SYSTEMS AND METHODS FOR CYBER SECURITY RISK ASSESSMENT
The present invention is directed to methods, systems, and non-transitory computer readable mediums which can evaluate cyber readiness of an organization. The methods can include: presenting a plurality of objective questions to a user; receiving answers to said plurality of objective questions from said user; determining based on said answers a risk rating for a threat origin of a cyber-attack; determining based on said answers a strength rating for an organizational safeguard against said threat origin; comparing said risk rating of said threat origin to said strength rating of said organizational safeguard; determining based on said comparison a cyber readiness of said organizational safeguard from said cyber-attack by said threat origin; and presenting the cyber readiness of said organizational safeguard. Systems and non-transitory computer readable mediums operating in a similar fashion as such systems are disclosed herein.
This application is a continuation of U.S. application Ser. No. 15/633,242 filed on Jun. 26, 2017, the entire contents of which are relied upon and incorporated by reference.
TECHNICAL FIELDThe present disclosure relates to a system for cyber-risk assessment of an organization, and more specifically, to modeling cyber readiness of an organization against possible cyber-risks.
BACKGROUNDCyber-attacks relate to malicious attempts through cyberspace or physical access to alter, manipulate, destruct, deny, degrade or destroy an organization's computers or networks, or the information residing in them, with the effect, in cyber space or the physical world, of compromising stability or prosperity of an organization. As such, cyber-attacks can come in many different forms including, but not limited to, hacking, malware, ransomware, botnets, DoS, social engineering, and phishing. Along these lines, cyber-attacks may come from different sources including, but not limited to, an attack from outside the organization, an attack from inside the organization by and/or through an individual within the organization, and a use of physical access.
As such, organizations must have multiple processes and technologies in place to deter and defend against cyber-attacks, as well as must employ evaluations to ensure their cyber readiness. However, given the numerous different types of cyber-attacks, and the complexity of cyber-security processes and measures, it is difficult to adequately determine the sufficiency of an organization's processes and technologies in deterring and defending against cyber threats.
SUMMARY OF THE INVENTIONIn an embodiment of the present invention, a method for evaluating cyber readiness of an organization is provided, including: presenting a plurality of objective questions to a user, wherein each of the objective questions has one or more predefined answers to be selected by the user; receiving answers to the plurality of objective questions from the user; determining based on the answers a risk rating for a threat origin of a cyber-attack; determining based on the answers a strength rating for an organizational safeguard against the threat origin; comparing the risk rating of the threat origin to the strength rating of the organizational safeguard; determining based on the comparison a cyber readiness of the organizational safeguards from the cyber-attack by the threat origin; and presenting the cyber readiness rating of the organizational safeguard.
In another embodiment of the present invention, a system for evaluating cyber readiness of an organization is provided, including: a memory storage device and a processor in communication with the memory storage device. The processor is configured to: present a plurality of objective questions to a user, wherein each of the objective questions has one or more predefined answers to be selected by the user; receive answers to the plurality of objective questions from the user; determine based on the answers a risk rating for a threat origin of a cyber-attack; determine based on the answers a strength rating for an organizational safeguard against the threat origin; compare the risk rating of the threat origin to the strength rating of the organizational safeguard; determine based on the comparison the cyber readiness of the organizational safeguard from the cyber-attack by the threat origin; and present the cyber readiness rating of the organizational safeguard.
In yet another embodiment of the present invention, a non-transitory computer-readable medium tangibly storing computer program instructions is provided, which when executed by a processor, causes the processor to: present a plurality of objective questions to a user, wherein each of the objective questions has one or more pre-defined answers to be selected by the user; receive answers to the plurality of objective questions from the user; determine based on the answers a risk rating for a threat origin of a cyber-attack; determine based on the answers a strength rating for an organizational safeguard against the threat origin; compare the risk rating of the threat origin to the strength rating of the organizational safeguard; determine based on the comparison a cyber readiness of the organizational safeguard from the cyber-attack by the threat origin; and present the cyber readiness rating of the organizational safeguard.
Other features and advantages will become apparent from the following description, taken in connection with the accompanying drawings, wherein, by way of illustration and example, embodiments of the invention are disclosed.
The foregoing and other features and advantages will be apparent from the following, more particular, description of various exemplary embodiments, as illustrated in the accompanying drawings, wherein like reference numbers generally indicate identical, functionally similar, and/or structurally similar elements.
