System and method for network vulnerability detection and reporting

A method of objectively assessing the security of a network, said method comprising the steps of:

• assigning a vulnerability risk level to each of a plurality of vulnerabilities found on the network;
• assigning a vulnerability risk level to each of a plurality of nodes on the network based on vulnerabilities found on each of the plurality of nodes;
• assigning an exposure risk level to each exposure found on the network;
• assigning an exposure risk level to each of a plurality of exposures found on the network;
• providing a security score that is dependent on at least the vulnerability risk levels of the vulnerabilities, the vulnerability risk levels of the nodes, and a number of nodes on the network;
• wherein to security score is further dependent on the exposure risk levels;
• wherein the security score is derived from a formula of form F=a−V−E, wherein F is the security score, a is a constant, V is a vulnerability loss, and E is an exposure loss.

A system for selectively calculating one of a plurality of network security scores, the system comprising:

• a network security score calculation module adapted to run computer instructions for calculating a network security score, the network security score being calculated according to defined vulnerabilities and exposures found in a network and defined numerical weights for each defined vulnerability and exposure;
• a plurality of network security calculation instruction sets, the plurality of network security calculation instruction sets adapted to define the vulnerabilities and exposures included in the calculation, and to define the numerical weights for each vulnerability and exposure;
• and
• a calculation selection module adapted to allow a computer user to select one of the plurality of network security calculation instruction sets to be run by the network security score calculation module;
• wherein the network security score is derived from formula of form F=a−V−E, wherein F is the network security score, a is a constant, V is a vulnerability loss, and E is an exposure loss.

A computer program product embodied on a tangible computer readable medium for objectively assessing the security of a network, said computer program product comprising:

• computer code for assigning a vulnerability risk level to each of a plurality of vulnerabilities found on the network;
• computer code for assigning a vulnerability risk level to each of a plurality of nodes on the network based on vulnerabilities found on each of the plurality of nodes;
• computer code for assigning an exposure risk level to each exposure found on the network;
• computer code for providing a security score that is dependent on at least the vulnerability risk levels of the vulnerabilities, the vulnerability risk levels of the nodes, and a number of nodes on the network;
• wherein the security score is derived front a formula of form F=a−V−E, wherein F is the security score, a is a constant, V is a vulnerability loss, and E is an exposure loss.