Patent ID: 7841007
Filing Date: 2010-11-23
Classification: G06F,G06Q,H04L

Abstract:
1. An apparatus for providing a security status of an on-line service, comprising: a web page object that is automatically rendered by a browser when a visitor uses the browser to access one or more web pages of the on-line service via a public network; and a computer including a verification service that hosts the web page object separately from the one or more web pages of the on-line service, and further controls contents of the web page object, wherein the visitor is not required to take any action other than requesting access to the on-line service via the browser to receive the security status through the automatic rendering of the web page object by the visitor's browser, and wherein the verification service causes the contents of the web page object to be changed in accordance with its prior determination of a level of the security status, such that when the verification service determines, in a first verification operation prior to the visitor's access request, that the on-line service has a first level of the security status, it causes the web page object to have first contents, and when the verification service determines, in a second verification operation prior to the visitor's access request, that the on-line service has a different second level of the security status, it causes the web page object to have different second contents, and thereby automatically controls the visitor's perception of the different security status levels via the browser's automatic rendering of the prior-determined and changed web page object contents when the visitor requests access to the on-line service, and wherein the first and second verification operations to determine the on-line service's security status and control the contents of the web page object are performed by the verification service prior to and completely independently from the visitor's request to access the on-line service, and independently from any action by the visitor and the visitor's browser, and wherein the levels of the security status displayed for the visitor via the automatic rendering of the web page object indicate how vulnerable devices and services of the on-line service are to hackers and other online security threats as determined by the first and second verification operations, and wherein at least one of the first and second verification operations include determining the security status by comparing a fingerprint of a new vulnerability to a stored list of the devices and services and without performing an actual scan or test of the devices and services, and wherein when the verification service causes the web page object to have at least one of the first and second contents, the web page object appears invisible to the visitor after it is rendered by the visitor's browser, and wherein at least one of the first and second verification operations includes scanning the on-line service from a remote address on the network, and wherein the scanning produces a set of XML files including information about open ports, available service, network protocols, security exposures and vulnerabilities, the information associated with a device providing the on-line service, and wherein a scan header record associated with the scanning is stored in a database, the scan header record including a date, launch time, duration and a number of vulnerabilities classified by severity level; wherein the database stores information about generic services expected to be running on the open ports; wherein the scanning is performed using a scanning engine of the verification service; wherein the scanning engine parses the set of XML files and stores records of the parsed set of XML files in the database in association with a device record that is further in association with an account number of a provider of the online service; wherein the apparatus is operable such that the scanning is performed according to a schedule.