# US 2023/0069738 A1 · Systems and Methods for Automated Risk-Based Network Security Focus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0069738 A1 - Document ID: US20230069738A1 - Status: Published application - Kind: A1 - Application number: 17/408,730 - Filed: 2021-08-23 - Published: 2023-03-02 - Earliest claimed: 2021-08-23 - Assignees: Fortinet, Inc. - Applicants: Fortinet, Inc - Inventors: Rajiv Sreedhar; MANUEL NEDBAL; MANOJ AHLUWALIA; LATHA KRISHNAMURTHI; RAJESHWARI RAO; DAMODAR K. HEGDE; JITENDRA B. GAITONDE; Dave Karp; Mark Lubeck - Web page: https://patentgrep.com/patent/US20230069738A1 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1433: {Vulnerability analysis} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, devices, and methods are discussed for automatically determining a risk-based focus in determining zero trust network access policy on one or more network elements. ## Claims ### Claim 1 A method for securing network access using automatically generated network focus, the method comprising: accessing, by a processing resource, at least a first risk score for a first application and a second risk score for a second application, wherein the first risk score indicates a higher risk than the second risk score; selecting, by the processing resource, the first application based in part on the first risk score indicating a higher risk than the second risk score; and securing, by the processing resource, a network from a focus of the first application. ### Claim 2 (depends on 1) The method of claim 1, the method further comprising: scoring, by the processing resource, the first application to yield the first risk score. ### Claim 3 (depends on 2) The method of claim 2, wherein the scoring the first application comprises: scoring, by the processing resource, at least a first application tier of the first application to yield a first tier risk score and a second application tier associated with the first application to yield a second tier risk score, and generating the first risk score based at least in part on the first tier risk score. ### Claim 4 (depends on 3) The method of claim 3, wherein the first tier risk score indicates a higher risk than the second tier risk score, and wherein the generating the first risk score based at least in part on the first tier risk score includes selecting the first tier risk score. ### Claim 5 (depends on 3) The method of claim 3, wherein the scoring the first application tier comprises: scoring, by the processing resource, at least a first workload of the first application tier to yield a first workload risk score and a second workload of the first tier to yield a second workload risk score, and generating the first tier risk score based at least in part on the first workload risk score. ### Claim 6 (depends on 5) The method of claim 5, wherein the first workload risk score indicates a higher risk than the second workload risk score, and wherein the generating the first tier risk score based at least in part on the first workload risk score includes selecting the first workload risk score. ### Claim 7 (depends on 5) The method of claim 5, wherein the scoring the first workload comprises: calculating, by the processing resource, the first workload risk score based upon a combination of two or more of: a common vulnerability scoring system score, a degree of flatness, a degree of exposure, a number of live attack attempts, and a number of successful exploits. ### Claim 8 (depends on 7) The method of claim 7, wherein the scoring the first workload further comprises: accessing, by the processing resource, a database to obtain the common vulnerability scoring system score. ### Claim 9 (depends on 1) The method of claim 1, wherein the securing the network from a focus of the first application comprises: monitoring, by the processing resource, network activity to yield a set of network traffic; identifying, by the processing resource, a set of workloads in the set of network traffic that are either sourced from the first application or destined to the first application; and augmenting, by the processing resource, an access control list to include one or more workload rules allowing the set of workloads. ### Claim 10 (depends on 9) The method of claim 9, wherein the set of network traffic is a first set of network traffic, wherein the set of workloads is a first set of workloads, the method further comprising: monitoring, by the processing resource, network activity to yield a second set of network traffic; identifying, by the processing resource, a second set of workloads in the second set of network traffic that are either sourced from any of the at least one network focus, or destined to any of the at least one network focus; identifying, by the processing resource, at least one workload in the second set of workloads that is not in the first set of workloads; and augmenting, by the processing resource, the access control list to include the at least one workload in the second set of workloads that is not in the first set of workloads. ### Claim 11 (depends on 9) The method of claim 9, the method further comprising: identifying, by the processing resource, a third application associated with two or more workloads in the set of workloads, and a fourth application associated with two or more other workloads in the set of workloads; wherein augmenting, by the processing resource, the access control list to include one or more workload rules allowing the set of workloads is