Patent ID: 9141805
Filing Date: 2015-09-22
Classification: G06F,H04L

Abstract:
1. A method for security testing, comprising: maintaining a record of vulnerabilities associated with existing malicious software programs; identifying a vulnerability in an asset; identifying, using one or more processors, whether the vulnerability is utilized by an existing malicious software program by accessing the record; executing a security tool, using the one or more processors, to determine whether the vulnerability is exploitable, wherein the determination whether the vulnerability is exploitable is based on information from one or more security forums and websites; determining a risk level of the vulnerability based on whether the vulnerability is utilized by the existing malicious software program; determining a new risk level for a future time based on factors utilized to determine the risk; and determining a remediation strategy for the vulnerability in the asset according to a determined priority of remediation of vulnerabilities based on any combination of the risk level, the new risk level, an overall risk, risk aggregation in relation to risk thresholds, cost of remediation, and/or uptime requirements.