Reference will now be made in detail to various embodiments of the present invention, examples of which are illustrated in the accompanying drawings. It is to be understood that the figures and descriptions of the present invention included herein illustrate and describe elements that are of particular relevance to the present invention. It is also important to note that any reference in the specification to “one embodiment,” “an embodiment” or “an alternative embodiment” means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. As such, the recitation of “in one embodiment” and the like throughout the specification does not necessarily refer to the same embodiment.
The systems and methods disclosed herein are directed to evaluating cyber readiness of an organization. Cyber readiness can refer to the process of integrated security measure across a system or infrastructure of an organization that monitors for and/or deters cyber threats. Referring now to
Referring now to
Moreover, the strength rating 109a-e can refer to a quality level of protecting one or more organizational resources from one or more avenues of a cyber-attack. As such, the strength rating 109a-e can be a plurality of levels. The levels can be presented to a user in the form of text and/or color. According to an embodiment, the strength rating 109a-e can be presented to a user as “Good,” “Acceptable,” “Deficient,” or “TBD.” According to another embodiment, the strength rating 109a-e can be presented to a user as green, yellow, red, or gray. The color green can represent “Good,” the color yellow can represent “Acceptable,” the color red can represent “Deficient,” and the color gray can represent “TBD.” “TBD” can refer to an insufficient amount of information entered into the system for assessment of the organizational safeguard at hand.
The inherent risk profile 107 can comprise one or more threat vectors 110a-c and/or one or more threat origins 111a-c. The threat vectors 110a-c can be a method in which a threat source attempts to alter, manipulate, destruct, deny, degrade or destroy an organizational resource with or without authorized access. For example, as shown, the threat vectors 110a-c can be “Hacking,” “Malware/Ransomware,” “Botnets,” “DoS/DDoS,” “Use of Insider Employee,” “Via Trusted Third Party Provider/Vendor,” “Social Engineering (Not Phishing),” “Phishing,” “Vishing,” “Physical Access to Facility,” and “Dumpster Diving.”
Along these lines, the threat origins 111a-c can refer to a method or location in which a threat origin attempts to alter, manipulate, destruct, deny, degrade or destroy an organizational resource with or without authorized access. For example, as shown, the threat origins 111a-c fall into categories such as “Attack from Outside,” “Use of Insiders,” and “Use of Physical Access.” “Attack from Outside” can refer to an individual outside of an organization attempting to access an organizational resource by a connection to the organization that is available to the individual from the outside. “Use of Insiders” can refer to an individual inside (e.g., employee) an organization, or related to the organization (e.g., vendor), using legitimate access granted to the individual with malicious intent. “Use of Physical Access” can refer to an individual outside of an organization that acquires unauthorized access to an organizational resource by gaining access to the organization's physical facilities or property.
As such, the threat origins 111a-c can each comprise one or more threat vectors 110a-c. Accordingly, the threat vectors 110a-c can be grouped according to their threat origin 111a-c. For example, as illustrated, the threat origin 111a—“Attack from Outside”—can comprise the threat vectors 110a—“Hacking,” “Malware/Ransomware,” “Botnets,” and “DoS /DDoS.” Also, threat origin 111b—“Use of Insiders”—can comprise the threat vectors 110b—“Use of Insider Employee,” “Via Trusted Third Party Provider/Vendor,” “Social Engineering (Not Phishing),” “Phishing,” and “Vishing.”
In addition, the inherent risk profile 107 can comprise a risk rating 112a-c for the threat vectors 110a-c and/or a risk rating 113a-c for the threat origins 111a-c. The risk ratings 112a-c, 113a-c can refer to a likelihood of receiving a cyber-attack from the threat vectors 110a-c and/or threat origins 111a-c. As such, the risk ratings 112a-c, 113a-c for the threat vectors 110a-c and/or threat origins 111a-c can comprise a plurality of levels. The plurality of levels can be the same or different for the threat vectors 110a-c and threat origins 111a-c. Along these lines, the plurality of levels for the threat vectors 110a-c and/or threat origins 111a-c can be the same or different than those of the evaluation categories 108a-e.
