Vulnerability management for a cloud environment using software development information
AssigneeFortinet, Inc.
InventorsJeffrey A. Kwiat, Galen D. Emery, Yijou Chen
Life of this patent
Estimating the term…
Abstract
An illustrative method for managing a vulnerability may include identifying, based on a scan of a compute environment, a vulnerable software component included in a plurality of software components deployed within the compute environment, identifying software development information associated with the plurality of software components, and performing, based on the software development information, an operation associated with the vulnerable software component.
Claims20
A method comprising:
- identifying, by a data platform and based on a scan of a compute environment, a vulnerable software component included in a plurality of software components deployed within the compute environment;
- identifying, by the data platform, software development information associated with the plurality of software components, wherein identifying the software development information further comprises determining a status of a development pipeline associated with the vulnerable software component;
- constructing, by the data platform, a graph comprising a plurality of nodes connected by a plurality of edges, and wherein the plurality of nodes comprises one or more nodes that represent the vulnerable software component and behavioral relationships between the plurality of nodes;
- and
- performing, by the data platform and based on the software development information and analysis of the constructed graph, an operation associated with the vulnerable software component.
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions capable of being executed to:
- identify, based on a scan of a compute environment, a vulnerable software component included in a plurality of software components deployed within the compute environment;
- identify software development information associated with the plurality of software components, wherein identifying the software development information further comprises determining a status of a development pipeline associated with the vulnerable software component;
- construct a graph comprising a plurality of nodes connected by a plurality of edges, and wherein the plurality of nodes comprises one or more nodes that represent the vulnerable software component and behavioral relationships between the plurality of nodes;
- and
- perform, based on the software development information and analysis of the constructed graph, an operation associated with the vulnerable software component.
A system comprising:
- a memory storing instructions;
- and
- a processor communicatively coupled to the memory and configured to execute the instructions to:
- identify, based on a scan of a compute environment, a vulnerable software component included in a plurality of software components deployed within the compute environment;
- identify software development information associated with the plurality of software components, wherein identifying the software development information further comprises determining a status of a development pipeline associated with the vulnerable software component;
- and
- constructing a graph comprising a plurality of nodes connected by a plurality of edges, and wherein the plurality of nodes comprises one or more nodes that represent the vulnerable software component and behavioral relationships between the plurality of nodes;
- and
- performing, based on the software development information and analysis of the constructed graph, an operation associated with the vulnerable software component.
Dependencies are inferred from the claim text.