Static Security Scanner for Remote Network Management Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Custom applications developed for remote network management platforms face challenges in security auditing due to their integration with the platform's specific libraries and database tables, making it difficult to identify potential security vulnerabilities such as public web pages, open redirections, and improper access control lists.
Innovation Solution
A static security scanner is introduced to retrieve custom application code, database tables, and user roles, applying predefined rules to detect security vulnerabilities, and presenting the results in an intuitive web-based format for administrators to evaluate.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If custom applications are developed using the platform's specific libraries and database tables, then the applications can leverage existing components and adhere to coding conventions, but security auditing becomes more challenging and requires intimate knowledge of the platform
Solution Approach 1:
The patent introduces an intermediary security scanning mechanism that acts as a bridge between the custom application and the auditing process. The scanner retrieves and analyzes the application's source code, database schemas, and configuration files, translating platform-specific implementations into security-relevant information without requiring external experts to know the platform intimately.
Solution Approach 2:
The security scanner creates copies of the application's source code, database schemas, and configuration files for analysis. By working with these copies, the system can perform comprehensive security auditing without affecting the original application and can analyze platform-specific implementations in isolation.
2Reliability
If comprehensive security scanning is performed on custom applications, then security vulnerabilities can be identified, but the scanning process becomes more complex and time-consuming
Solution Approach 1:
The patent segments the security scanning process into distinct modules: retrieving source code, retrieving database schemas, retrieving configuration files, analyzing each component separately, and aggregating results. This segmentation reduces complexity by making each step manageable and independent while maintaining comprehensive security coverage.
Solution Approach 2:
The system performs preliminary actions by retrieving and storing the application's source code, database schemas, and configuration files before the actual security analysis. This preparation phase organizes the data in advance, making the subsequent analysis more efficient and less complex.
3Measurement precision
If detailed security analysis is conducted on application code and database tables, then security vulnerabilities can be detected, but the time required for scanning increases
Solution Approach 1:
The patent implements continuous security scanning by integrating the analysis process into the application lifecycle. The scanner can operate continuously or periodically on the application's code and configuration, providing ongoing security monitoring without requiring lengthy batch processing intervals, thus reducing the perceived scanning time while maintaining precision.
Data Source
AI summary
An example embodiment may involve a remote network management platform including a computational instance hosting a particular application. The particular application may be based on a unit of program code, use one or more database tables, and define one or more user roles with respect to accessing the program code and the database tables. A scanner application may be configured to: receive, from a client device, a request to scan the particular application; retrieve the particular application; conduct a static security scan by applying a set of rules that define security vulnerabilities, where the rules take into account (i) relationships between the user roles and the unit of program code, and (ii) relationships between the user roles and the database table; and transmit, to the client device, a representation of a web page that contains observed security vulnerabilities of the particular application.