Moreover, the risk rating 112a-c, 113a-c for the threat vectors 110a-c and/or the threat origins 111a-c can be presented to a user in the form of text and/or color. According to an embodiment, the risk ratings 112a-c, 113a-c of the threat vectors 110a-c and/or the threat origins 111a-c can be presented to a user as “Very High,” “High,” “Medium,” “Low,” or “Very Low.” According to another embodiment, the risk ratings 112a-c, 113a-c of the threat vectors 110a-c and/or the threat origins 111a-c can be presented to a user as a medium shade of red, a light shade of red, a medium shade of yellow, a medium shade of green, or a light shade of green. The medium shade of red can represent “Very High,” the light shade of red can represent “High,” the medium shade of yellow can represent “Medium,” the medium shade of green can represent “Low,” and the light shade of green can represent “Very Low.”
To determine the inherent risk profile 107, an inherent risk assessment may be performed. Referring now to
The look-up tables 116 can each comprise each possible answer or combination of answers a user may select for a particular question and a preliminary risk rating relating to a likelihood of being attacked by one or more threat actors for each possible answer. The preliminary risk rating can be one of a plurality of threat levels and, thus, can be the same or different for each of the look-up tables 116. Along these lines, each of the look-up tables can comprise the same threat actor(s) 117a-e (e.g., “Organized Crime,” “Hactivists,” “Nation States/Competitor,” “Nation States/Disruption, Destruction,” and “Disgruntled Employees.”)
Based on the answers to one or more questions 115, the inherent risk assessment 114 can determine the risk of cyber-attack via one or more threat actors 117a-e and a cumulative risk rating 118a-e for each of the threat actors 117a-e. Along these lines, based on the threat actors 117a-e and their cumulative risk ratings 118a-e, the inherent risk assessment 114 can also determine a risk rating 112a-c for one or more threat vectors 110a-c of one or more threat origins 111a-c.
Referring now to
As such, the questions presented in categories 121a-g can comprise one or more objective questions having predefined answers for selection by a user. Alternatively, the questions presented in categories 121a-g can permit a user to manually input a free-form answer. As such, the questions presented in categories 121a-g can be for informational purposes only (free-form answers) and/or for the inherent risk assessment or the cyber preparedness assessment. According to an embodiment, the inherent risk assessment can only be based on one or more objective questions having predefined answers for selection by a user. According to another embodiment, the questions permitting a user to manually input a free-form answer can only be used for informational purposes.
Referring now to
Upon selection of multiple industries, the inherent risk assessment can select the highest risk rating for each of the threat actors 117a-e corresponding to the selected industries. For example, the “Aircraft” industry has a low risk of being attacked by “Organized Crime,” a medium risk of being attacked by “Hacktivists,” a high risk of being attacked by “Nation States/Competitor,” a high risk of being attacked by “Nation States/Disruption, Destruction,” and a high risk of being attacked by “Disgruntled Employees.” Whereas, the “Amusement Parks” industry has a medium risk of being attacked by “Organized Crime,” a medium risk of being attacked by “Hacktivists,” a low risk of being attacked by “Nation States/Competitor,” a low risk of being attacked by “Nation States/Disruption, Destruction,” and a low risk of being attacked by “Disgruntled Employees.” Moreover, the “Hotels” industry has a high risk of being attacked by “Organized Crime,” a medium risk of being attacked by “Hacktivists,” a high risk of being attacked by “Nation States/Competitor,” a low risk of being attacked by “Nation States/Disruption, Destruction,” and a medium risk of being attacked by “Disgruntled Employees.”
As such, upon selection of both the “Aircraft” and “Amusement Parks” industries (and no others), the inherent risk assessment can determine the organization has a medium risk of being attacked by “Organized Crime,” a medium risk of being attacked by “Hacktivists,” a high risk of being attacked by “Nation States/Competitor,” a high risk of being attacked by “Nation States/Disruption, Destruction,” and a high risk of being attacked by “Disgruntled Employees.” Moreover, upon selection of each of the “Aircraft,” “Amusement Parks,” and Hotels” industries (and no others), the inherent risk assessment can determine the organization has a high risk of being attacked by “Organized Crime,” a medium risk of being attacked by “Hacktivists,” a high risk of being attacked by “Nation States/Competitor,” a high risk of being attacked by “Nation States/Disruption, Destruction,” and a high risk of being attacked by “Disgruntled Employees.”
