System and method for evaluating risk of a vulnerability
Techniques, methods and/or apparatuses are disclosed that enable prioritization of vulnerabilities in different applications or the same application on different assets. A risk assessment component collects information related to the use environment, activity, functions, and configuration of a device and each of its applications. This collected information is analyzed to prioritize vulnerabilities that may be common across applications but have different levels of risk of exploitation based on their environment, activity, functions, or configuration. The risk of exploitation of a vulnerability is calculated for each asset, for each application, and each application on an asset.
1. A method of prioritizing vulnerabilities in applications of a system, the method comprising:
obtaining risk information corresponding to one or more assets of the system;
scanning the one or more assets for first application information relating to at least two applications installed on the one or more assets;
determining a risk score of a vulnerability or a set of vulnerabilities that is specific to a first application of the at least two applications installed on the one or more assets, the risk score of the vulnerability or the set of vulnerabilities being based on the risk information and the first application information,
wherein the risk score is based on the presence or absence of one or more asset-specific attributes required for successful exploitation of the vulnerability or the set of vulnerabilities,
wherein the risk score is one of a plurality of risk scores, each of the plurality of risk scores associated with a respective vulnerability or a respective set of vulnerabilities associated with the one or more assets; and
sorting the plurality of risk scores to facilitate remediation of associated vulnerabilities in order of riskiness.
2. The method of claim 1 , wherein obtaining the risk information comprises:
obtaining a first set of risk factors corresponding to activity or environment of the one or more assets; and
obtaining a second set of risk factors corresponding to functions or configurations of the one or more assets; or
obtaining a third set of risk factors corresponding to activity or environment of the applications on the one or more assets; and
obtaining a fourth set of risk factors corresponding to functions or configurations of the applications on the one or more assets.
3. The method of claim 2 , wherein the first set of risk factors includes one or more activity indicators corresponding to behavior of users of the one or more assets, to activity in the applications of the one or more assets, to usage patterns of at least one interface of the one or more assets, or a combination thereof, and
wherein the first set of risk factors includes one or more environmental indicators corresponding to connection history of the one or more assets, to hosting of public facing resources, to encryption status, to sharing of the one or more assets, or a combination thereof.
4. The method of claim 2 , wherein the second set of risk factors includes one or more functional risk indicators corresponding to connection capabilities of the asset, installed application program interfaces (APIs), accessibility from public internet, access permissions, or a combination thereof, and
wherein the second set of risk factors includes one or more configuration risk indicators corresponding to auto-connect settings, auto-play settings, open ports, registry settings, API configurations, auto-update settings, or a combination thereof.
5. The method of claim 2 , wherein the determining further comprises:
obtaining one or more rules corresponding to the vulnerability or the set of vulnerabilities;
determining whether the one or more rules apply to one or more of the at least two applications; and
generating a first risk score if the one or more rules apply to an application of the at least two applications, or
generating a second risk score if the one or more rules do not apply to an application of the at least two applications,
wherein the first risk score or the second risk score for the application are generated based on the risk score being based on the first set of risk factors, the second set of risk factors, and the first application information that corresponds to the application.
6. The method of claim 2 , wherein the first set of risk factors and the second set of risk factors are applied as weights in determining the risk score for a particular vulnerability for at least one application.
7. The method of claim 2 , wherein, in determining the risk score, the first set of risk factors and the second set of risk factors are scaled based on a risk correlation with at least one application.
8. The method of claim 1 , the determining further comprising:
determining a separate risk score for the vulnerability or the set of vulnerabilities corresponding to each application of the at least two applications installed on the one or more assets.
9. The method of claim 1 , wherein the first application information includes a version record, one or more dependencies required by one or more of the at least two applications, one or more libraries accessed by one or more of the at least two applications, or one or more containers or databases managed by the at least two applications.
10. The method of claim 1 , further comprising:
sorting a list of the at least two applications for each of the one or more assets based on vulnerability risk scores specific to each application of the at least two applications.
11. A system to prioritize vulnerabilities, the system comprising:
a memory; and
at least one processor coupled to the memory,
wherein the memory and the at least one processor are configured to:
obtain risk information corresponding to one or more assets;
scan the one or more assets for first application information related to at least two applications installed on the one or more assets;
determine a risk score of a vulnerability or a set of vulnerabilities that is specific to at least one first application of the at least two applications installed on the one or more assets, the risk score of the vulnerability or the set of vulnerabilities being based on the risk information and the first application information,
wherein the risk score is based on the presence or absence of one or more asset-specific attributes required for successful exploitation of the vulnerability or the set of vulnerabilities,
wherein the risk score is one of a plurality of risk scores, each of the plurality of risk scores associated with a respective vulnerability or a respective set of vulnerabilities associated with the one or more assets; and
sort the plurality of risk scores to facilitate remediation of associated vulnerabilities in order of riskiness.
