US 10,313,389 B2Granted

Computer asset vulnerabilities

AssigneeAccenture Global Services Limited

InventorsElvis Hovor, Shaan Mulchandani, Matthew Carver

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for determining a network path between computer assets. One of the methods includes receiving an asset topology that includes an identifier for each computer-related asset that may be an entry point for an attack simulation, receiving threat data that identifies vulnerabilities of computer-related assets, determining a first computer-related asset that may be an entry point for an attack simulation, identifying one or more first vulnerabilities of the first computer-related asset, determining a path from the first computer-related asset to a second computer-related asset, determining one or more second vulnerabilities of the second computer-related asset, determining a probability that the second computer-related asset will be compromised by an adversary, and determining a change to the asset topology to reduce the probability that the second computer-related asset will be compromised by an adversary.

Claims33

Dependent claims

A system comprising:

a data processing apparatus;
and
a non-transitory computer readable storage medium in data communication with the data processing apparatus and storing instructions executable by the data processing apparatus and upon such execution cause the data processing apparatus to perform operations comprising:
identifying, using threat data that identifies vulnerabilities of computer-related assets, one or more first vulnerabilities of a first computer-related asset that is a) identified by an asset topology that i) identifies an entity's computer-related assets including one or more first computer-related assets each of which is a potential entry point for an attack simulation and one or more second computer-related assets each of which is not a potential entry point for an attack simulation, and ii) how the computer-related assets are connected together and b) one of the first computer-related assets;
in response to identifying the one or more first vulnerabilities of the first computer-related asset, determining, using the one or more first vulnerabilities, that a first probability that the first computer-related asset will be compromised by an adversary's device satisfies a threshold probability;
in response to determining that the first probability that the first computer-related asset will be compromised by an adversary's device satisfies the threshold probability, determining, using the asset topology, a path from the first computer-related asset to a second computer-related asset that is one of the second computer-related assets identified by the asset topology;
in response to determining the path from the first computer-related asset to the second computer-related asset, determining, using the threat data, one or more second vulnerabilities of the second computer-related asset;
in response to determining the one or more second vulnerabilities of the second computer-related asset, determining, using the one or more second vulnerabilities of the second computer-related asset, a second probability that the second computer-related asset will be compromised by an adversary's device;
in response to determining the second probability that the second computer-related asset will be compromised by an adversary's device, determining, using the asset topology and the threat data, a change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary's device;
and
in response to determining the change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary's device, implementing the change to the asset topology.

8 more elements

A computer-implemented method comprising:

identifying, using threat data that identifies vulnerabilities of computer-related assets, one or more first vulnerabilities of a first computer-related asset that is a) identified by an asset topology that i) identifies an entity's computer-related assets including one or more first computer-related assets each of which is a potential entry point for an attack simulation and one or more second computer-related assets each of which is not a potential entry point for an attack simulation, and ii) how the computer-related assets are connected together and b) one of the first computer-related assets;
in response to identifying the one or more first vulnerabilities of the first computer-related asset, determining, using the one or more first vulnerabilities, that a first probability that the first computer-related asset will be compromised by an adversary's device satisfies a threshold probability;
in response to determining that the first probability that the first computer-related asset will be compromised by an adversary's device satisfies the threshold probability, determining, using the asset topology, a path from the first computer-related asset to a second computer-related asset that is one of the second computer-related assets identified by the asset topology;
in response to determining the path from the first computer-related asset to the second computer-related asset, determining, using the threat data, one or more second vulnerabilities of the second computer-related asset;
in response to determining the one or more second vulnerabilities of the second computer-related asset, determining, using the one or more second vulnerabilities of the second computer-related asset, a second probability that the second computer-related asset will be compromised by an adversary's device;
in response to determining the second probability that the second computer-related asset will be compromised by an adversary's device, determining, using the asset topology and the threat data, a change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary's device;
and
in response to determining the change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary's device, implementing the change to the asset topology.

5 more elements

A non-transitory computer readable storage medium storing instructions executable by a data processing apparatus and upon such execution cause the data processing apparatus to perform operations comprising:

identifying, using threat data that identifies vulnerabilities of computer-related assets, one or more first vulnerabilities of a first computer-related asset that is a) identified by an asset topology that i) identifies an entity's computer-related assets including one or more first computer-related assets each of which is a potential entry point for an attack simulation and one or more second computer-related assets each of which is not a potential entry point for an attack simulation, and ii) how the computer-related assets are connected together and b) one of the first computer-related assets;
in response to identifying the one or more first vulnerabilities of the first computer-related asset, determining, using the one or more first vulnerabilities, that a first probability that the first computer-related asset will be compromised by an adversary's device satisfies a threshold probability;
in response to determining that the first probability that the first computer-related asset will be compromised by an adversary's device satisfies the threshold probability, determining, using the asset topology, a path from the first computer-related asset to a second computer-related asset that is one of the second computer-related assets identified by the asset topology;
in response to determining the path from the first computer-related asset to the second computer-related asset, determining, using the threat data, one or more second vulnerabilities of the second computer-related asset;
in response to determining the one or more second vulnerabilities of the second computer-related asset, determining, using the one or more second vulnerabilities of the second computer-related asset, a second probability that the second computer-related asset will be compromised by an adversary's device;
in response to determining the second probability that the second computer-related asset will be compromised by an adversary's device, determining, using the asset topology and the threat data, a change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary's device;
and
in response to determining the change to the asset topology to reduce the second probability that the second computer-related asset will be compromised by an adversary's device, implementing the change to the asset topology.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/913,219Filed 6 Mar 2018 · continuation
Priority: 13 Aug 2015
Published: US 2018/0198815 A112 Jul 2018
Granted: 4 Jun 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification3 codes

H04L 63/1433
For detecting or protecting against malicious traffic: vulnerability analysis
H04L 63/14
Network architectures or network communication protocols for network security: for detecting or protecting against malicious traffic
H04L
Digital communication

Family

Application62/204,830Us provisional application · filed 13 Aug 2015
Application14/841,007Parent of this continuation · filed 31 Aug 2015
US 2018/0198815 A1Pre-grant publication · published 12 Jul 2018
US 9,979,743 B2Parent of this continuation
US 2017/0048266 A1Published application
US 10,313,389 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key