Referring now to
As such,
Upon selection of multiple countries for the organization's headquarters and/or presence, the inherent risk assessment can select the highest rating for each threat actor 117a-e. For example, as illustrated in
As such, upon selection of both the “Switzerland” and “Norway” for the organization's presence (and no others), the inherent risk assessment can determine the organization has a threat level of “0” for “Organized Crime,” a threat level of “1” for “Hacktivists,” a threat level of “2” for “Nation States/Competitor,” a threat level of “1” for “Nation States/Disruption, Destruction,” and a threat level of “0” for “Disgruntled Employee.” Moreover, upon selection of each of “Switzerland,” “Norway,” and “Qatar” for the organization's presence (and no others), the inherent risk assessment can define the organization has a threat level of “1” for “Organized Crime,” a threat level of “1” for “Hacktivists,” a threat level of “2” for “Nation States/Competitor,” a threat level of “1” for “Nation States/Disruption, Destruction,” and a threat level of “1” for “Disgruntled Employee.”
Therefore, to determine a cumulative risk rating for one or more threat actors 117a-e, a cumulative look-up table may be used. Referring now to
Accordingly, the scenarios can represent each possible combination of outcomes from questions relating to the organization's industries as well as their headquarters and presence in countries. Along these lines, the scenarios can be utilized to determine the preliminary risk rating 126 for each of the threat actors 117a-e (illustrated in
Referring back to
To determine the likelihood of the threat actors 117a-e employing the threat vectors 110a-c, a threat look-up table can be utilized. Referring now to
As such, the likelihood of the threat actors 117a-e utilizing the threat vector “DoS/DDoS” can provide a discount to the risk rating 118a-e (illustrated in
Upon acquiring the likelihood of the threat actors 117a-e employing a particular one of the threat vectors 110a-c, the inherent risk assessment 114 (illustrated in
For example, as illustrated, the threat actor 117a—“Organized Crime”—can have cumulative risk rating 118a—“Very High”—and level of likelihood 128a—“3”—for utilizing the threat vector 110a-4—“DoS/DDoS,” the threat actor 117b—“Hacktivists”—can have cumulative risk rating 118b—“Medium”—and level of likelihood 128b—“1”—for utilizing the threat vector 110a-4—“DoS/DDoS,” the threat actor 117c—“Nation States/Competitor”—can have cumulative risk rating of 118c—“High”—and level of likelihood 128c—“3”—for utilizing the threat vector 110a-4—“DoS/DDoS,” the threat actor 117c—“Nation States/Disruption, Destruction”—can have cumulative risk rating of 118d—“Medium”—and level of likelihood 128d—“1”—for utilizing the threat vector 110a-4—“DoS/DDoS,” and the threat actor 117e—“Disgruntled Employee”—can have cumulative risk rating 118e—“Medium” —and a level of likelihood 128e—“1”—for utilizing the threat vector 110a-4—“DoS/DDoS.”
As such, the cumulative risk rating 118a for the threat actor 117a—“Organized Crime”—can decrease 2 levels, and the ultimate risk rating 130a for the threat actor 117a—“Organized Crime”—can be “Medium.” The cumulative risk rating 118b for the threat actor 117b—“Hacktivists”—can remain the same, and the ultimate risk rating 130b for the threat actor 117b—“Hacktivists”—can be “Medium.” The cumulative risk rating 118b for the threat actor 117c—“Nation States/Competitor”—can decrease 2 levels, and the ultimate risk rating 130c for the threat actor 117c—“Nation States/Competitor” can be “Low.” The cumulative risk rating 118d of the threat actor 117d—“Nation States/Disruption, Destruction”—can remain the same, and the ultimate risk rating 130d for the threat actor 117d—“Nation States/Disruption, Destruction”—can be “Medium.” The cumulative risk rating 118e of the threat actor 117e—“Disgruntled Employee”—can decrease 2 levels, and the ultimate risk rating 130d for the threat actor 117e—“Disgruntled Employee”—can be “Medium.”
