Patent ID: 9202183
Filing Date: 2015-12-01
Classification: G06Q

Abstract:
1. A method for auditing an organization's internal controls for handling information technology (IT) configurations and vulnerabilities comprising: receiving, with a processor, a technology summary summarizing a plurality of IT systems in an organization; based on the technology summary, assigning, with the processor, a vulnerability risk value to each of the plurality of IT systems, wherein each vulnerability risk value represents the risk of the associated IT system compromising the integrity of sensitive information in the organization; determining, with the processor, a risk threshold; comparing the risk threshold to the vulnerability risk value associated with each of the plurality of IT systems; based at least in part on the comparison between the risk threshold and the vulnerability risk value associated with each of the plurality of IT systems, selecting, with the processor, one or more of the plurality of IT systems to test; for each of the selected one or more IT systems, identifying a first vulnerability and a second vulnerability that affect the respective IT system; performing, with the processor, a test of each of the selected one or more IT systems, based on the first vulnerability and the second vulnerability that affect the respective IT system; accessing a file associated with the first vulnerability, the file identifying a patch that can correct the first vulnerability and/or the second vulnerability in the respective IT system; implementing the patch and determining whether the first vulnerability has been corrected using the patch identified in the file; and if the first vulnerability has been corrected, determining, based on the file, whether the second vulnerability was corrected when the first vulnerability was corrected.