Patent ID: 9241007
Filing Date: 2016-01-19
CPC Classification: H04L

Claim Text:
1. A method, performed by a computer system, for providing a vulnerability assessment of a network of industrial automation devices, the method comprising: providing a user interface that enables a user to select an IP address range for a vulnerability assessment and that enables the user to select a plurality of industrial automation protocols with respect to which the vulnerability assessment will be performed; attempting to establish a communication session with each device within the selected IP address range, wherein, in response to the user selecting a plurality of industrial automation protocols, an attempt is made using each of the plurality of selected industrial automation protocols in order to identify any vulnerabilities within the IP address range for each of the selected industrial automation protocols; in response to being able to establish a communication session with a device, attempting to read manufacturer and model information from the device, wherein, in response to the user selecting a plurality of industrial automation protocols, a read attempt is made for each of the plurality of industrial automation protocols with which the system was successful in using to establish a communication session; mapping each of a plurality of industrial automation devices with a threat level; storing the mapping in a data store; in response to reading the manufacturer and model information from the device, determining a threat level associated with the device by looking up the device in the mapping using the manufacturer and model information and, in response to finding the device in the mapping, retrieving the threat level associated with the device; providing a vulnerability assessment to the user and uploading the vulnerability assessment to the data store, wherein the vulnerability assessment identifies each device with which a communication session was established and, for each identified device, the industrial automation protocol(s) with which the communication session was established and any threat level determined for the device; determining if the vulnerability assessment includes a new device that is not in the mapping; in response to the vulnerability assessment including a new device, flagging the new device for review and addition to the mapping; receiving a threat level associated with the new device; and updating the mapping to include the new device and the associated threat level.