Therefore, upon determining the ultimate risk ratings 130a-e for the threat actors 117a-e, a risk rating 112a-4 for the threat vector 110a-4 can be determined. The risk rating 112a-4 for the threat vector 110a-4 can be the worst of the ultimate risk ratings 130a-e. For example, as illustrated and stated previously, the ultimate risk rating 130a for the threat vector 117a—“Organized Crime”—to use the threat vector 110a-4—“DoS/DDoS”—can be “Medium,” the ultimate risk rating 130b for the threat vector 117a—“Hacktivists”—to use the threat vector 110a-4—“DoS/DDoS”—can be “Medium,” the ultimate risk rating 130c for the threat vector 117c—“Nation States/Competitor”—to use the threat vector 110a-4—“DoS/DDoS”—can be “Low,” the ultimate risk rating 130d for the threat actor 117d—“Nation States/Disruption, Destruction”—to use the threat vector 110a-4—“DoS/DDoS”—can be “Medium,” and the ultimate risk rating 130e for the threat actor 117e—“Disgruntled Employee”—to use the threat vector 110a-4—“DoS/DDoS”—can be “Medium.” As such, the risk rating 112a-4 for the threat vector 110a-4—“DoS/DDoS” can be “Medium.”
Referring back to
To determine if the risk rating for one of the treat types 110a-c should be modified based on the legal regime in the organization's presence countries, the inherent risk assessment 114 can utilize a separate look-up table than those previously discussed. Referring now to
Consequently, upon the organization being present in multiple countries having different legal regime ratings, the inherent risk assessment can utilize the legal regime rating having the highest level (i.e., the weakest legal regime). For example, as illustrated, although the organization is present in “Germany” and “United States,” the inherent risk assessment may only utilize the legal regime rating for the “United States.” In doing so, the inherent risk process can increase the risk rating of “the threat vector 110b-2—Use of Insider Employee—from “High” to “Very High.”
Referring back to
Referring now to
As such, the look-up tables of
Referring back to
Referring now to
Referring now to
Referring back to
As to evaluation category 108e (not illustrated), a user can assess one or more physical locations of the organization to determine if the location meets one or more predetermined capabilities relating to deterring one or more physical acts that may result in a cyber-attack. The assessment can be performed manually by the user, and can be inputted into the computer. The results of the assessment can provide a strength rating of the evaluation category 108e. As such, the results can be determined by the user and inputted into the computer, or can determined by the computer. Along these lines, the results can be determined by the computer using a look-up table.
Referring now to
As such, the data structure 156 can comprise a first level node 157 that corresponds to an organizational safeguard (i.e., Governance and Oversight). The root node 157 can depend on one or more second level nodes 158-160. The second level nodes 158-160 can correspond to one or more internal processes of the organization to deter a cyber-attack. As illustrated, the second level nodes 158-160 can each be internal nodes and depend on a plurality of third level nodes. Alternatively, although not illustrated, the second level nodes 158-160 can be external nodes and each correspond to a question of one or more categories 121a-f (depicted in
As such, the third level nodes 161-168 can be internal nodes or external nodes. The third level, external nodes 161, 162, 164-168 can each correspond to a question of the same category of upper echelon nodes. For example, as illustrated, node 161 corresponds to question 13, node 162 corresponds to question 13a, node 164 corresponds to question 10, node 165 corresponds to question 11, node 166 corresponds to question 12, node 167 corresponds to question 4, and node 168 corresponds to question 6.
Moreover, the third level, internal node 163 can depend on a plurality of fourth level nodes 169-173. The fourth level nodes 169-173 can each be internal nodes or external nodes. The fourth level, external nodes 169-173 can each correspond to a question. For example, as illustrated, node 169 corresponds to question 13b, node 170 corresponds to question 13c, node 171 corresponds to 13e, and node 172 corresponds to question 13d. The fourth level, internal node 173 can depend on a plurality of fifth level, external nodes 174, 175, each of which can correspond to a question of the same category as upper echelon nodes. For example, as illustrated, node 174 corresponds to question 13f, and node 175 corresponds to question 13g.
Along these lines, the questions corresponding to the nodes can be presented to a user in different categories 121a-f (depicted in
To determine a strength factor of the organizational safeguard (i.e., Governance and Oversight), external nodes utilize the look-up tables of the questions associated therewith, as discussed in detail above. Moreover, internal nodes each utilize a look-up table comprising each possible outcome or combination of preliminary strength ratings for the question(s) corresponding to external, child nodes and a cumulative strength rating for each possible combination of preliminary strength ratings. The cumulative strength rating can comprise a plurality of levels that are the same or different than the levels of the preliminary strength ratings relating to at least one of the questions.
