Security Risk Management System for Pre-Release Vulnerability Investigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current security risk management systems do not effectively reduce the time needed to take countermeasures against vulnerabilities once vulnerability information is released, as they do not facilitate pre-release investigation and preparation.

Innovation Solution

A security risk management system that includes a server and an agent unit, where the server transmits vulnerability information to the agent unit before its release date, allowing the agent to investigate and report results back to the server before the release date, enabling the server to present investigation results on or after the release date.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of time

If vulnerability information is transmitted to agents before the release date, then the time needed to take countermeasures is reduced, but the secrecy of vulnerability information may be compromised

Engineering Contradiction:

Improvetime needed to take countermeasuresVSAvoidsecrecy of vulnerability information

Core Design Contradiction:

Loss of timeVSReliability

Solution Approach 1:

The system performs preliminary vulnerability investigations before the official release date by transmitting vulnerability information to agent units in advance. Agents conduct investigations and report results to the server before public release, so that when vulnerability information becomes public, countermeasures can be immediately implemented based on pre-collected data, significantly reducing the response time.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The server acts as an intermediary between the vulnerability information source and the agent units. It controls the timing of information distribution, releasing vulnerability information to agents before the official release date while maintaining security through controlled access. The server also serves as an intermediary for collecting and managing investigation results before public presentation.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of information

If vulnerability information is released publicly, then transparency and awareness are improved, but terminals become vulnerable to immediate attacks

Engineering Contradiction:

Improvetransparency of vulnerability informationVSAvoidrisk of terminal attacks

Core Design Contradiction:

Loss of informationVSObject-affected harmful factors

Solution Approach 1:

The system conducts vulnerability investigations and prepares countermeasures before the public release date. By having agents investigate vulnerabilities in advance and the server prepare response strategies, the organization is positioned to immediately implement protective measures when vulnerability information becomes public, thereby reducing the window of exposure to attacks.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system takes preliminary anti-actions by investigating vulnerabilities and preparing countermeasures before the vulnerability information is publicly released. This proactive approach allows the organization to have defensive measures ready in advance, countering potential attacks before they can exploit the newly disclosed vulnerabilities.

Inventive Principle:

Principle #9Preliminary anti-action

3Measurement precision

If investigation is performed after vulnerability release, then information accuracy is maintained, but response time is extended

Engineering Contradiction:

Improveaccuracy of vulnerability investigationVSAvoidresponse time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs vulnerability investigations in advance before the official release date. Agents receive vulnerability information from the server and conduct thorough investigations, collecting accurate data about vulnerable terminals. This preliminary investigation ensures both accuracy and rapid response capability when the vulnerability is publicly released.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system maintains continuous vulnerability management by conducting investigations before release, preparing countermeasures during the pre-release period, and implementing responses immediately after release. This continuous process eliminates gaps between vulnerability disclosure and response, maintaining both accuracy and speed throughout the entire lifecycle.

Inventive Principle:

Principle #20Continuity of useful action

Data Source

PatentUS10860722B2Security risk management system, server, control method, and non-transitory computer-readable medium

Publication Date: 2020.12.08 NEC CORP

AI summary

A security risk management system (305) of the present disclosure includes a server (310) and an agent unit (320) included in a terminal. The server (310) transmits vulnerability information to the agent unit (320) before the release date and time of the vulnerability information. The agent unit (320) investigates the presence or absence of vulnerabilities in the terminal based on information regarding a method for vulnerability investigation contained in the vulnerability information, and transmits vulnerability investigation results containing the investigation results to the server (310) before the release date and time of the vulnerability information. The server (310) presents the vulnerability information and the vulnerability investigation results on or after the release date and time of the vulnerability information.