System and method for monitoring and grading a cybersecurity framework

• US 10,171,510 B2
• Filed: 11/10/2017
• Issued: 01/01/2019
• Est. Priority Date: 12/14/2016
• Status: Active Grant

• Current Assignee: CyberSaint, Inc.
• Original Assignee: CyberSaint, Inc.
• Inventors: O'Reilly, Padraic
• Primary Examiner(s): Le, Chau
• Application Number:
  US15/809,466
• Publication Number:
  US 20180167414A1
• Time in Patent Office: 417 Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 3/08 Learning methods
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A cybersecurity system is provided that sums and scores one or more cybersecurity controls for different client computing systems that each have different attributes, needs, and interests. In addition, the cybersecurity system provides to each different client computing system auto-suggestions that suggest one or more ways in which the client computing system may improve the confidentiality, integrity, and availability of the information stored on the client computing system and/or improve the confidentiality, integrity, and availability of the underlying characteristics of the client computing system. In addition, the cybersecurity system verifies that the functioning of the client computing system has improved.

Claims

1. A cybersecurity system, comprising:

processing logic configured to;

receive, over a network and from a client system, control information associated with one or more cybersecurity controls, wherein the control information indicates a current state of the client system with respect to each cybersecurity control of the one or more cybersecurity controls;

transmit, over the network and to the client system, one or more query scripts based on at least a target state of the client system and the control information;

receive, over the network and from the client system, one or more responses to the one or more query scripts; and

transmit, over the network and to the client system, one or more suggestions for moving cybersecurity of the client system from the current state towards the target state, wherein the one or more suggestions are based on at least the one or more responses and the current state of the client system, and wherein the one or more suggestions include one or more updates to be made to the client system to improve the cybersecurity of the client system.

2. The cybersecurity system of claim 1, wherein the one or more suggestions are created using logic, wherein the logic includes one or more of artificial intelligence, machine learning, fuzzy logic, and neural networks.

3. The cybersecurity system of claim 1, wherein the one or more cybersecurity controls are based on one of an industry standard framework and a custom framework.

4. The cybersecurity system of claim 1, wherein moving the current state of the client system towards the target state of the client system is based on an initial score derived from the control information and a target score derived from target control information.

5. The cybersecurity system of claim 1, wherein the processing logic is further configured to generate one or more progress reports utilizing the control information, wherein the control information is timestamped.

6. The cybersecurity system of claim 1, wherein the processing logic is further configured to display, on a display, the control information in one or more graphical formats, wherein the one or more graphical formats includes one or more of a spider chart, a radar chart, a bar chart, and a table.

7. The cybersecurity system of claim 1, further comprising one or more defined user roles that include one or more of a super user, an administrator, a consultant, and an end user.

8. The cybersecurity system of claim 1, wherein the processing logic is further configured to identify, utilizing an audit trail, changes to one or more of a user name, a date, a time, a media access control (MAC) address, an Internet Protocol (IP) address, a location, a device type, and a biometric recognition.

9. The cybersecurity system of claim 1, wherein the control information indicates one of whether the client system is in compliance with a particular cybersecurity control, is not in compliance with the particular cybersecurity control, is in partial compliance with the particular cybersecurity control, and that the particular cybersecurity control is not applicable to the client system.

10. A cybersecurity system configured to:

receive, over a network and from a client system, control information associated with one or more cybersecurity controls, wherein the control information indicates a current state of the client system with respect to each cybersecurity control of the one or more cybersecurity controls;

transmit, over the network and to the client system, one or more query scripts based on at least a target state of the client system and the control information;

receive, over the network and from the client system, one or more responses to the one or more query scripts;

transmit, over the network and to the client system, one or more suggestions for moving cybersecurity of the client system from the current state towards the target state, wherein the one or more suggestions are based on at least the one or more responses and the current state of the client system;

determine if the client computing system has been updated according to the one or is more suggestions;

in response to determining that a particular cybersecurity control has been updated based on the one or more suggestions, provide, to the client system, a new compliance value for the particular cybersecurity control; and

in response to determining that the particular cybersecurity control has not been updated based on the one or more suggestions, provide, to the client system, an alert indicating that the particular cybersecurity control has not been updated.