As such, still referring to
Upon performing an inherent risk assessment 114 (illustrated in
Along these lines, the cyber readiness profile 105 can compare the strength ratings 109a-e of the evaluation categories 108a-e to the risk ratings 113a-c of the threat types 110a-c. In doing so, the cyber readiness profile 105 can present one or more relationships 176a-e between one or more organizational safeguards 108a-e and one or more threat origins 111a-c. The relationships 176a-e between the organizational safeguards 108a-e and the threat origins 111a-c can depend on one or more attack types of the threat origins 111a-c for employing a cyber-attack, and on one or more defense mechanisms of the organizational safeguards 108a-e in defending against the attack type. As such, for there to be a relationship between one or more threat origins 111a-c and one or more one or more organizational safeguards 108a-e, the defense mechanism of the organizational safeguards 108a-e may have to be configured to defend against the attack employed by the threat origins 111a-c.
According to an embodiment, the cyber readiness profile 105 can present a relationship 176a-c between one of the evaluation categories 108a-c and one of the threat origins 111a-c. For instance, the threat origin 111a—“Attack from Outside”—can comprise an attack through the internet (such as hacking), and the organizational safeguard 108a—“Cybersecurity Framework”—can comprise one or more defense mechanisms to defend against such a cyber-attack. Therefore, the cyber readiness profile 105 can present the relationship 176a between the organizational safeguards 108a—“Cybersecurity Framework”—and the threat origin 111a—“Attack from Outside.” Moreover, the threat origin 111b—“Use Insiders”—can comprise an attack involving legitimate access given to an individual inside, or related to, the organization, and the organizational safeguard 108b—“Insider Threat Management”—can comprise one or more defense mechanisms to defend against access given to such an individual. Accordingly, the cyber readiness profile 105 can present the relationship 176b between the organizational safeguard 108b—“Insider Threat Management”—and the threat origin 111b—“Use Insiders.” Furthermore, the threat origin 111c—“Use of Physical Access”—can employ an attack through an individual outside of an organization who acquires unauthorized access to an organizational resource by gaining access to the organization's physical facilities or property, and the organizational safeguard 108c—“Physical Security”—can comprises one or more defense mechanisms to ensure protection against such an individual. Therefore, the cyber readiness profile 105 can present the relationship 176c between the organizational safeguards 108c—“Physical Security”—and the threat origin 111c—“Use of Physical Access.”
According to another embodiment, the cyber readiness profile 105 can present a relationship 176d-e between one of the evaluation safeguards 108d-e and a plurality of the threat origins 111a-c. To do so, the evaluation safeguards 108d-e can have generic capabilities and, thus, correspond to a plurality of threat origins 111a-c. Specifically, the evaluation safeguard 108d—“Governance and Oversight”—can be directed to assessing corporate culture for protecting against a likelihood of an occurrence of an attack by the threat origins 111a-c. Moreover, the evaluation category 108e—“Incident Response & DR Capabilities” can be directed to assessing readiness of an organization in responding to an attack by the threat origins 111a-c. As such, the cyber readiness profile 105 can present a relationship 176d between the organizational safeguards 108d—“Governance and Oversight”—and the threat origin 111a-c—“Attack from Outside,” “Use of Insiders,” and “Use of Physical Access.” Along these lines, the cyber readiness profile 105 can present a relationship 176e between the organizational safeguards 108e—“Incident Response & DR Capabilities”—and the threat origin 111a-c—“Attack from Outside,” “Use of Insiders,” and “Use of Physical Access.”
By doing so, the relationships 176a-e can illustrate a cyber readiness of each of the evaluation categories 108a-e against each of the threat origins 111a-c. To illustrate the extent of cyber readiness of the organization, the relationships 176a-e can comprise a plurality of degrees. The degrees can be presented to a user in the form of text and/or color. According to an embodiment, the degrees can be presented to a user as “Severe Gap,” “Possible Concern,” “OK,” and “N/A.” According to another embodiment, the relationships 176a-e can be presented to a user as green, yellow, red, or gray. The color green can represent “OK,” the color yellow can represent “Possible Concern,” the color red can represent “Severe Gap,” and the color gray can represent “N/A.”
Moreover, to determine the relationships 176a-e between the organizational safeguards 108a-e and the threat origins 111a-c, one or more look-up tables can be utilized. Referring now to
Referring now to
Referring now to
Referring now to
The memory component 190 may also store and send all or some of the information sent to the processor 189 in a plurality of modules 192, 193. As such, the module 192, 193 may each contain a look-up table, as discussed above. This can improve the logic and processing speed of the server 187 in analyzing cyber readiness of an organization, as well as reduce the required computing power by the server 187 to do so.
