WO2014107104A1

WO2014107104A1 - System and method for the scoring, evaluation and ranking of the assets of the information system

Info

Publication number: WO2014107104A1
Application number: PCT/MA2013/000001
Authority: WO
Original assignee: Netpeas S.A.
Priority date: 2013-01-02
Filing date: 2013-01-02
Publication date: 2014-07-10

Abstract

A solution (« SCORISKj® ») integrated into the « Place de Marché COREvidence ® des Technologies de l'Information » concept intended, in this environment, for the calculation and quantification of risk levels during assessment or compliance scans, on the basis of the following structured critera: the Precision, that is to say the common vulnerabilities reported by all the scan engines involved; the Weighting (or weight), based on the classification (scoring) regarding severity and exploitability of the CVSS v2.0 evaluation system; the predetermined Tagging, or Classification, when the vulnerability is tagged as part of a list of major risks according to the ordered list ΟψΕ/SANS Top 25; the Persistence, a criterion measuring the longevity of the vulnerability; a solution relating to an integrated and global approach of the security of assets.

Description

System and Method for the rating, evaluation and classification of information system assets

The present invention relates to a system and method for the rating, evaluation and classification of the assets of the information system of organizations.

The present invention relates to the field of vulnerability management of computer systems, e | t is positioned in a much larger field that is commonly known as "Software as a Service" (SaaS). . has experienced in recent years

important developments, and that seems to want to continue strongly with broad applications such as "virtualization" and cloud computing, and other online networkjet developments. Global vulnerability management is understood in the present invention as a new, homogenous and more comprehensive, even global, approach to; the security of computer systems. Thus, the present invention is classified in that it is possible to denote "SaaS Security". A better understanding of the present invention is to consider that it has been designed to audit and analyze the security of information systems, and provide an orderly, systematic, comprehensive, integrated and real-time solution.

Note: In the following, eiflraison of the inevitable preponderance of English expressions in information technology (Tl), it will be most often referred to in parentheses, and these expressions or abbreviations will be italicized.

Among the overall functionalities of the system described here, it is necessary to insist firstly on the integrated character of the presented solution, compared with the state of the prior art. In fact, the security needs of IT systems are very varied: Vulnerability Management, Risk Assessment, Monitoring / Surveillance (Monitô pg), Application Evaluation, Detection and

control / reduction of Ma / are, ... etc. In practice and on the market, each Publisher is focused on its more or less delimited domain. However, as consequences, the users of such solutions who wish to cover a maximum of aspects of the security of computer systems are obliged to acquire several solutions. This fact makes a global vision of security a very difficult task for the following reasons: data aggregation problems, compatibility of reports due to the multiplicity and variety of documents retrieved, differences in the management of support teams, different pricing, different settlement plans, time and considerable effort - and repetitive ^ - to compare the solution editors, how to classify reports, etc. To these problems, it is still necessary to add that some Solutions are not in SaaS, which results in making them more expensive and mobilizing more human and material resources. In summary, on the current state of the art, the vast heterogeneity of information systems infrastructures makes a complete evaluation by sticking to existing security solutions on the market.

Beyond the overall functionality of the system described here, which will be more detailed below, it is necessary to emphasize its main advantages, which are considerable time and productivity, because of the fact that analysis of safety data, the problem is to quickly identify and isolate priorities with the greatest guarantee - technically and

methodologically possible - that these priorities are indeed relevant. The solution that responds effectively to this problem is now available and bears the name "COREvidence ®".

The following summary of this solution is provided for explanation only, as it provides the framework for the invocation, which refers to the technical solution - as detailed below - detailed in this specification.

The "COREvidence" solution has the particularity of aggregating the content of several APIs or engines I scan. The result sought and obtained is the definition of the level of identification of common vulnerabilities, still conceived as a set of Vulnerabilities common to several scan engines. This result is in itself a response to the frequently encountered problem of the accuracy of audits and the 'false positives' that can result. The importance of defining this environment has earned it the title of "COREVidence Marketplace Marketplace Concept".

Information Technology "(The COREvidence IT Security Marketplace Concept).

And it is at this level that the present invention intervenes, constituting the central element of this concept, which; allows the calculation and quantification of risk levels during analysis or compliance scans.

In other words, the constituent technology of the present invention is COREvidence's (proprietary) 'proprietary' concept for the methodological and quantitative assessment of risks to assets, which is fundamentally based on the following criteria, as will be detailed in more detail. before:

Accuracy: Common Vulnerabilities reported by all scan engines involved. The higher this ratio is, the more the vulnerability is considered safe.

Weighting (or weight): This is based on the {scoring) rating for the severity and usability of the CVSS v2.0 evaluation system.

Pre-identified or Classification: Marked when the vulnerability is identified as part of a major hazard list according to the CWE / SANS Top 25 ordered list.

The COREvidençe system is structured as follows:

Based on a multiplicity of Network Vulnerability Scanners

Automated Scanners of Applications and Network Services (web)

Predefined Scanning Models Regulatory and Standards

Penetration tests and toolbox on demand, hacking 'ethics'.

Remote Voice Security Scanner over the Internet (VoIP)

Technical and Organizational Self-Assessment Questionnaires

(NIST, CIS, ISO27001, PCI DSS ...)

