Risk scoring system for vulnerability mitigation
Apparatus, methods, and articles of manufacture or disclosed for implementing risk scoring systems used for vulnerability mitigation in a distributed computing environment. In one disclosed example, a computer-implemented method of mitigating vulnerabilities within a computing environment includes producing a risk score indicating at least one of: a vulnerability component, a security configuration component, or a file integrity component for an object within the computing environment, producing a signal score indicating a factor that contributes to risk for the object, and combining the risk score and the signal score to produce a combined risk score indicating a risk level associated with at least one vulnerability of the computing system object. In some examples, the method further includes mitigating the at least one vulnerability by changing a state of a computing object using the combined risk score.
1. A computer-implemented method of mitigating vulnerabilities within a computing environment, the method comprising:
producing a risk score based at least in part on a vulnerability component for an object within the computing environment, wherein the vulnerability component comprises at least an age component, wherein the risk score follows a model of:
from a minimum value for the age component, increasing to a local maxima as the age component reaches a first predetermined age,
decreasing to a local minima as the age component approaches a second predetermined age from the first predetermined age, the second predetermined age being greater than the first predetermined age, and
increasing as the age component increases past the second predetermined age;
producing a signal score indicating a factor that contributes to risk for the object; and
combining the risk score and the signal score to produce a combined risk score indicating a risk level associated with at least one vulnerability of the computing system object.
2. The method of claim 1 , further comprising:
producing a vision score comprising at least one bucket for risk of the vulnerability on the network.
3. The method of claim 1 , further comprising:
mitigating one or more of the at least vulnerability by changing a state of at least one object within the computing environment.
4. The method of claim 1 , further comprising:
mitigating a vulnerability identified in the computing environment using the combined risk score by changing a state of at least one computing object.
5. The method of claim 1 , further comprising:
displaying the risk score, the signal score, the combined risk score, or an overall risk score using a graphical display coupled to a computing device within the computing environment.
6. The method of claim 1 , wherein:
the producing the vulnerability score comprises determining at least one of: the age of the vulnerability, the skill required to exploit the vulnerability, or the outcome of a successful exploitation of the vulnerability.
7. The method of claim 1 , wherein:
the producing the risk score and/or the signal score comprises indicating a crowned vulnerability deemed to need immediate mitigation.
8. The method of claim 1 , wherein:
the risk score is determined by combining at least one of the following components: a risk component, a skill component, an age component, or a categorization component.
9. The method of claim 1 , wherein:
the risk score is determined by determining a security configuration management score and/or a file integrity management score.
10. The method of claim 1 , wherein:
the signal score is determined by evaluating at least one of a single type component, a criticality component, and/or a test component of an object in the computing environment.
11. The method of claim 1 , wherein:
the signal score is based on at least one of: a name component, a description component, a single type component, a criticality component, a data source component, a data value component, a test count, a test method, a per test data component, a test definition component, and execution order component, a data match component, a midpoint identifier component, as no signal match component, or a no data source available component.
12. The method of claim 1 , wherein:
the combining the risk score and the signal score is based on a criticality indicated by the signal score.
13. The method of claim 1 , wherein:
the producing the vulnerability score, the producing the signal score, or combining the vulnerability score and the risk score includes a factor that contributes to risk for the object.
14. The method comprising computing an overall system risk score by combining two or more combined risk scores generating by the method of claim 1 .
15. The method of claim 14 , further comprising displaying the overall system risk score on a display coupled to a computing system, the display including at least one of a numerical indication of the overall system risk score, a graphical indicator of the overall system risk score, or a color shaded indicator of the overall system or score.
16. The method of claim 1 , wherein the risk score is further produced based at least in part on one or more of a security configuration component and a file integrity component for the object within the computing environment.
17. One or more non-transitory computer readable storage media storing computer readable instructions, which when executed by a computer cause the computer to:
produce a risk score based at least in part on a vulnerability component for an object within the computing environment, wherein the vulnerability component comprises at least an age component, wherein the risk score follows a model of:
from a minimum value for the age component, increasing to a local maxima as the age component reaches a first predetermined age,
decreasing to a local minima as the age component approaches a second predetermined age from the first predetermined age, the second predetermined age being greater than the first predetermined age, and
increasing as the age component increases past the second predetermined age;
produce a signal score indicating a factor that contributes to risk for the object; and
combine the risk score and the signal score to produce a combined risk score indicating a risk level associated with at least one vulnerability of the computing system object.
18. An apparatus, comprising:
a processor; and
one or more non-transitory computer readable storage media storing computer readable instructions, which when executed by the processor cause the apparatus to:
produce a risk score based at least in part on a vulnerability component for an object within the computing environment, wherein the vulnerability component comprises at least an age component, wherein the risk score follows a model of:
from a minimum value for the age component, increasing to a local maxima as the age component reaches a first predetermined age,
decreasing to a local minima as the age component approaches a second predetermined age from the first predetermined age, the second predetermined age being greater than the first predetermined age, and
increasing as the age component increases past the second predetermined age;
produce a signal score indicating a factor that contributes to risk for the object; and
combine the risk score and the signal score to produce a combined risk score indicating a risk level associated with at least one vulnerability of the computing system object.
19. The apparatus of claim 18 , further comprising:
a risk score component implemented with an agent executed by a processor or a device profiler coupled to a compute object for which the risk score is determined.