11. The cybersecurity system of claim 10, wherein the one or more suggestions are created using logic, wherein the logic includes one or more of artificial intelligence, machine learning, fuzzy logic, and neural networks.

12. The cybersecurity system of claim 10, wherein the one or more cybersecurity controls are based on one of an industry standard framework and a custom framework.

13. The cybersecurity system of claim 10, wherein moving the current state of the client system towards the target state of the client system is based on an initial score derived from the control information and a target score derived from target control information.

14. The cybersecurity system of claim 10, wherein the processing logic is further configured to generate one or more progress reports utilizing the control information, wherein the control information is timestamped.

15. The cybersecurity system of claim 10, wherein the processing logic is further configured to display, on a display, the control information in one or more graphical formats, wherein the one or more graphical formats includes one or more of a spider chart, a radar chart, a bar chart, and a table.

16. The cybersecurity system of claim 10, further comprising one or more defined user roles that include one or more of a super user, an administrator, a consultant, and an end user.

17. The cybersecurity system of claim 10, wherein the processing logic is further configured to identify, utilizing an audit trail, changes to one or more of a user name, a date, a time, a media access control (MAC) address, an Internet Protocol (IP) address, a location, a device type, and a biometric recognition.

18. The cybersecurity system of claim 10, wherein the control information indicates one of whether the client system is in compliance with a particular cybersecurity control, is not in compliance with the particular cybersecurity control, is in partial compliance with the particular cybersecurity control, and that the particular cybersecurity control is not applicable to the client system.

19. A non-transitory computer-readable storage media storing:

one or more instructions that, when executed, cause at least one processing device to;

receive, over a network and from a client system, control information s associated with one or more cybersecurity controls, wherein the control information indicates a current state of the client system with respect to each cybersecurity control of the one or more cybersecurity controls;

transmit, over the network and to the client system, one or more query scripts based on at least a target state of the client system and the control information;

receive, over the network and from the client system, one or more responses to the one or more query scripts; and

transmit, over the network and to the client system, one or more suggestions for moving cybersecurity of the client system from the current state towards the target state, wherein the one or more suggestions are based on at least the one or more responses and the current state of the client system, and wherein the one or more suggestions include one or more updates to be made to the client system to improve the cybersecurity of the client system.

20. The non-transitory computer-readable storage media of claim 19, wherein the one or more suggestions are created using logic, wherein the logic includes one or more of artificial intelligence, machine learning, fuzzy logic, and neural networks.

21. The non-transitory computer-readable storage media of claim 19, wherein the one or more cybersecurity controls are based on one of an industry standard framework and a custom framework.

22. The non-transitory computer-readable storage media of claim 19, wherein moving the current state of the client system towards the target state of the client system is based on an initial score derived from the control information and a target score derived from target control information.

23. The non-transitory computer-readable media of claim 19, further storing:

one or more instructions that, when executed, cause the at least one processing device to;

generate one or more progress reports utilizing the control information,

wherein the control information is timestamped.

24. The non-transitory computer-readable media of claim 19, further storing:

one or more instructions that, when executed, cause the at least one processing device to;

display, on a display, the control information in one or more graphical formats, wherein the one or more graphical formats include one or more of a spider chart, a radar chart, a bar chart, and a table.

25. The non-transitory computer-readable media of claim 19, further storing:

one or more instructions that, when executed, cause the at least one processing device to;

identify, utilizing an audit trail, changes to one or more of a user name, a s date, a time, a a media access control (MAC) address, an Internet Protocol (IP) address, a location, a device type, and a biometric recognition.

26. The non-transitory computer-readable media of claim 19, wherein the control information indicates one of whether the client system is in compliance with a particular cybersecurity control, is not in compliance with the particular cybersecurity control, is in partial compliance with the particular cybersecurity control, and that the s particular cybersecurity control is not applicable the client system.

