Dave Cole

A security risk management system comprises a vulnerability database, an asset database, a local threat intelligence database and a threat correlation module. The vulnerability database comprises data about security vulnerabilities of assets on a network gathered using active or passive vulnerability assessment techniques. The asset database comprises data concerning attributes of each asset. The threat correlation module receives threat intelligence alerts that identify attributes and… Show more

A security risk management system comprises a vulnerability database, an asset database, a local threat intelligence database and a threat correlation module. The vulnerability database comprises data about security vulnerabilities of assets on a network gathered using active or passive vulnerability assessment techniques. The asset database comprises data concerning attributes of each asset. The threat correlation module receives threat intelligence alerts that identify attributes and vulnerabilities associated with security threats that affect classes of assets. The threat correlation module compares asset attributes and vulnerabilities with threat attributes and vulnerabilities and displays a list of assets that are affected by a particular threat. The list can be sorted according to a calculated risk score, allowing an administrator to prioritize preventive action and respond first to threats that affect higher risk assets. The security risk management system provides tools for performing preventive action and for tracking the success of preventive action. Show less

Computer-implemented methods, systems, and computer-readable media for determining (200) an action time when an action is taken regarding an executable content; storing (205) the action time with an indication of the executable content; storing (215) an entry time and an indication of the entered data source when the data processing system enters one of the plurality of data sources; receiving (220) an indication that the executable content is infected with a malicious code; receiving (225) an… Show more

Computer-implemented methods, systems, and computer-readable media for determining (200) an action time when an action is taken regarding an executable content; storing (205) the action time with an indication of the executable content; storing (215) an entry time and an indication of the entered data source when the data processing system enters one of the plurality of data sources; receiving (220) an indication that the executable content is infected with a malicious code; receiving (225) an indication of a data source targeted by the malicious code; scanning the data processing system for the malicious code at a scan time; storing (230) the scan time; determining (245) whether one of the plurality of data sources corresponds to the targeted data source; and when it is determined that one of the plurality of data sources corresponds to the targeted data source, determining (255) whether the entry time occurs after the action time and before the scan time; and when it is determined that the entry time occurs after the action time and before the scan time, sending (260) a warning regarding the potential threat. Show less

A determination is made as to whether there is a correlation between a user's security risk profile and a personalized threat profile of an actual or spreading threat. If there is a correlation, a personalized reactive alert is issued in the case of an actual threat. The personalized reactive alert informs the user of specific suspected data that may have been compromised by the threat and the specific non-computer related action that the user should take. Further, if there is a correlation, a… Show more

A determination is made as to whether there is a correlation between a user's security risk profile and a personalized threat profile of an actual or spreading threat. If there is a correlation, a personalized reactive alert is issued in the case of an actual threat. The personalized reactive alert informs the user of specific suspected data that may have been compromised by the threat and the specific non-computer related action that the user should take. Further, if there is a correlation, a personalized proactive alert is issued and/or personalized proactive protective action taken in the case of a spreading threat. The personalized proactive alert informs the user of the spreading threat that the user and/or the user's host computer system is particularly susceptible to. Further, the personalized proactive protective action taken provides automated risk mitigation. Show less

A system and method provide comprehensive and highly automated testing of vulnerabilities to intrusion on a target network, including identification of operating system, identification of target network topology and target computers, identification of open target ports, assessment of vulnerabilities on target ports, active assessment of vulnerabilities based on information acquired from target computers, quantitative assessment of target network security and vulnerability, and hierarchical… Show more

A system and method provide comprehensive and highly automated testing of vulnerabilities to intrusion on a target network, including identification of operating system, identification of target network topology and target computers, identification of open target ports, assessment of vulnerabilities on target ports, active assessment of vulnerabilities based on information acquired from target computers, quantitative assessment of target network security and vulnerability, and hierarchical graphical representation of the target network, target computers, and vulnerabilities in a test report. The system and method employ minimally obtrusive techniques to avoid interference with or damage to the target network during or after testing. Show less