Security and Malware Tools, Running Front End Resources

Tool Scans (Ojen Source & Commercial) and Sensor Import Capabilities

Tl Vulnerability Service and Tools Monitoring.

Benefits provided by Ije System:

Flexibility of use based on Credit Plan

Customized Subscription Plans for SMB and Free Consultants

(Free lance)

Precise Scans Using Multiple APIs and Unlimited Scans Scan Engines & Fixed Asset Tracking or Variable Monitoring

Easy interface and able to be personalized.

Consolidated, Accurate and Unified Reports

features

Figure 7 (Table 4) typically summarizes the score calculations (according to the ScorRisk'j Scoring Guide).

Figure 8 (Table 5) çist, a table that typically summarizes the ScoRISK Quality Grades used to mark an asset.

As this framework is established, the expression of the invention is broken down into specific steps and procedures which are described below, essentially as concrete examples of the application of the system, which moreover reveal a methodology and operating procedures. specific. The procedure is therefore as follows or similarly to the steps below.

We assume a number 'n' of Scan Engines or (n APIs), involved in a scan process (as we could refer to it in COREvidence) and we consider the following formulas:

Level 1 Common Vulnerabilities (VC) = VC identified with 'n' APIs

Level 2 Common Vulnerabilities (VC) = VC identified with (n-1) APIs ...

Level 'N' Common Vulnerabilities (VC) = VC reported with each API

The example in Figure 1 i (Table 1) schematizes the concept.

i ■

By the application of the formula, three levels will be determined (because of 3 APIs in this example), as shown in Table 2 (Figure 5).

The following elements are defined by convention as follows:

v: Vulnerability

n: the number of APIs

L: is the level = (Nb (API): -M) (3 APIs if the number of levels is 2)

Occurrence: The number of times Vulnerability is detected by APIs. A vulnerability is detected n fols (by all APIs involved) up to 1 time (per 1 API).

Ratio (v) = Occurrence (v) / n * 100

GR (Global Ratio) = Sum (Ratio (v)) i / (Total Ratios except Level 1) * 100

(i ranging from n to L). In fact, we do not compute level 1 vulnerabilities. This is normal since we are looking for the ones found by more than one API.

Score +2 if Global Ratio> = 80%

Score ÷ 1 if Global Ratio <50 <70%

Score +0 if no common vulnerability

Table 3 (Figure 6) shows how the Ratio and Global Ratio are calculated using the example shown! Table 1 above. - Notes

Claims

1 - System and method for the rating, evaluation and classification of information system assets, constituting the central element of the concept of "COREvidence® Market Place of Information Technologies", a solution that has the particularity of aggregating the content of several APIs or scan engines, and framework approach whose primary purpose is the definition of the level of identification of common vulnerabilities designed as a set of Vulnerabilities common to several mores of scan, and result constituting in an answer to the frequently asked problem of the accuracy of the audits and the 'false-positives' that can result from them, having as their main advantages a considerable time saving and productivity] because of the fact that in the analysis of the data of safety, the problem I am asking is to quickly identify and isolate priorities with the greatest technical and methodological possible, that these priorities are actually relevant; solution in the framework thus described, characterized by the possibility of calculating and quantifying risk levels during the assessment or compliance scans, on the basis of at least the following structured criteria: Precision, c Common Vulnerabilities; reported by all the scan engines involved; the weighting (or weight), scored on the scoring for the severity and usability of the CVSS v2.0 evaluation system; the pre-determined Scoring, or Classification, when the vulnerability is identified as part of a list of major hazards according to the ordered list CWE / SANS Top 25; Persistence, criterion measuring the longevity of [Here vulnerability. (Figures 1 to 3).

2 - System and method for the evaluation, evaluation and classification of information system assets, according to Claim 1, characterized in that, as an integrated solution, meets system security requirements A wide range of computer-related issues, such as: Vulnerability management, evaluation; risks, monitoring / surveillance (monitoring), evaluation of applications, detection and [control and reduction of Malware,

3 - System and method for rating, evaluating and classifying the assets of the information system, according to Claims 1 and 2, characterized in that - since in the practice and on the market each Publisher is focused on its more or less delimited domain - with the consequence that users of such solutions who want to cover a maximum of aspects of the security of IT systems are obliged to acquire several solutions - this solution brings a global vision safety, especially avoiding the operators the problems! -de: aggregation of data, difficult compatibility of reports due to the multiplicity and variety of documents retrieved, differences in the management of support equipment, different pricing, different settlement plans, time and effortsllconsiderable and repetitive, to compare publishers solutions, and disparate methods of filing reports.

4 - System and method for rating, evaluating and classifying the assets of the information system, according to Claims 1 to 3, characterized in that, in the purpose for the client to minimize the cost of the Solution, particularly in terms of material and methodological human resources, said solution is provided in SaaS mode, or Logici! ej as a Service.

5 - System and method for rating, evaluating and classifying the assets of the information system, according to Claims 1 to 4, characterized in that this solution is deployed to compensate for the vast heterogeneity of the infrastructures of the information systems In the present state of the art, it is complex to make a comprehensive assessment of existing disparate security solutions on the market, providing a unique, comprehensive and integrated solution.