Back to results
US 12,614,138 B1Granted
Organization vendor-based risk assessment using internet telemetry
AssigneeRapid7, Inc.
InventorsWah-Kwan Lin, Harley Ray Rogers
Life of this patent
Estimating the term…
Abstract
Various embodiments include systems and methods of assessing vendor risk. One or more sets of IP address(es) associated with one or more vendors is identified. Risk data related to the set(s) of IP address(es) is obtained using internet telemetry data. Based at least in part on the risk data, security risk level(s) are determined for the vendor(s). Some embodiments include systems and methods of implementing a vendor-based risk posture assessment of an organization. The vendor-based risk posture assessment may be based at least in part on one or more security risk levels determined for the vendor(s) of the organization.
Claims20
A system, comprising:
- one or more hardware processors with associated memory that implement a vendor-based risk posture assessment system of an organization, wherein the one or more hardware processors are configured to:
- repeatedly determine security risk levels for a plurality of vendors of the organization over a plurality of time intervals, wherein the vendors have privileged access to one or more computer systems of the organization, wherein the determination of a respective security risk level of a respective vendor includes to:
- identify a respective set of one or more internet protocol (IP) addresses of the respective vendor;
- perform one or more network scans of the one or more IP addresses to collect internet telemetry data for the one or more IP addresses;
- generate risk data related to the one or more IP addresses, wherein the risk data includes the internet telemetry data collected for the one or more IP addresses and indications of whether a set of security exposures are evidenced by the internet telemetry data, including:
- (a) an expired domain name service (DNS) certificate associated with the one or more IP addresses,
- (b) an exposed instance of an unencrypted service,
- (c) an exposed network time protocol (NTP) and border gateway protocol (BGP), and
- (d) an operating system or application that is no longer supported or patched by a provider;
- and
- determine, based at least in part on the risk data, the respective security risk level of the respective vendor;
- determine that a security risk level of a particular vendor has changed from a previous time interval, and in response:
- identify, based on the change and the risk data, one or more security lapses of the particular vendor and one or more security improvement areas to address the one or more security lapses;
- and
- generate a first alert via a graphical user interface indicating the one or more security lapses and the one or more security improvement areas;
- and
- assess, based at least in part on the security risk levels for the plurality of vendors,
- a risk posture of the organization, and in response:
- determine, based on the risk posture of the organization, a secondary security exposure of the one or more computer systems of the organization through association with the particular vendor;
- generate a second alert indicating the secondary security exposure of the organization via the graphical user interface;
- and
- automatically perform one or more remedial actions to mitigate the secondary security exposure, wherein the one or more remedial actions includes terminating or altering a privileged access of the particular vendor to the one or more computer systems.
19 more elements
A method comprising:
- performing, by one or more hardware processors that implement a vendor-based risk posture assessment system of an organization:
- repeatedly determining security risk levels for a plurality of vendors of the organization over a plurality of time intervals, wherein the vendors have privileged access to one or more computer systems of the organization, wherein the determination of a respective security risk level of a respective vendor includes:
- identifying a respective set of one or more internet protocol (IP) addresses of the respective vendor;
- performing one or more network scans of the one or more IP addresses to collect internet telemetry data for the one or more IP addresses;
- generating risk data related to the one or more IP addresses, wherein the risk data includes the internet telemetry data collected for the one or more IP addresses and indications of whether a set of security exposures are evidenced by the internet telemetry data, including:
- (a) an expired domain name service (DNS) certificate associated with the one or more IP addresses,
- (b) an exposed instance of an unencrypted service,
- (c) an exposed network time protocol (NTP) and border gateway protocol (BGP), and
- (d) an operating system or application that is no longer supported or patched by a provider;
- and
- determining, based at least in part on the risk data, the respective security risk level of the respective vendor;
- determining that a security risk level of a particular vendor has changed from a previous time interval, and in response:
- identifying, based on the change and the risk data, one or more security lapses of the particular vendor and one or more security improvement areas to address the one or more security lapses;
- and
- generating a first alert via a graphical user interface indicating the one or more security lapses and the one or more security improvement areas;
- and
- assessing, based at least in part on the security risk levels for the plurality of vendors, a risk posture of the organization, and in response:
- determining, based on the risk posture of the organization, a secondary security exposure of the one or more computer systems of the organization through association with the particular vendor;
- generating a second alert indicating the secondary security exposure of the organization via the graphical user interface;
- and
- automatically performing one or more remedial actions to mitigate the secondary security exposure, wherein the one or more remedial actions includes terminating or altering a privileged access of the particular vendor to the one or more computer systems.
18 more elements
One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more processors, implement at least a portion of a vendor-based risk posture assessment system of an organization and cause the vendor-based risk posture assessment system to:
- repeatedly determine security risk levels for a plurality of vendors of the organization over a plurality of time intervals, wherein the vendors have privileged access to one or more computer systems of the organization, wherein the determination of a respective security risk level of a respective vendor includes to:
- identify a respective set of one or more internet protocol (IP) addresses of the respective vendor;
- perform one or more network scans of the one or more IP addresses to collect internet telemetry data for the one or more IP addresses;
- generate risk data related to the one or more IP addresses, wherein the risk data includes the internet telemetry data collected for the one or more IP addresses and indications of whether a set of security exposures are evidenced by the internet telemetry data, including:
- (a) an expired domain name service (DNS) certificate associated with the one or more IP addresses,
- (b) an exposed instance of an unencrypted service,
- (c) an exposed network time protocol (NTP) and border gateway protocol (BGP), and
- (d) an operating system or application that is no longer supported or patched by a provider;
- and
- determine, based at least in part on the risk data, the respective security risk level of the respective vendor;
- determine that a security risk level of a particular vendor has changed from a previous time interval, and in response:
- identify, based on the change and the risk data, one or more security lapses of the particular vendor and one or more security improvement areas to address the one or more security lapses;
- and
- generate a first alert via a graphical user interface indicating the one or more security lapses and the one or more security improvement areas;
- and
- assess, based at least in part on the security risk levels for the plurality of vendors, a risk posture of the organization, and in response:
- determine, based on the risk posture of the organization, a secondary security exposure of the one or more computer systems of the organization through association with the particular vendor;
- generate a second alert indicating the secondary security exposure of the organization via the graphical user interface;
- and
- automatically perform one or more remedial actions to mitigate the secondary security exposure, wherein the one or more remedial actions includes terminating or altering a privileged access of the particular vendor to the one or more computer systems.
17 more elements
Dependencies are inferred from the claim text.