12. The system of claim 11 , wherein obtaining the risk information comprises:
obtaining a first set of risk factors corresponding to activity or environment of the one or more assets; and
obtaining a second set of risk factors corresponding to functions or configurations of the one or more assets; or
obtaining a third set of risk factors corresponding to activity or environment of the applications on the one or more assets; and
obtaining a fourth set of risk factors corresponding to functions or configurations of the applications on the one or more assets.
13. The system of claim 12 , wherein the first set of risk factors includes one or more activity indicators corresponding to behavior of users of the one or more assets, to activity in the at least two applications on the one or more assets, to usage patterns of at least one interface of the one or more assets, or a combination thereof, and
wherein the first set of risk factors includes one or more environmental indicators corresponding to connection history of the one or more assets, to hosting of public facing resources, to encryption status, to sharing of the one or more assets, or a combination thereof.
14. The system of claim 12 , wherein the second set of risk factors includes one or more functional risk indicators corresponding to connection capabilities of the asset, installed application program interfaces (APIs), accessibility from public internet, access permissions, or a combination thereof, and
wherein the second set of risk factors includes one or more configuration risk indicators corresponding to auto-connect settings, auto-play settings, open ports, registry settings, API configurations, auto-update settings, or a combination thereof.
15. The system of claim 12 , wherein the first set of risk factors and the second set of risk factors are applied as weights in determining the risk score of the vulnerability or the set of vulnerabilities for at least one application.
16. The system of claim 12 , wherein, in determining the risk score, the first set of risk factors and the second set of risk factors are scaled based on a risk correlation with at least one application.
17. The system of claim 11 , further comprising:
a display with a graphical user interface (GUI), wherein the memory and the at least one processor are configured to:
sort a list of the at least two applications for each of the one or more assets based on vulnerability risk scores specific to each application of the at least two applications.
18. The system of claim 11 , wherein the memory and the at least one processor are configured to:
obtain one or more rules corresponding to the vulnerability or the set of vulnerabilities;
determine whether the one or more rules apply to one or more of the at least two applications; and
generate a first risk score if the one or more rules apply to an application of the at least two applications, or
generate a second risk score if the one or more rules do not apply to an application of the at least two applications,
wherein the first risk score or the second risk score for the application are generated based on the risk score, the risk score being based on the risk information and the first application information that corresponds to the application.
19. The system of claim 11 , wherein the memory and the at least one processor are configured to:
determine a separate risk score for the vulnerability or the set of vulnerabilities that is specific to each application of the at least two applications installed on the one or more assets.
20. The system of claim 11 , wherein the first application information includes a version record, one or more dependencies required by one or more of the at least two applications, one or more libraries accessed by one or more of the at least two applications, or one or more containers or databases managed by the at least two applications.
21. A system that determines risk of vulnerability exploitation, the system comprising:
at least two hardware or virtual hardware assets, the at least two hardware or virtual hardware assets having at least two software applications installed thereon; and
at least one endpoint agent that:
extracts first application information corresponding to the at least two software applications,
logs environmental and activity information for the at least two hardware or virtual hardware assets, the environmental and activity information corresponding to a first set of risk factors,
collects functional information corresponding to the at least two software applications,
collects configuration information corresponding to the at least two software applications, the functional information and the configuration information corresponding to a second set of risk factors, and
generates a risk score for exploitation of a vulnerability or a set of vulnerabilities for each application of the at least two software applications based on the first set of risk factors, the second set of risk factors, and the first application information,
wherein the risk score is based on the presence or absence of one or more asset-specific attributes required for successful exploitation of the vulnerability or the set of vulnerabilities,
wherein the risk score is one of a plurality of risk scores, each of the plurality of risk scores associated with a respective vulnerability or a respective set of vulnerabilities associated with the one or more assets; and
sorts the plurality of risk scores to facilitate remediation of associated vulnerabilities in order of riskiness.
22. The system of claim 21 , wherein the risk scores for exploitation of the vulnerability or the set of vulnerabilities are generated for each application of the at least two software applications on each asset of the at least two hardware or virtual hardware assets such that a particular risk score of the risk scores is associated with a particular asset, application, and vulnerability combination.