Automated security assessment of business-critical systems and applications

Abstract

Systems and methods which provide a new application security assessment framework that allows auditing and testing systems to automatically perform security and compliance audits, detect technical security vulnerabilities, and illustrate the associated security risks affecting business-critical applications.

Having thus described the invention, what is claimed as new and secured by Letters Patent is: 
     
         1 . A method for assessing a security configuration of a target computer system, the method comprising:
 a) scanning previously provided IP addresses and ports;   b) fingerprinting detected open ports to identify underlying services for said open ports;   c) detecting if said target system is active   d) accessing a database of modules and executing at least one of said modules, said modules being for determining security vulnerabilities accessible through said IP addresses and ports wherein
 said at least one module is executed based on a configuration of said module; 
 said target computer system is for executing business-critical applications; and 
 wherein at least one of said modules executes a method comprising:
 cc-1) retrieving destination tables for remote function calls and other interfaces for application servers associated with said target system; 
 cc-2) retrieving log files for applications for said target system; 
 cc-3) determining connections between different systems associated with said target system based on said destination tables and log files; 
 cc-4) graphically mapping said connections; 
 cc-5) providing a user with a graphical map of said connections. 
 
   
     
     
         2 . A method according to  claim 1  wherein step b) comprises the steps of:
 b1) accessing a fingerprint database containing a plurality of predefined network queries, each predefined query being associated with at least one expected response; 
 b2) sending at least one of said plurality of predefined network queries to said open ports; 
 b3) receiving at least one response to said queries; 
 b4) analyzing said at least one response to determine if said at least one response is an expected response; 
 wherein a receipt of an expected response is an indication of an availability of a specific service at said target system. 
 
     
     
         3 . A method according to  claim 1  wherein at least one of said modules is executed based on a method comprising:
 aa-1) determining a scope of said at least one module, said scope for each module being predetermined and coded into each module; 
 aa-2) in the event said scope is for a system, executing a function of said module once per target system; 
 aa-3) in the event said scope is for a component, executing a function of said module for one specific connector associated with a specific target component; 
 aa-4) in the event said scope is for a connector, executing a function of said module for a specific connector. 
 
     
     
         4 . A method according to  claim 1  wherein at least one of said modules executes a method comprising:
 bb-1) receiving at least one program identifier from a user; 
 bb-2) for each of said at least one program identifier, 
 bb-2-1) connecting to a gateway for said target system; 
 bb-2-2) attempting to initiate a specific server associated with said program identifier on a host for a program identified by said program identifier; 
 bb-3) determining which program associated with said at least one program identifier can be initiated based on a result of step bb-2-1). 
 
     
     
         6 . A method according to  claim 1  wherein at least one of said modules executes a method comprising:
 dd-1) receiving IP address ranges and ports from a user; 
 dd-2) attempting to connect to each IP address and port combination through a software router associated with said target system, each combination being derived from said IP address ranges and ports from step dd-1) and each combination being representative of a connection; 
 dd-3) determining that a connection representing a specific IP address and port combination is successful in the event said software router does not deny a connection attempt using said specific IP address and port combination; 
 dd-4) providing said user with a listing of successful and failed connections. 
 
     
     
         7 . A method according to  claim 1  wherein at least one module executes a method for routing network traffic through a software router associated with said target system, the method comprising:
 ee-1) creating an end-point, said end-point comprising a proxy server and a protocol translator, said protocol translator being for translating a protocol associated with said target system and software routers associated with said target system; 
 ee-2) receiving outgoing network traffic from network software connected to said end-point; 
 ee-3) forwarding said outgoing network traffic to said protocol translator; 
 ee-4) at said protocol translator, packaging said outgoing network traffic into outgoing packets compatible with said software routers associated with said target system; 
 ee-5) forwarding said outgoing packets to software routers associated with said target system; 
 ee-6) receiving incoming packets from said software routers; 
 ee-7) sending said incoming packets to said protocol translator; 
 ee-8) unpacking said incoming packets into incoming network traffic; 
 ee-9) forwarding said incoming network traffic to said network software. 
 
