Automatically prioritizing computing resource configurations for remediation

A method for evaluating a computing system, the method comprising:

• a) selecting, from a list of computing devices operating within a computing environment, one of the computing devices;
• b) selecting, from a list of vulnerability descriptions associated with vulnerabilities, one of the vulnerability descriptions associated with one of the vulnerabilities, the one of the vulnerabilities having a baseline priority score indicative of an estimate of a severity of the one of the vulnerabilities that does not account for mitigating factors or exacerbating factors unique to particular circumstances of the one of the vulnerabilities;
• c) receiving network configuration information of the computing environment that defines a maximum level of network access to the one of the computing devices, and determining a maximum privilege level allowed for applications executing within the one of the computing devices;
• d) converting the maximum level of network access to a system access score according to a predefined vulnerability metric definition, and converting the maximum privilege level to a system privilege score according to the predefined vulnerability metric definition;
• e) evaluating, based at least in part on information accessible to the one of the computing devices, the one of the vulnerabilities for the one of the computing devices, including generating a vulnerability priority score for the one of the vulnerabilities with respect to the one of the computing devices by:
• converting a level of data sensitivity for the information accessible to the one of the computing devices into a data sensitivity score;
• and
• providing the baseline priority score the data sensitivity score, the system access score, and the system privilege score as inputs to a weighting function, the weighting function configured to output the vulnerability priority score for the one of the vulnerabilities according to weighting rules of the weighting function;
• f) repeating steps b) through e) for additional ones of the vulnerability descriptions from the list of vulnerability descriptions;
• g) selecting or generating, from the vulnerability priority scores generated in step e), a representative vulnerability priority score indicating an aggregate vulnerability priority score for the vulnerabilities with respect to the one of the computing devices;
• h) repeating steps a) through g) for additional ones of the computing devices from the list of computing devices;
• and
• i) generating a vulnerability report listing the vulnerabilities corresponding to each vulnerability description and corresponding vulnerability priority score indicating a relative importance of mitigating each vulnerability.

A system comprising one or more processors and memory storing computer-executable instructions that, when executed by the one or more processors, cause the system to:

• a) select, from a list of vulnerability descriptions associated with vulnerabilities, one of the vulnerability descriptions associated with one of the vulnerabilities, the one of the vulnerabilities having a baseline priority score indicative of an estimate of a severity of the one of the vulnerabilities that does not account for mitigating factors or exacerbating factors unique to particular circumstances of the one of the vulnerabilities;
• b) select, from a list of computing devices, one of the computing devices;
• c) receive network configuration information of the computing environment that defines a maximum level of network access to the one of the computing devices, and determining a maximum privilege level allowed for applications executing within the one of the computing devices;
• d) convert the maximum level of network access to a system access score according to a predefined vulnerability metric definition, and converting the maximum privilege level to a system privilege score according to the predefined vulnerability metric definition;
• e) evaluate, based at least in part on information accessible to the one of the computing devices, the one of the vulnerabilities for the one of the computing devices, including generating a vulnerability priority score for the one of the vulnerabilities with respect to the one of the computing devices by:
• converting a level of data sensitivity for the information accessible to the one of the computing devices into a data sensitivity score;
• and
• providing the baseline priority score the data sensitivity score, the system access score, and the system privilege score as inputs to a weighting function, the weighting function configured to output the vulnerability priority score for the one of the vulnerabilities according to weighting rules of the weighting function;
• f) repeat steps b) through e) for additional ones of the computing devices from the list of computing devices;
• g) select or generate, from the vulnerability priority scores generated in step e), a representative vulnerability priority score indicating an aggregate vulnerability priority score for the one of the vulnerabilities with respect to the computing devices;
• h) repeat steps a) through g) for additional ones of the vulnerability descriptions from the list of vulnerability descriptions;
• and
• i) generate a vulnerability report listing the vulnerabilities corresponding to each vulnerability description and corresponding vulnerability priority score indicating a relative importance of mitigating each vulnerability.