Real-time vulnerability monitoring

Abstract

A security information management system is described, wherein client-side devices preferably collect and monitor information describing the operating system, software, and patches installed on the device(s), as well as configuration thereof. A database of this information is maintained, along with data describing vulnerabilities of available software and associated remediation techniques available for it. The system exposes an API to support security-related decisions by other applications. For example, an intrusion detection system (IDS) accesses the database to determine whether an actual threat exists and should be (or has been) blocked.

1 . A system, comprising: 
 a plurality of computing devices, each comprising a processor and memory, wherein the memory is encoded with programming instructions executable by the processor;    a database of device status information that characterizes zero or more vulnerabilities to which each of the computing devices is subject, wherein the device status information is kept current in substantially real time; and    an application that 
 transmits a query signal to the database;  
 receives a result signal, responsive to the query signal, from the database; and  
 makes a security-related determination based on the result signal.  
   
   
   
       2 . The system of  claim 1 , wherein the application is an intrusion detection system, and the security-related determination is whether to produce a signal indicating that an intrusion attempt has occurred.  
   
   
       3 . The system of  claim 1 , wherein: 
 the application is selected from the group of applications consisting of a firewall, a proxy, and a router; and    the security-related determination is whether to allow a connection to pass.    
   
   
       4 . The system of  claim 1 , wherein the security-related determination is selected from the group consisting of: 
 whether to block a connection attempt;    whether to pass a communication from one device to another through a network; and    whether to permit software to be installed.    
   
   
       5 . The system of  claim 4 , wherein the connection attempt is a request from an external device to connect with at least one of the plurality of computing devices.  
   
   
       6 . The system of  claim 4 , wherein the connection attempt is a request from one of the computing devices to connect with another of the computing devices.  
   
   
       7 . The system of  claim 1 , wherein the query signal and the result signal are each transmitted over a network.  
   
   
       8 . The system of  claim 1 , wherein for at least one of the plurality of computing devices, the device status information is kept current by a software agent executed by the processor of each of the at least one of the plurality of computing devices.  
   
   
       9 . The system of  claim 8 , wherein: 
 a set of programming instructions for the software agent is encoded in the memory of the at least one computing device; and    the set of programming instructions is executed by the processor of the at least one computing device.    
   
   
       10 . The system of  claim 1 , wherein a single computing device hosts the database of device status information and the application.  
   
   
       11 . The system of  claim 10 , wherein the single computing device is not in the plurality of computing devices.  
   
   
       12 . A method, comprising: 
 transferring data including device status information from at least one client computer to a server incorporating a database in substantially real time;    receiving a connection request at an application;    transmitting a query signal from the application to the server, the query signal including information characterizing the connection request;    transmitting a result signal, responsive to the query signal, from the server to the application; and    making and executing a security-related determination relating to the connection request, wherein the determination is made as a function of the information in the query signal and data in the database.    
   
   
       13 . The method of  claim 12 , wherein the determination is to block the connection request.  
   
   
       14 . The method of  claim 12 , wherein the determination is made by the application based on the result signal.  
   
   
       15 . The method of  claim 12 , wherein: 
 the determination is made by the server;    the determination is reflected by information in the result signal; and    the executing is performed by the application.    
   
   
       16 . The method of  claim 12 , wherein: 
 the application is an intrusion detection system; and    the determination is to produce a signal indicating that an intrusion attempt has occurred.    
   
   
       17 . The method of  claim 12 , wherein for each of the at least one client computers, the database includes: 
 information that characterizes zero or more vulnerabilities to which the client computer is subject;    data identifying an operating system, software, and patches installed on the client computer;    software security information associated with the operating system, software, and patches; and    data characterizing the system policy settings and configuration data on the client computer.    
   
   
       18 . The method of  claim 12 , further comprising transferring a data stream including vulnerability remediation information from at least one vulnerability remediation database to the server.  
   
   
       19 . The method of  claim 18 , wherein the data stream includes: 
 data characterizing security vulnerabilities for one or more operating systems; and    vulnerability remediation information, the vulnerability remediation information including vulnerability remediation techniques for the security vulnerabilities.    
   
