Exposure detection by scan telemetry
AssigneeRapid7, Inc.
InventorsWah-Kwan Lin, Paul Deardorff
Life of this patent
Estimating the term…
Abstract
Methods and systems for identifying a vulnerability on a network are disclosed. The methods described herein may involve executing a first scanning function to obtain a first view of a network and then filtering the first view of the network for at least one point of exposure of a first entity that originates from a second entity. The methods described herein may further involve executing a secondary scanning function to identify any vulnerabilities of the first entity based on the point of exposure of the first entity that originates from the second entity and implementing a threat prevention procedure upon identifying a vulnerability of the first entity based on the point of exposure of the first entity that originates from the second entity.
Claims19
A method comprising:
- executing a first scanning function to obtain a first view of a network;
- filtering the first view of the network for at least one point of exposure of a first entity that originates from a second entity, wherein the point of exposure includes a resource or network endpoint of the second entity that is not owned or controlled by the first entity, and the filtering is performed using a plurality of terms specific to the first entity including one or more organization names, organization-specific technology names, or organization-specific service names associated with the first entity;
- executing a secondary scanning function to identify vulnerabilities of the first entity based on the point of exposure of the first entity that originates from a second entity;
- and
- implementing a threat prevention procedure upon identifying a vulnerability of the first entity based on the point of exposure of the first entity that originates from a second entity.
A system comprising:
- one or more a processors executing instructions stored on memory configured to:
- execute a first scanning function to obtain a first view of a network;
- filter the first view of the network for at least one point of exposure of a first entity that originates from a second entity, wherein the point of exposure includes a resource or network endpoint of the second entity that is not owned or controlled by the first entity, and the filtering is performed using a plurality of terms specific to the first entity including one or more organization names, organization-specific technology names, or organization-specific service names associated with the first entity;
- execute a secondary scanning function to identify vulnerabilities of the first entity based on the point of exposure of the first entity that originates from the second entity;
- and
- implement a threat prevention procedure upon identifying a vulnerability of the first entity based on the point of exposure of the first entity that originates from a second entity.
A method comprising:
- executing a DNS scan of a first portion of the internet to obtain a first view of the internet;
- filtering the first view of the internet for at least one point of exposure of a first entity by enumerating a plurality of terms specific to the first entity and searching the first view of the internet for instances of the enumerated plurality of terms, wherein the point of exposure includes a resource or network endpoint of a second entity that is not owned or controlled by the first entity, and the plurality of terms includes names specific to the first entity including one or more organization names, organization-specific technology names, or organization-specific service names associated with the first entity;
- executing a secondary scanning function to identify vulnerabilities of the first entity based on the point of exposure, wherein the secondary scanning function identifies at least one of an IP address, a port, a protocol, a service, and an autonomous system associated with the first entity;
- and
- implementing a threat prevention procedure upon identifying a vulnerability of the first entity based on the point of exposure of the first entity.
Dependencies are inferred from the claim text.