Vulnerability Assessment Engine for Risk-Based Patch Prioritization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face difficulties in remediating software vulnerabilities and bugs in a timely and cost-effective manner due to the continuous discovery of new security threats.
Innovation Solution
A continuous vulnerability assessment system that employs agents on computing devices to profile software characteristics, determine execution times, and a vulnerability assessment engine to calculate risk levels and mitigate vulnerabilities based on user analytics and severity, enabling prioritized patching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all vulnerabilities are remediated, then security coverage is improved, but resource consumption and cost increase
Solution Approach 1:
The vulnerability assessment system segments vulnerabilities into different risk levels based on exploitation likelihood and impact. Instead of treating all vulnerabilities uniformly, the system divides them into categories (e.g., high, medium, low risk) and applies different remediation priorities and resource allocation strategies to each segment, allowing organizations to focus resources on the most critical vulnerabilities first
Solution Approach 2:
The system applies different assessment and remediation qualities to different vulnerabilities based on their specific characteristics. High-risk vulnerabilities receive intensive assessment and immediate remediation resources, while low-risk vulnerabilities receive minimal assessment and deferred remediation, optimizing resource allocation according to local needs of each vulnerability
2Measurement precision
If comprehensive vulnerability assessment is performed, then detection accuracy is improved, but time consumption increases
Solution Approach 1:
The system performs preliminary actions by continuously monitoring and profiling software characteristics, execution patterns, and vulnerability indicators in advance. This ongoing baseline assessment allows the system to quickly evaluate new vulnerabilities against established patterns, reducing the time needed for comprehensive assessment while maintaining high detection accuracy
Solution Approach 2:
The vulnerability assessment operates periodically and continuously rather than as a one-time comprehensive scan. The system regularly updates vulnerability profiles, re-assesses risks, and adjusts remediation priorities based on changing threat landscapes, maintaining high detection accuracy through repeated measurements while distributing time consumption over periods
3Productivity
If priority-based remediation is implemented, then productivity is improved, but system complexity increases
Solution Approach 1:
The system changes parameters by dynamically adjusting vulnerability risk scores based on multiple factors including exploitation likelihood, impact severity, software criticality, and environmental context. These parameter changes enable automatic priority assignment and remediation scheduling, improving productivity through data-driven decisions while the underlying complexity is managed by automated algorithms rather than manual processes
Data Source
AI summary
The embodiments disclosed herein are directed to a continuous vulnerability assessment system for detecting exploitable vulnerabilities. For example, an agent executes on a plurality of computing devices. Each agent profiles various pieces of software executing on its respective device and obtains various characteristics thereof. For instance, each agent determines, among other things, the length of time certain software executes on the device. Each agent provides descriptors of the determined characteristics to a vulnerability assessment engine. The engine determines a cumulative length of time that each particular piece of software executed across the plurality of computing devices. The engine also determines whether a vulnerability exists with respect to each particular piece of software, assigns a security risk level for the software based at least on the determined vulnerability and the cumulative length of time, and performs an action to mitigate the determined vulnerability based on the security risk level.