   
       20 . The method of  claim 19 , further comprising: 
 selecting a remediation technique for a vulnerability of the at least one client computer; and    applying the selected vulnerability remediation technique, wherein the selecting is performed by the server, and the applying is performed by the at least one client computer.    
   
   
       21 . The method of  claim 12 , wherein: 
 the at least one client computer is on a subnet; and    the connection request includes a request from a source that is not on the subnet to connect with the at least one client computer.    
   
   
       22 . The method of  claim 12 , wherein: 
 the plurality of computing devices includes a first client computer and a second client computer; and    the connection request includes a request from the first client computer to connect with the second client computer.    
   
   
       23 . The method of  claim 12 , wherein the connection request includes a request from an external source to install a software program on one of the at least one client computers.  
   
   
       24 . An apparatus, comprising a device encoded with logic executable by one or more processors to communicate with a database of device status information to make a security-related determination, wherein: 
 the device status information includes information representing zero or more vulnerabilities of a client computer, updated in substantially real time; and    the determination is made as a function of the device status information.    
   
   
       25 . The apparatus of  claim 24 , wherein the communication with the database includes: 
 the device transmitting a query signal to the database; and    the database transmitting a result signal, responsive to the query signal and containing information from the database, to the device.    
   
   
       26 . The apparatus of  claim 25 , wherein the determination is made based on the result signal.  
   
   
       27 . The apparatus of  claim 24 , wherein the determination is selected from the group consisting of: 
 whether to block a connection attempt;    whether to pass a communication from one device to another through a network; and    whether to permit software to be installed.    
   
   
       28 . The apparatus of  claim 24 , wherein the device is an intrusion detection system, and the determination includes whether to produce a signal that indicates an intrusion attempt has occurred.  
   
   
       29 . The apparatus of  claim 24 , wherein the device status information further includes information representing vulnerabilities and remediation techniques received from a vulnerability remediation database.  
   
   
       30 . The apparatus of  claim 29 , wherein the determination includes: 
 selecting one or more remediation techniques; and remediating one or more vulnerabilities of the client computer according to the one or more selected techniques.    
   
   
       31 . A method, comprising: 
 receiving device status information for one or more computing devices in substantially real time;    detecting one or more vulnerabilities of the one or more computing devices based on the device status information;    selecting one or more remediation techniques from a first database, the one or more remediation techniques corresponding to the one or more detected vulnerabilities; and    remediating the one or more detected vulnerabilities according to the one or more selected remediation techniques.    
   
   
       32 . The method of  claim 31 , wherein the receiving, detecting, and selecting are performed by a server incorporating the first database.  
   
   
       33 . The method of  claim 31 , wherein: 
 the remediation techniques are initially stored in a second database; and    the remediation techniques are periodically updated from the second database to the first database.    
   
   
       34 . The method of  claim 31 , wherein for at least one of the plurality of computing devices, the device status information is updated in substantially real time by a software agent executed by a processor of the at least one computing device.  
   
   
       35 . The method of  claim 34 , wherein: 
 a set of programming instructions for the software agent is encoded in a memory of the at least one computing device; and    the set of programming instructions is executed by a processor of the at least one computing device.    
   
   
       36 . A system, comprising: 
 a plurality of computing devices, each comprising at least one processor and memory, wherein the memory is encoded with programming instructions executable by the processor;    a database of security information, wherein: 
 the security information includes device status information that characterizes zero or more vulnerabilities to which each of the computing devices is subject;  
 the security information also includes one or more remediation techniques;  
 the device status information is kept current in substantially real time; and  
 the system is operable to select remediation techniques as a function of the security information and remediate vulnerabilities to which the computing devices are subject according to the selected remediation techniques; and  
   an application that makes security-related determinations as a function of the security information.    
   
   
       37 . The system of  claim 36 , wherein the application: 
 transmits a query signal to the database;    receives a result signal, responsive to the query signal, from the database; and    makes a security-related determination based on the result signal.    
   
   
       38 . The system of  claim 36 , wherein: 
 the application is an intrusion detection system; and    the determination is whether to generate a signal indicating that an intrusion attempt has occurred.    
   
   
       39 . The system of  claim 36 , wherein the application is selected from the group consisting of a firewall, a proxy, and a router.