Application Security Risk Manager for Vulnerability Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security vulnerability management in computer applications is hindered by the need for manual risk assessments, leading to delays in responding to newly discovered vulnerabilities, which can leave applications exposed to potential threats until a thorough investigation can be conducted.
Innovation Solution
Embedding a security risk manager within the application that periodically checks a security vulnerabilities database for alerts, allowing for immediate and selective disabling of affected code entities to mitigate risks, while maintaining a list of known alerts to avoid false positives and enabling notifications to the operations team.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual risk assessment is performed by operations team, then security vulnerability investigation is thorough, but response time is delayed
Solution Approach 1:
The patent applies preliminary action by embedding a security risk manager that proactively monitors security vulnerability databases and automatically responds to alerts before manual assessment can occur. The system pre-configures response actions (disabling affected code entities) that execute immediately upon detecting vulnerabilities, eliminating the time delay inherent in manual processes while maintaining security investigation thoroughness through automated alert analysis and operations team notification.
Solution Approach 2:
The security risk manager implements self-service by autonomously performing security vulnerability detection, assessment, and initial response without requiring continuous manual intervention. The system automatically queries vulnerability databases, analyzes alerts against known vulnerabilities, disables affected code entities, and notifies operations teams - enabling the application to manage its own security posture in real-time while preserving thorough investigation capabilities through automated workflows.
2Reliability
If application is taken offline pending investigation, then security exposure is eliminated, but service availability is lost
Solution Approach 1:
The patent applies segmentation by isolating only the specific code entities affected by security vulnerabilities rather than taking the entire application offline. The security risk manager identifies and disables individual vulnerable components (functions, classes, modules) while leaving the rest of the application operational, thus eliminating security exposure for affected segments while maintaining service availability for unaffected segments.
Solution Approach 2:
The system implements local quality by applying security measures selectively to specific vulnerable code entities rather than uniformly across the entire application. The security risk manager analyzes vulnerability alerts to determine which specific code entities are affected and applies disabling actions only to those local segments, preserving the functionality and availability of other application components that are not vulnerable.
3Reliability
If code entities are disabled immediately upon vulnerability detection, then security risk is mitigated, but application functionality is reduced
Solution Approach 1:
The patent applies dynamics by making the application's security posture adaptive rather than static. The security risk manager continuously monitors vulnerability databases and dynamically adjusts the enabled/disabled state of code entities based on current threat levels and vulnerability information. Code entities can be enabled or disabled as needed, allowing the application to optimize between security risk mitigation and functionality preservation based on real-time security conditions.
Solution Approach 2:
The system implements parameter changes by modifying the operational state parameter of code entities (enabled/disabled) in response to vulnerability detections. The security risk manager changes the state parameter of affected code entities from enabled to disabled when vulnerabilities are detected, and can revert them when vulnerabilities are resolved, allowing dynamic adjustment of application functionality based on security parameters without permanent functional loss.
Data Source
AI summary
Approaches presented herein enable a security risk manager embedded in an application to manage security vulnerabilities of the application. More specifically, the application comprises code entities such as components, packages, libraries, or microservices. The entities are modified as part of the application development process to have an enabled state, in which these entities are permitted to run normally when called, and a disabled state, in which these entities do not run when called but instead perform a back-out behavior such as generating an error message. At runtime, the application periodically accesses a security vulnerabilities database to check for security alerts. When a relevant security alert is found, the application changes any code entities that are affected by the security alert to the disabled state pending investigation by an operations team. The application notifies the operations team by sending a notification of the security alert to an external security monitoring tool.