Communication device 188 may include an input device including any mechanism or combination of mechanisms that permit an operator to input information to communication device 188, such as a keyboard, a mouse, a touch sensitive display device, a microphone, a pen-based pointing device, a biometric input device, and/or a voice recognition device. Communication device 178 may include an output device that can include any mechanism or combination of mechanisms that outputs information to the operator, including a display, a printer, a speaker, etc.
From the foregoing description, one skilled in the art can readily ascertain the essential characteristics of the invention, and without departing from the spirit and scope thereof, can make changes and modifications of the invention to adapt it to various conditions and to utilize the present invention to its fullest extent. The specific embodiments described here are to be construed as merely illustrative, and not limiting of the scope of the invention in any way whatsoever. Moreover, features described in connection with one embodiment of the invention may be used in conjunction with other embodiments, even if not explicitly stated above.
Claims
1. A method for evaluating cyber readiness of an organization, the method comprising:
- presenting, by a computer, a plurality of objective questions to a user, wherein each of the objective questions has one or more predefined answers to be selected by said user;
- receiving, by said computer, answers to said plurality of objective questions from said user;
- determining based on said answers, by said computer, a risk rating for a threat origin of a cyber-attack;
- determining based on said answers, by said computer, a strength rating for an organizational safeguard against said threat origin;
- comparing, by said computer, said risk rating of said threat origin to said strength rating of said organizational safeguard;
- determining based on said comparison, by said computer, a cyber readiness rating of said organizational safeguard from said cyber-attack by said threat origin; and
- presenting, by said computer, the cyber readiness rating of said organizational safeguard.
2. The method of claim 1, wherein presenting the cyber readiness rating of said organization comprises:
- presenting, by said computer, said threat origin and said risk rating of said threat origin; and
- presenting, by said computer, said organizational safeguard and said strength rating of said organization safeguard.
3. The method of claim 2, additionally comprising:
- identifying, by said computer, a relationship between said risk rating of said threat origin and said strength rating of said organizational safeguard.
4. The method of claim 3, wherein said cyber readiness rating of said organizational safeguard from said cyber-attack by said threat origin comprises one of a plurality of levels, the levels being severe gap, possible concern, and okay.
5. The method of claim 1, wherein said risk rating of said threat origin is determined independent from said strength rating of said organizational safeguard.
6. The method of claim 1, wherein determining said risk rating of said threat origin comprises:
- determining based on said answers, by said computer, a plurality of threat vectors, wherein the threat vectors correspond to the threat origin; and
- determining based on said answers, by said computer, a risk rating for each of said threat vectors.
7. The method of claim 6, wherein determining said risk rating of said threat origin further comprises:
- determining based on said risk rating for each of said threat vectors, by said computer, a cumulative risk rating of said threat origin.
8. The method of claim 1, additionally comprising:
- correlating, by said computer, one or more of said objective questions to a plurality of elements of said organizational safeguard, wherein said elements collectively determine said strength rating of said organizational safeguard.
9. The method of claim 8, wherein determining of said strength rating of said organizational safeguard comprises:
- determining, by said computer, a strength rating for a first element of said organizational safeguard based on at least one of said answers; and
- determining, by said computer, a strength rating for a second element of said organizational safeguard based on at least one of said answers.
10. The method of claim 9, wherein determining of said strength rating of said first element comprises:
- determining, by said computer, a strength rating for a third element of said organizational safeguard based on said strength rating of said first element and said strength rating of said second element.
11. The method of claim 10, wherein determining said strength rating of said organizational safeguard additionally comprises:
- determining, by said computer, a strength rating for a fourth element of said organizational safeguard based on at least one of said answers; and
- determining, by said computer, a strength rating for a fifth element of said organizational safeguard based on said strength rating of said third element and said strength rating of said fourth element.
12. The method of claim 11, wherein said strength rating for said first element, said strength rating for said second element, said strength rating for said third element, said strength rating for said fourth element, and said strength rating for said fifth element are each determined using a look-up table.
13. The method of claim 12, wherein the look-up table provides an outcome for each possible combination of answers to said objective question.
14. The method of claim 1, additionally comprising:
- determining based on said objective questions, by said computer, an inherent risk profile, wherein the inherent risk profile comprises a plurality of threat origins and a risk rating for each of the threat origins.