27. A non-transitory computer-readable media storing:

one or more instructions that, when executed, cause the at least one processing device to;

receive, over a network and from a client system, control information s associated with one or more cybersecurity controls, wherein the control information indicates a current state of the client system with respect to each cybersecurity control of the one or more cybersecurity controls;

transmit, over the network and to the client system, one or more query scripts based on at least a target state of the client system and the control information;

receive, over the network and from the client system, one or more responses to the one or more query scripts;

transmit, over the network and to the client system, one or more suggestions for moving cybersecurity of the client system from the current state towards the target state, wherein the one or more suggestions are based on at least the one or more responses and the current state of the client system;

determine if the client computing system has been updated according to the one or more suggestions;

in response to determining that a particular cybersecurity control has been updated based on the one or more suggestions, provide, to the client system, a new compliance value for the particular cybersecurity control; and

in response to determining that the particular cybersecurity control has not been updated based on the one or more suggestions, provide, to the client system, an alert indicating that the particular cybersecurity control has not been updated.

28. The non-transitory computer-readable storage media of claim 27, wherein the one or more suggestions are created using logic, wherein the logic includes one or more of artificial intelligence, machine learning, fuzzy logic, and neural networks.

29. The non-transitory computer-readable storage media of claim 27, wherein the one or more cybersecurity controls are based on one of an industry standard framework and a custom framework.

30. The non-transitory computer-readable storage media of claim 27, wherein moving the current state of the client system towards the target state of the client system is based on an initial score derived from the control information and a target score derived from target control information.

31. The non-transitory computer-readable media of claim 27, further storing:

one or more instructions that, when executed, cause the at least one processing device to;

generate one or more progress reports utilizing the control information, wherein the control information is timestamped.

32. The non-transitory computer-readable media of claim 27, further storing:

one or more instructions that, when executed, cause the at least one processing device to;

display, on a display, the control information in one or more graphical formats, wherein the one or more graphical formats include one or more of a spider chart, a radar chart, a bar chart, and a table.

33. The non-transitory computer-readable media of claim 27, further storing:

one or more instructions that, when executed, cause the at least one processing device to;

identify, utilizing an audit trail, changes to one or more of a user name, a date, a time, a a media access control (MAC) address, an Internet Protocol (IP) address, a location, a device type, and a biometric recognition.

34. The non-transitory computer-readable media of claim 27, wherein the control information indicates one of whether the client system is in compliance with a particular cybersecurity control, is not in compliance with the particular cybersecurity control, is in partial compliance with the particular cybersecurity s control, and that the particular cybersecurity control is not applicable the client system.

35. A method, comprising:

receiving, from a client system and at a cybersecurity system, control information associated with one or more cybersecurity controls, wherein the control information indicates a current state of the client system with respect to each cybersecurity control of s the one or more cybersecurity controls;

transmitting, over the network and to the client system, one or more query scripts based on at least a target state of the client system and the control information;

receiving, over the network and from the client system, one or more responses to the one or more query scripts; and

transmitting, over the network and to the client system, one or more suggestions for moving cybersecurity of the client system from the current state towards the target state, wherein the one or more suggestions are based on at least the one or more responses and the current state of the client system, and wherein the one or more suggestions include one or more updates to be made to the client system to improve the cybersecurity of the client system.

36. A cybersecurity system, comprising:

processing logic configured to;

receive, over a network and from a client system, control information associated with one or more cybersecurity controls, wherein the control information indicates a current state of the client system with respect to each cybersecurity control of the one or more cybersecurity controls;

transmit, over the network and to the client system, one or more query scripts based on at least a target state of the client system and the control information;

receive, over the network and from the client system, one or more responses to the one or more query scripts; and

transmit, over the network and to the client system, one or more suggestions for moving cybersecurity of the client system from the current state towards the target state, wherein the one or more suggestions are based on at least the one or more responses and is the current state of the client system, and wherein the one or more suggestions include one or more updates to be made to the client system to improve at least one of confidentiality, integrity, and availability associated with the client system.