Asset Valuation Prioritization for Vulnerability Remediation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In distributed computing environments, network asset managers face challenges in prioritizing vulnerabilities due to limited capacity and subjective methods, often leading to inefficient remediation efforts.

Innovation Solution

A computer-implemented method for ranking and scoring assets based on remediation action measurements and asset value and risk measurements, including obtaining information about assets, determining asset valuation factors, computing remediation costs, and calculating returns on investment for remediating vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If subjective prioritization methods are used for vulnerability management, then ease of operation is improved, but productivity deteriorates due to inefficient remediation efforts

Engineering Contradiction:

Improveease of vulnerability prioritizationVSAvoidremediation efficiency

Core Design Contradiction:

Ease of operationVSProductivity

Solution Approach 1:

The system enables automated self-service vulnerability prioritization by computing risk scores based on asset criticality, vulnerability severity, and exploitation likelihood without human intervention, resolving the contradiction between ease of operation and remediation efficiency

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The invention transforms subjective prioritization into objective parameter-based scoring by quantifying asset criticality, vulnerability severity, and exploitation likelihood into a composite risk score, improving both ease of operation and productivity simultaneously

Inventive Principle:

Principle #35Parameter changes

2Reliability

If all vulnerabilities are addressed immediately, then reliability is improved, but loss of time increases due to limited capacity

Engineering Contradiction:

Improvesecurity postureVSAvoidtime to remediate

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary risk assessment and prioritization before remediation, computing risk scores that guide the sequence of remediation activities to maximize security improvement while minimizing time loss

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention implements partial action by addressing only the most critical vulnerabilities first based on risk scores, rather than attempting to fix all vulnerabilities simultaneously, optimizing the balance between reliability improvement and time consumption

Inventive Principle:

Principle #16Partial or excessive action

3Ease of operation

If resource allocation is based on subjective criteria, then ease of operation is improved, but productivity deteriorates due to suboptimal resource utilization

Engineering Contradiction:

Improveease of resource allocationVSAvoidresource utilization efficiency

Core Design Contradiction:

Ease of operationVSProductivity

Solution Approach 1:

The system transforms subjective resource allocation decisions into objective parameter-driven decisions by using risk scores to automatically allocate remediation resources to highest-priority vulnerabilities, improving both ease of operation and resource utilization efficiency

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20230094208A1Asset Inventorying System with In-Context Asset Valuation Prioritization

Publication Date: 2023.03.30 BIT DISCOVERY INC

AI summary

A computer-implemented method provides for vulnerability ranking and scoring assets based on remediation action measurements and asset value and risk measurements. A method might comprise obtaining information about a set of assets, obtaining information about environments of assets in the set of assets, determining asset valuation factors for the assets, computing remediation costs for vulnerabilities of the assets, determining returns on investment for remediating the vulnerabilities of the assets, and scoring assets based on remediation action returns on investment.