System and method of managing network security risks

Abstract

A security risk management system comprises a vulnerability database, an asset database, a local threat intelligence database and a threat correlation module. The vulnerability database comprises data about security vulnerabilities of assets on a network gathered using active or passive vulnerability assessment techniques. The asset database comprises data concerning attributes of each asset. The threat correlation module receives threat intelligence alerts that identify attributes and vulnerabilities associated with security threats that affect classes of assets. The threat correlation module compares asset attributes and vulnerabilities with threat attributes and vulnerabilities and displays a list of assets that are affected by a particular threat. The list can be sorted according to a calculated risk score, allowing an administrator to prioritize preventive action and respond first to threats that affect higher risk assets. The security risk management system provides tools for performing preventive action and for tracking the success of preventive action.

Description

BACKGROUND OF THE INVENTION[0001]1. Field of the Invention[0002]Embodiments of the invention relate to managing threats to network security.[0003]2. Description of the Related Art[0004]Computer networks are exposed to a large number of vulnerabilities to network security, including open ports, flawed application programs, worms, viruses, trojan horses, and the like. At times, individuals, groups of individuals, or automated programs, either intentionally or unwittingly, take advantage of these vulnerabilities to compromise network security. Attempts to compromise network security include attempts to damage data, to infect one or more computers with viruses or worms, and to access a computer system without authorization.[0005]Automated vulnerability scanners scan the assets and nodes of a network to discover active devices (thereby building an asset inventory) and to detect the vulnerabilities that exist on a network. Based on the information provided by vulnerability scanners, admin...

AI Technical Summary

Benefits of technology

"The invention provides a system for managing network security threats by using a threat correlation module to identify assets that are vulnerable to security threats. The system receives threat intelligence alerts that include data about security threats and compares them with data about assets on the network. The system displays a list of affected assets with a risk score based on their vulnerabilities and attributes. The system also includes a compliance tracking module to measure compliance with security goals and a threat update module to update vulnerabilities in assets. The technical effect of the invention is to provide a more efficient and effective way to manage network security threats by identifying vulnerable assets and remedying them in a timely manner."

Problems solved by technology

Computer networks are exposed to a large number of vulnerabilities to network security, including open ports, flawed application programs, worms, viruses, trojan horses, and the like.

At times, individuals, groups of individuals, or automated programs, either intentionally or unwittingly, take advantage of these vulnerabilities to compromise network security.

Attempts to compromise network security include attempts to damage data, to infect one or more computers with viruses or worms, and to access a computer system without authorization.

Many administrators, however, have neither the time nor the experience to maintain up-to-date knowledge of network security threats.

Images