Policy driven vulnerability identification and remediation

A vulnerability identification and remediation method for a network equipment in a cloud-based multi-tenant system of an enterprise, the method comprising:

• receiving from an application running on an end user device of a plurality of end user devices, a selection of a cloud service from a plurality of cloud services;
• identifying at a mid-link server, a plurality of vulnerabilities associated with a plurality of firmware of the end user device;
• identifying security risks associated with the plurality of vulnerabilities based on a type of the plurality of vulnerabilities;
• identifying at the mid-link server, a plurality of policies associated with the plurality of vulnerabilities based on the type of the plurality of vulnerabilities and the end user device, wherein the plurality of policies is specified for the plurality of end user devices;
• determining at the mid-link server, remediation for the plurality of vulnerabilities based on the plurality of policies, wherein the plurality of policies is based on the cloud service, a tenant of the end user device, and/or a user role associated with the end user device;
• identifying at the mid-link server, a route from a plurality of routes corresponding to the plurality of policies and the cloud service, wherein:
• the route specifies the end user device or the mid-link server;
• the plurality of routes is specified for the plurality of policies;
• and
• the plurality of routes through the cloud-based multi-tenant system delivers the plurality of cloud services to the plurality of end user devices;
• prioritizing at the mid-link server, the remediation of the plurality of firmware based on the type of the plurality of vulnerabilities, the security risks, and the plurality of policies;
• executing remediation of the plurality of firmware by upgrading the plurality of firmware based on the plurality of policies according to the priority;
• and
• establishing by the mid-link server, communication via the route between the application and the cloud service based on the plurality of policies.

A cloud-based multi-tenant system for policy-based vulnerability management, the cloud-based multi-tenant system comprising one or more processors and one or more memories with code for:

• extracting:
• configuration items associated with a plurality of firmware of a plurality of end user devices from a configuration database using Application Programming Interfaces (APIs),
• device configurations including vendor specific information from a device configuration repository, and
• external vulnerability information including external websites, social media, and/or vendor web sites from a plurality of data sources;
• correlating the configuration items, the device configurations, and the external vulnerability information;
• and
• identifying a plurality of vulnerabilities associated with the plurality of firmware based on the correlation;
• receiving from an application running on an end user device of the plurality of end user devices, a selection of a cloud service from a plurality of cloud services;
• identifying security risks associated with the plurality of vulnerabilities based on a type of the plurality of vulnerabilities;
• identifying a plurality of policies associated with the plurality of vulnerabilities based on the type of the plurality of vulnerabilities and the end user device, wherein the plurality of policies is specified for the plurality of end user devices;
• determining remediation for the plurality of vulnerabilities based on the plurality of policies, wherein the plurality of policies is based on the cloud service, a tenant of the end user device, and/or a user role associated with the end user device;
• identifying a route from a plurality of routes corresponding to the plurality of policies and the cloud service, wherein:
• the route specifies the end user device or a mid-link server of the cloud-based multi-tenant system;
• the plurality of routes is specified for the plurality of policies;
• and
• the plurality of routes through the cloud-based multi-tenant system delivers the plurality of cloud services to the plurality of end user devices;
• executing the remediation of the plurality of firmware by upgrading the plurality of firmware based on the plurality of policies;
• and
• communicating via the route between the application and the cloud service based on the plurality of policies.