     
     
         8 . A method according to  claim 1  wherein at least one module executes a method comprising:
 ff-1) connecting to a database of said target system; 
 ff-2) accessing said database and retrieving specific entries from specific fields from said database; 
 ff-3) calculating a signature value from said specific entries; 
 ff-4) storing said signature value in a repository remote from said target system; 
 ff-5) in the event multiple signature values exist for said target system, storing each signature value separately. 
 
     
     
         9 . A method according to  claim 8  wherein said method further comprises the steps of:
 ff-6) executing steps ff-1) to ff-5) at least twice at different times; 
 ff-7) comparing signature values obtained at each execution; 
 ff-8) reporting differences between said signature values compared in step ff-6). 
 
     
     
         10 . A method according to  claim 1  wherein at least one module executes a method comprising:
 gg-1) connecting to a target system; 
 gg-2) executing a special function to verify if files associated with a specific application server have properly defined security permissions; 
 gg-3) reporting results of verification executed in step gg-2); 
 wherein said step gg-1) is executed independently of an underlying operating system of said target system. 
 
     
     
         11 . A method according to  claim 1  wherein at least one module executes a method comprising:
 hh-1) receiving configuration instructions from a user; 
 hh-2) attempting to execute a plurality of operating system commands on an operating system of said target system; 
 hh-3) attempting to open and close network connections between said target system and remote systems; 
 hh-4) attempting to provide proxy services to network traffic between said target system and specific networked systems; 
 wherein said module is logically executed in the operating system of said target system. 
 
     
     
         12 . A system for automatically testing at least one target business-critical application running on a target computer system or network of computer systems, for security vulnerabilities or security configuration problems, the system comprising:
 a core engine subsystem for storing data related to said security vulnerabilities or configurations for at least one target business-critical application;   at least one scan engine subsystem in communication with said core engine subsystem, said scan engine subsystem comprising:
 a system identifier subcomponent for determining resources of said at least one target business-critical application; 
 a plurality of testing and probing modules for automatically testing resources of said at least one target business-critical application and for determining if at least one of a vulnerability and a security configuration problem on said resources exist; 
 an intelligent dispatch subcomponent for launching at least one of said testing and probing modules based on a configuration of said module; 
 wherein said at least one target computer system executes business-critical applications. 
   
     
     
         13 . A system according to  claim 12  wherein said at least one computer system comprises at least one computer network comprising at least one computer server. 
     
     
         14 . A system according to  claim 13  wherein said at least one computer server comprises a database. 
     
     
         15 . A system according to  claim 12  wherein said resources comprises at least one of services, ports, components, interfaces and connectors. 
     
     
         16 . A system according to  claim 12  further comprising a user interface for controlling a behavior of said system and for entering parameters for said system. 
     
     
         17 . A system according to  claim 12  wherein said testing and probing modules utilizes at least one of vulnerabilities subject to being exploited, database SQL queries, and configurations to automatically test said resources. 
     
     
         18 . A system according to  claim 17  wherein said testing and probing modules utilizes at least one security vulnerability on said at least one target business-critical application to automatically test said resources of said at least one target business-critical application. 
     
     
         19 . A system according to  claim 17  wherein said testing and probing modules sends database queries to a database of said at least one target business-critical application to determine if security configuration problems exist for said at least one target business-critical application. 
     
     
         20 . A system according to  claim 17  wherein said testing and probing modules accesses a configuration of said at least one target business-critical application to determine if security configuration problems exist for said at least one target business-critical application. 
     
     
         21 . A system according to  claim 17  wherein said testing and probing modules comprise at least one module which performs a white-box analysis of said resources. 
     
     
         22 . A system according to  claim 17  wherein said testing and probing modules comprise at least one module which performs a black-box analysis of said resources. 
     
     
         23 . A system according to  claim 21  wherein said at least one module which performs a white-box analysis of said resources is configured with credentials to log into said at least one target business-critical application.