Vulnerability Correlation

Intelligent vulnerability correlation is key to reducing the false positive rate. The risk of any one attack clearly depends on whether or not the target system is vulnerable to the exploit being used. So a critical success factor in reducing false positives is the ability to intelligently incorporate relevant vulnerability scan information in the real-time correlation process from different vendors.

Many organizations have multiple vulnerability scanners. Yet there are security information management vendors who still can't link their correlation to even one vulnerability scanner, let alone the ones you might have deployed. Some appliance vendors insist you use the one vulnerability system that runs on their appliance, eliminating your ability to select the best of breed solution you need. After all, you don't want to be explaining to the CEO that the reason a core system was compromised was that you went with the easy VA scanner instead of the right one. It's not our job at OpenService to tell you what vulnerability scanner you should use; our job is to ensure we can correlate information using the scanner(s) you are using.

InfoCenter correlates inbound threats with a wide variety of industry-standard vulnerability assessment technologies, covering proprietary and open source technologies. InfoCenter has the ability to intelligently integrate data from multiple VA scanners, become the one console where you can view all your enterprise risk and vulnerabilities. InfoCenter’s vulnerability correlation is smart, too, including the ability to change how much a VA scan is trusted the older it is. By using risk-management algorithms to perform signature-by-signature IDS to VA system correlation, InfoCenter leads the industry in its ability to intelligently modify attack risk.

Better yet, InfoCenter's vulnerability correlation database is kept automatically up to date using the InfoCenter update service, eliminating the need, time and expense of writing new signature-based correlation rules that other products demand. And when you review attacks in the InfoCenter console, it's just a single click to determine what other hosts are vulnerable to the exploit—and the risk associated with each one. InfoCenter's vulnerability correlation therefore enables intelligent decision making and risk reduction, by allowing you to proactively patch at risk systems in the light of real-time hacker or worm activity.

For more on vulnerability correlation, read our white paper Real-time Risk and Vulnerability Management in the Resources section.