Combining assessment models and client targeting to identify network security vulnerabilities

A system comprising:

• a plurality of client computing devices;
• a server communicatively coupled to the plurality of client computing devices, the server including:
• a network scanning engine that performs unauthenticated inspections of ports corresponding to each client computing device in a first set of client computing devices and each client computing device in a second set of client computing devices;
• the network scanning engine further configured to harvest the first and second sets of client computing devices from a target set of client computing devices to assess, the harvest including discovering at least some of the client computing devices in the first and second sets of client computing devices by name or by IP address;
• a server agent that communicates with the first set of client computing devices in the plurality of client computing devices, each client computing device in the first set of client computing devices including a client agent that independently performs a self-assessment process that determines security risks and security vulnerabilities of the client computing device in the first set of client computing devices that includes the client agent responsive to the communication from the server agent;
• a remote assessment component that performs a remote assessment process to determine security risks and security vulnerabilities of the second set of client computing devices in the plurality of client computing devices, the remote assessment component performing a further remote assessment process to identify security risks and security vulnerabilities of a selected client computing device in the first set of client computing devices;
• a reporting mechanism that combines results of the self-assessment process performed by the client agents of each client computing device in the first set of client computing devices with results of the remote assessment process to provide a combined data set indicative of security risks and security vulnerabilities of the plurality of client computing devices;
• and
• a network scanning engine that communicates with each client computing device in the plurality of client computing devices to determine which client computing devices include a client agent that performs the self-assessment process and which client computing devices do not include a client agent that performs the self-assessment process;
• the server configured to compare results of the further remote assessment process against results of the self-assessment process performed by the client agent included in the selected client computing device to determine whether any discrepancy exists in the results for the selected client computing device.

In a network that includes a server and a plurality of client computing devices communicatively coupled thereto, a method performed by the server comprising:

• performing unauthenticated inspection of ports corresponding to each client computing device in a first set of client computing devices and each client computing device in a second set of client computing devices;
• harvesting the first and second set of client computing devices from a target set of client computing devices to assess, the harvesting step including discovering at least some of the client computing devices in the first and second sets of client computing devices by name or by IP address;
• managing the first set of client computing devices in the plurality of client computing devices, each client computing device in the first set of client computing devices including one or more components that independently perform a self-assessment process to determine security risks and security vulnerabilities of the client computing device in the first set of client computing devices that includes the component(s) responsive to communication received from the server;
• obtaining a first set of results corresponding to the self-assessment processes performed by the component(s) included in the client computing devices in the first set of client computing devices;
• remotely assessing security risks and security vulnerabilities of the second set of client computing devices in the plurality of client computing devices to obtain a second set of results corresponding to the remote assessments;
• remotely assessing security risks and security vulnerabilities of a selected client computing device in the first set of client computing devices to obtain a third set of results;
• combining the first, second, and third sets of results into a combined data set indicative of security risks and security vulnerabilities of the first and second sets of the client computing devices in the plurality of client computing devices, including comparing results of the remote assessment of the selected client computing device against results of the self-assessment process performed by the component(s) included in the selected client computing device to determine whether any discrepancy exists in the results for the selected client computing device;
• and
• communicating with each client computing device in the plurality of client computing devices to determine which client computing devices include the component(s) that perform the self-assessment process and including the client computing devices in the first set of client computing devices, and to determine which client computing devices do not include the component(s) that perform the self-assessment process and including those client computing devices in the second set of client computing devices.