Distributed hardware vulnerability identification and resolution

A method comprising:

• scanning all devices on a network to be blocked according to stored representations of expected configurations of the devices to identify devices of interest;
• queuing and performing a deep scan job for each device of interest;
• passing deep scan results to an incident manager to open an incident ticket for each device of interest;
• and
• processing incident tickets by an automated incident response system (AIRS) to perform remedial actions on each device of interest, the processing of each incident ticket and associated device of interest including:
• identifying and initiating an appropriate job to reconfigure the device of interest;
• rescanning the device of interest to obtain a rescanning result;
• generating an alert to initiate investigation of the device of interest when the rescanning result is not as expected;
• and
• updating the incident manager to close the incident ticket when the rescanning result is as expected.

A system comprising:

• a processor;
• a network interface device;
• and
• a memory storing modules executable by the processor to perform data processing activities, the modules and their data processing comprising:
• a storage connector module executable by the processor to store and retrieve data from a shared data storage resource;
• a scanning module executable by the processor to:
• retrieve, via the storage connector module, stored representations of devices on a network accessible via the network interface device, the stored representations of devices including data indicating all devices are blocked by default and identifies devices expressly opened;
• scan all devices on the network to be blocked according to the retrieved stored representations to identify devices of interest;
• add devices of interest to a deep scanning queue;
• and
• store data representative of device scanning results via the storage connector module;
• a deep scanning module to:
• perform deep scanning of each device of interest present in the deep scanning queue;
• and
• pass deep scan results, via the storage connector module, to an incident manager module to open an incident ticket for each device of interest;
• an automated incident response module executable by the processor to:
• retrieve incident tickets, via the storage connector module, from the incident manager module;
• and
• process each incident ticket to perform remedial actions on each device of interest, the processing of each incident ticket and associated device of interest including:
• identifying and initiating an appropriate job to reconfigure the device of interest;
• rescanning the device of interest to obtain a rescanning result;
• generating an alert via the network interface device to initiate investigation of the device of interest when the rescanning result is not as expected and updating the incident manager module, via the storage connector module, to reflect the rescanning result;
• and
• updating the incident manager module, via the storage connector module, to close the incident ticket when the rescanning result is as expected.