15. The method of claim 1, additionally comprising:
- determining based on said objective questions, by said computer, a preparedness profile, wherein said preparedness profile comprises a plurality of organizational safeguards and a strength rating for each of said organizational safeguards.
16. A system for evaluating cyber readiness of an organization, the system comprising:
- a memory storage device; and
- a processor in communication with said memory storage device and configured to: present a plurality of objective questions to a user, wherein each of the objective questions has one or more predefined answers to be selected by said user; receive answers to said plurality of objective questions from said user; determine based on said answers a risk rating for a threat origin of a cyber-attack; determine based on said answers a strength rating for an organizational safeguard against said threat origin; compare said risk rating of said threat origin to said strength rating of said organizational safeguard; determine based on said comparison the cyber readiness rating of said organizational safeguard from said cyber-attack by said threat origin; and present the cyber readiness rating of said organizational safeguard.
17. The system of claim 16, wherein presenting the cyber readiness rating of said organization comprises:
- presenting said threat origin and said risk rating of said threat origin; and
- presenting said organizational safeguard and said strength rating of said organization safeguard.
18. The system of claim 17, additionally comprising:
- identifying a relationship between said risk rating of said threat origin and said strength rating of said organizational safeguard.
19. The system of claim 18, wherein said cyber readiness rating of said organizational safeguard from said cyber-attack by said threat origin comprises one of a plurality of levels, the levels being severe gap, possible concern, and okay.
20. The system of claim 16, wherein determining said risk rating of said threat origin comprises:
- determining based on said answers a plurality of threat vectors, wherein the threat vectors correspond to the threat origin; and
- determining based on said answers a risk rating for each of said threat vectors.
21. The system of claim 20, wherein determining said risk rating of said threat origin to cyber-attack further comprises:
- determining based on said risk rating for each of said threat vectors a cumulative risk rating for said threat origin.
22. The system of claim 16, wherein the processor is additionally configured to:
- correlate one or more of said objective questions to a plurality of elements of said organizational safeguard, wherein said elements collectively determine said strength rating of said organizational safeguard.
23. The system of claim 22, wherein determining of said strength rating of said organizational safeguard comprises:
- determining a strength rating for a first element of said organizational safeguard based on at least one of said answers; and
- determining a strength rating for a second element of said organizational safeguard based on at least one of said answers.
24. The system of claim 23, wherein determining of said strength rating of said first element comprises:
- determining a strength rating for a third element of said organizational safeguard based on said strength rating of said first element and said strength rating of said second element.
25. The system of claim 24, wherein determining of said strength rating of said organizational safeguard additionally comprises:
- determining a strength rating for a fourth element of said organizational safeguard based on at least one of said answers; and
- determining a strength rating for a fifth element of said organizational safeguard based on said strength rating of said third element and said strength rating of said fourth element.
26. The system of claim 25, said strength rating for said first element, said strength rating for said second element, said strength rating for said third element, said strength rating for said fourth element, and said strength rating for said fifth element are each determined using a look-up table.
27. The system of claim 26, wherein the look-up table provides an outcome for each possible combination of answers to said objective questions.
28. The system of claim 16, wherein the processor is additionally configured to:
- determine based on said objective questions an inherent risk profile, wherein the inherent risk profile comprises a plurality of threat origins and a risk rating for each of the threat origins.
29. The system of claim 16, wherein the processor is additionally configured to:
- determine based on said objective questions a preparedness profile, wherein said preparedness profile comprises a plurality of organizational safeguards and a strength rating for each of said organizational safeguards.
30. A non-transitory computer-readable medium tangibly storing computer program instructions which when executed by a processor, causes the processor to:
- present a plurality of objective questions to a user, wherein each of the objective questions has one or more pre-defined answers to be selected by said user;
- receive answers to said plurality of objective questions from said user;
- determine based on said answers a risk rating for a threat origin of a cyber-attack;
- determine based on said answers a strength rating for an organizational safeguard against said threat origin;
- compare the risk rating of said threat origin to said strength rating of said organizational safeguard;
- determine based on said comparison a cyber readiness rating of said organizational safeguard from said cyber-attack by said threat origin; and
- present the cyber readiness rating of the organizational safeguard.
Type: Application
Filed: Feb 13, 2018
Publication Date: Dec 27, 2018
Inventors: Jens Alkemper (Bellingham, MA), Antonio Faria (Johnston, RI)
Application Number: 15/895,049