Network Security Scanner Exposure Level Determination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current vulnerability scanning methods require multiple scans from different trust levels to determine exposure levels, leading to increased maintenance overhead, resource consumption, and scanning-induced disruptions, as well as difficulties in identifying and merging duplicate vulnerabilities.
Innovation Solution
A security scanner with multiple scanning privilege levels, allowing it to scan network-connected assets with a first privilege level for initial detection and a second, lower-level privilege for exposure assessment, determining exposure levels based on visibility across different access tiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple scans from different trust levels are performed to determine exposure levels, then measurement precision of vulnerability exposure is improved, but productivity deteriorates due to increased scanning time and resource consumption
Solution Approach 1:
The patent segments the scanning process into two distinct phases: a first scan using high-privilege credentials to detect all potential vulnerabilities, and a second scan using low-privilege credentials to determine exposure levels. This segmentation allows the system to maintain high measurement precision by performing both scans, while improving productivity by only performing the resource-intensive second scan on assets where vulnerabilities were actually detected, rather than scanning all assets with both privilege levels.
2Measurement precision
If multiple scans from different trust levels are performed, then measurement precision of vulnerability exposure is improved, but loss of time increases due to repeated scanning operations
Solution Approach 1:
The patent segments the scanning process into two distinct phases: a first scan using high-privilege credentials to detect all potential vulnerabilities, and a second scan using low-privilege credentials to determine exposure levels. This segmentation allows the system to maintain high measurement precision by performing both scans, while improving productivity by only performing the resource-intensive second scan on assets where vulnerabilities were actually detected, rather than scanning all assets with both privilege levels.
Solution Approach 2:
The first scan using high-privilege credentials serves as a preliminary action that identifies which assets contain vulnerabilities. This preliminary detection enables the system to avoid performing the time-consuming second low-privilege scan on assets without vulnerabilities, thereby reducing total scanning time while still maintaining accurate exposure level determination for vulnerable assets.
3Measurement precision
If multiple scanner deployments are used to perform scans from different trust levels, then measurement precision of vulnerability exposure is improved, but device complexity increases
Solution Approach 1:
The patent implements a single scanner capable of performing multiple functions by switching between different privilege levels. The scanner can operate in high-privilege mode for comprehensive vulnerability detection and low-privilege mode for exposure level determination. This multi-functionality eliminates the need for separate scanner deployments, reducing device complexity and maintenance overhead while maintaining the measurement precision benefits of multi-level scanning.
Solution Approach 2:
The patent merges the functionality of multiple scanners operating at different trust levels into a single scanner that can dynamically switch between privilege levels. By combining the high-privilege vulnerability detection capability and low-privilege exposure assessment capability into one unified tool, the system reduces deployment complexity, simplifies maintenance, and eliminates the need to coordinate multiple scanner instances while still achieving accurate exposure level determination.
Data Source
AI summary
A method includes receiving a scan request requesting to scan a set of network-connected assets designated for a network scan. For each respective network-connected asset, the method includes scanning, at a network security scanner using a first scanning privilege level, the respective network-connected asset. The method includes determining, based on the scan using the first scanning privilege level, whether the respective network-connected asset has a vulnerability. In response, the method includes scanning, at the network security scanner using a second scanning privilege level, the respective network-connected asset. The second scanning privilege level defines a lower level of access the network security scanner has than the first scanning privilege level. The method includes determining, based on the scans, an exposure level of the vulnerability. The method includes reporting the exposure level of the vulnerability to a user of the respective network-connected asset.