 ).
2. The method ( 900 ) of claim 1 , wherein said penetration application ( 310 ) is adapted to operate in at least one of a plurality of operating modes ( 110 ), said plurality of operating modes ( 110 ) including a snap-shot mode ( 112 ), a training mode ( 114 ), and a continuous surveillance mode ( 116 ), said method ( 900 ) further comprising enabling the user ( 80 ) to instantaneously switch from a first said operating mode ( 110 ) to a second said operating mode ( 110 ).
3. The method ( 900 ) of claim 1 , said method ( 900 ) further comprising communicating to the user ( 80 ) a remediation suggestion ( 610 ) that is a step-by-step instruction showing the user ( 80 ) to make a configuration improvement on the accessed computer ( 220 ).
4. The method ( 900 ) of claim 3 , said method ( 900 ) further comprising automatically implementing the step-by-step instruction without human intervention by the user ( 80 ).
5. The method ( 900 ) of claim 1 , wherein said assessed computer ( 220 ) is on a network ( 230 ) that includes a plurality of assessed computers ( 220 ), and wherein said assessed computer ( 220 ) is protected by firewall ( 240 ) and said host computer ( 210 ) is outside of said firewall ( 240 ).
6. The method ( 900 ) of claim 1 , wherein said plurality of vulnerability data ( 500 ) further includes a user error.
7. The method ( 900 ) of claim 1 , said method ( 900 ) further comprising creating a remediation suggestion ( 610 ) automatically without human intervention that is communicated to the user ( 80 ).
8. The method ( 900 ) of claim 1 , further comprising storing ( 940 ) at least a subset of said vulnerability data ( 500 ) in an encrypted vault ( 330 ).
9. The method ( 900 ) of claim 1 , wherein said plurality of vulnerability data ( 500 ) includes a missing security tool ( 550 ), a personally identifiable datum ( 570 ), a network configuration ( 580 ), and a domain security policy ( 590 ).
10. The method ( 900 ) of claim 1 , wherein said plurality of vulnerability data ( 500 ) includes a configuration datum.
11. The method ( 900 ) of claim 1 , further comprising
comparing ( 950 ) at least a subset of said vulnerability data ( 500 ) with an updatable security database ( 600 ) and
invoking ( 960 ) an artificial intelligence engine ( 340 ) that uses said plurality of vulnerability data ( 500 ) and said updatable security database ( 600 ) as a plurality of inputs ( 610 ).
12. The method ( 900 ) of claim 11 , further comprising updating ( 970 ) said updatable security database ( 600 ) using said plurality of inputs ( 610 ) and said artificial intelligence engine ( 340 ).
13. The method ( 900 ) of claim 11 , wherein said artificial intelligence engine ( 340 ) includes an expert system engine ( 342 ) and a machine learning engine ( 344 ).
14. A computer-implemented method ( 900 ) that is initiated by a user ( 80 ) for acquiring a plurality of vulnerability data ( 500 ) for an assessed computer ( 220 ), the method ( 900 ) comprising:
receiving ( 910 ) a penetration request ( 300 ) from the assessed computer ( 220 ) that is communicated to a host computer ( 210 ) over a network ( 230 ), wherein said network ( 230 ) is a friendly network ( 232 );
running ( 920 ) a penetration application ( 310 ) received from the host computer ( 210 ) and delivered to the assessed computer ( 220 ) over said friendly network ( 232 ), wherein said penetration application ( 310 ) is adapted to operate in a plurality of operating modes ( 110 ), said plurality of operating modes ( 110 ) including a snap-shot mode ( 112 ), a training mode ( 114 ), and a continuous surveillance mode ( 116 ); and
collecting ( 930 ) the plurality of vulnerability data ( 500 ) from the assessed computer ( 220 ) with the penetration application ( 310 );
wherein said vulnerability data ( 500 ) includes a reused password ( 560 ) and a missing security tool ( 550 ).
15. The method ( 900 ) of claim 14 , said method further comprising:
storing ( 940 ) at least a subset of said vulnerability data ( 500 ) in an encrypted vault ( 330 );
comparing ( 950 ) at least a subset of said vulnerability data ( 500 ) with an updatable security database ( 600 ); and
invoking ( 960 ) an artificial intelligence engine ( 340 ) that uses said plurality of vulnerability data ( 500 ) and said updatable security database ( 600 ) as a plurality of inputs ( 620 ).
16. The method ( 900 ) of claim 14 , wherein said assessed computer ( 220 ) is protected by firewall ( 240 ) and said host computer ( 210 ) is outside of said firewall ( 240 ), wherein said assessed computer ( 220 ) is on a network ( 230 ) that includes a plurality of assessed computers ( 220 ), and wherein said plurality of vulnerability data ( 500 ) includes a plurality of accounts data ( 510 ), a plurality of antivirus data ( 520 ), a plurality of firewall data ( 530 ), a plurality of encryption data ( 540 ), and a remediation suggestion ( 610 ).
17. The method ( 900 ) of claim 16 , wherein said remediation suggestion ( 610 ) includes a cracked password ( 612 ).
18. The method ( 900 ) of claim 14 , wherein said vulnerability data ( 500 ) includes a vulnerability metric ( 590 ).
19. A system ( 100 ) for assessing the security of an assessed computer ( 220 ) by using a penetration application ( 310 ) communicated from a host computer ( 210 ) on a friendly network ( 232 ) across a firewall ( 240 ), said system ( 100 ) comprising:
said host computer ( 210 ), wherein said host computer ( 210 ) includes a penetration application ( 310 ); and
said assessed computer ( 220 ), wherein said assessed computer ( 210 ) is adapted to communicate a penetration request ( 300 ) to said host computer over said friendly network ( 232 );
wherein said penetration application ( 310 ) is adapted to capture and store a plurality of vulnerability data ( 500 ) pertaining to said assessed computer ( 220 ),
wherein said vulnerability data ( 500 ) includes a reused password ( 560 ) and a missing security tool ( 550 ).