an incremental modification, and wherein the incremental modification includes: augmenting, by the processing device, the access control list to include first workload rules corresponding to the two or more workloads associated with the third application to yield a first augmented access control list; forward testing, by the processing device, the first augmented access control list; subsequent to forward testing the first augmented access control list, augmenting, by the processing device, the first access control list to include second workload rules corresponding to the two or more workloads associated with the fourth application to yield a second augmented access control list; and forward testing, by the processing device, the second augmented access control list. ### Claim 12 A network securing system, the network securing system comprising: a processing resource; a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to: access at least a first risk score for a first application and a second risk score for a second application, wherein the first risk score indicates a higher risk than the second risk score; select the first application based in part on the first risk score indicating a higher risk than the second risk score; and secure a network from a focus of the first application. ### Claim 13 (depends on 12) The network securing system of claim 12, wherein the non-transitory computer-readable medium further has stored therein instructions that when executed by the processing resource cause the processing resource to: score the first application to yield the first risk score by: scoring at least a first application tier of the first application to yield a first tier risk score and a second application tier associated with the first application to yield a second tier risk score, and generating the first risk score based at least in part on the first tier risk score. ### Claim 14 (depends on 13) The network securing system of claim 13, wherein the scoring the first application tier comprises: scoring at least a first workload of the first application tier to yield a first workload risk score and a second workload of the first tier to yield a second workload risk score, and generating the first tier risk score based at least in part on the first workload risk score. ### Claim 15 (depends on 14) The network securing system of claim 14, wherein the scoring the first workload comprises: calculating the first workload risk score based upon a combination of two or more of: a common vulnerability scoring system score, a degree of flatness, a degree of exposure, a number of live attack attempts, and a number of successful exploits. ### Claim 16 (depends on 15) The network securing system of claim 15, wherein the non-transitory computer-readable medium further has stored therein instructions that when executed by the processing resource cause the processing resource to: access a database to obtain the common vulnerability scoring system score. ### Claim 17 (depends on 12) The network securing system of claim 12, wherein the instructions that when executed by the processing resource cause the processing resource to secure the network from the focus of the first application includes instructions that when executed by the processing resource cause the processing resource to: monitor network activity to yield a set of network traffic; identify a set of workloads in the set of network traffic that are either sourced from the first application or destined to the first application; and augment an access control list to include one or more workload rules allowing the set of workloads. ### Claim 18 A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by a processing resource, causes the processing resource to: access at least a first risk score for a first application and a second risk score for a second application, wherein the first risk score indicates a higher risk than the second risk score; select the first application based in part on the first risk score indicating a higher risk than the second risk score; and secure a network from a focus of the first application. ### Claim 19 (depends on 18) The non-transitory computer-readable storage medium of claim 18, wherein the non-transitory computer-readable medium further has stored therein instructions that when executed by the processing resource cause the processing resource to: score the first application to yield the first risk score by: scoring at least a first application tier of the first application to yield a first tier risk score and a second application tier associated with the first application to yield a second tier risk score, and generating the first risk score based at least in part on the first tier risk score. ### Claim 20 (depends on 19) The network securing system of claim 19, wherein the scoring the first application tier comprises: scoring at least a first workload of the first application tier to yield a first workload risk score and a second workload of the first tier to yield a second workload risk score, and generating the first tier risk score based at least in part on the first workload risk score. ### Claim 21 (depends on 20) The network securing system of claim 20, wherein the scoring the first workload comprises: calculating the first workload risk score based upon a combination of two or more of: a common vulnerability scoring system score, a degree of flatness, a degree of exposure, a number of live attack attempts, and a number of successful exploits.