Overall risk in a system

• US 20030046128A1
• Filed: 03/29/2002
• Published: 03/06/2003
• Est. Priority Date: 03/29/2001
• Status: Active Grant

• Current Assignee: Accenture Global Services Limited (Accenture PLC)
• Original Assignee: Accenture SPA (Accenture PLC)
• Inventors: Heinrich, Nicolas
• Granted Patent: US 6,895,383 B2
• Time in Patent Office: Days
• US Class Current: 705/7
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G06Q 40/08 Insurance

Abstract

A computer-implemented method and system for assessing the overall risk in at least part of an information technology system includes inputting into a risk assessment database a plurality of identified risks in a system; associating the risks to at least one severity band in a risk echelon; assigning a value to each risk; multiplying each risk value by a coefficient factor; and summing the factored risk values to determine the overall risk. The method preferably includes modifying the security implementation of the information technology system and determining the modified overall risk. The system preferably includes an automated vulnerability detection scanner to gather risk information, which is stored on a database and used in calculating the overall risk.

Claims

1. A computer-implemented method for assessing the overall risk in at least part of an information technology system comprising:

(a) inputting into a risk assessment database a plurality of risks identified in the information technology system by utilizing at least one computer having a risk analysis program;

(b) associating the plurality of risks to at least one severity band in a risk echelon and storing said association in a memory storage device;

(c) assigning a value to each of the plurality of risks;

(d) multiplying each risk value by a coefficient factor system;

(e) adding the factored risk values to determine the overall risk system by utilizing the risk analysis program; and

(f) outputting an indication of the overall risk in a humanly readable form.

2. The method according to claim 1 wherein the value assigned to each risk is the mean value of the band in which the risk is assigned.

3. The method according to claim 1 wherein the factor for each risk value is smaller for risks in bands of lower severity.

4. The method according to claim 3 wherein the factors are selected such that the overall risk value does not exceed the upper risk value of the highest severity band containing a risk.

5. A computer-implemented method for assessing the overall risk in at least part of an information technology system comprising:

(a) assigning individual risks to bands of varying severity in a risk echelon;

(b) determining the current overall risk value by calculating a mean risk value of the highest severity risk band containing a risk by utilizing at least one computer having a risk analysis program;

(c) for each additional risk in said highest severity risk band, adding a first percentage of the space between the current overall risk value and the upper limit of the highest severity band by utilizing the risk analysis program;

(d) for each existing risk in bands below the band of highest severity risk, adding a second percentage of the space between the current overall risk value and the upper limit of the highest severity band multiplied by a coefficient factor relative to the proportionate level of risks the respective bands by utilizing the risk analysis program; and

(e) outputting an indication of the current overall risk in a humanly readable form.

6. The method according to claim 5 wherein the first and second percentages of space are between 10 and 60 percent.

7. The method according to claim 5 wherein the first percentage of space is 50 percent.

8. The method according to claim 5 further comprising modifying the security implementation of the information technology system, and determining the modified overall risk.

9. The method according to claim 5 wherein the coefficient factor is the mean risk value of the band containing each existing risk divided by said mean risk value of the highest severity risk band.

10. A computer-implemented method for assessing the overall risk in at least part of an information technology system

(a) inputting into a memory storage device a plurality of risks identified in the information technology system by utilizing at least one computer having a risk analysis program;

(b) associating the risks to at least one severity band in a risk echelon;

(c) assigning the initial overall risk value to be the lower limit of the highest severity band containing a risk by utilizing the risk analysis program;

(d) adding to the initial overall risk value a value of one half of the difference between the upper limit of said highest severity band and the initial overall risk value to determine an intermediate overall risk value by utilizing the risk analysis program;

(e) for each additional risk in that same band, adding successively one-half of the difference between the upper limit of said highest severity band and the most recent intermediate overall risk value to calculate the new most recent intermediate overall risk value by utilizing the risk analysis program;

(f) for each additional risk in bands of lesser severity, adding in series one half of the difference between the upper limit of said highest severity band and the most recent intermediate overall risk value proportioned by a coefficient factor to calculate the new most recent intermediate overall risk value by utilizing the risk analysis program;

(g) taking the new most intermediate overall risk value determined for the last risk as the overall risk value for the system; and

(h) outputting an indication of the intermediate overall risk in a humanly readable form.

11. The method according to claim 10 wherein the coefficient factor is proportional to a selected risk value of the band containing the risk to which the factor is applied divided by a selected risk value of said highest severity band.

12. The method according to claim 11 wherein the selected risk value of the band containing the risk to which the factor is applied is the mean risk value of that band, and the selected risk value of said highest severity band is the mean risk value of said highest severity band.

13. The method according to claim 10 wherein the step of identifying the risks includes performing network penetrations tests by utilizing the risk analysis program.

14. A computer-implemented method for assessing the overall risk in at least part of an information technology system, the method comprising calculating the overall risk value, R, by utilizing at least one computer having a risk analysis program programmed according to the equation:

15. A computer-implemented method for assessing the overall risk in an information technology system comprising:

(a) storing in a memory device a plurality of risks in a system associated with a component, category or method by utilizing at least one computer having a risk analysis program;

(b) associated the risks associated with one of a component, category or method with at least one severity band in a risk echelon associated with said one of a component, category or method, and storing said associations in a memory storage device;

(c) assigning a numerical value to each risk;

(d) multiplying each risk value by a relative risk coefficient factor by utilizing the risk analysis program;

(e) adding the factored risk values associated with said one of a component, category or method to determine the overall risk in the system for the said one of a component, category or method by utilizing the risk analysis program; and

(f) outputting an indication of the overall risk for the said one of a component in a humanly readable form.

16. The method according to claim 15 further comprising multiplying each overall risk of a component by a participation factor of the component participation in the system, placing all of the factored overall risks of the components into a risk echelon, and calculating the overall risk of the system by utilizing the risk analysis program.

17. The method of claim 15 further comprising, for a plurality of methods, determining the coverage per category for said category by calculating the average of all of the coverages per category per method weighted with a coefficient factor that represents the importance of the method for the category, wherein the sum of the weighted overages per category per method are divided by the sum of the coefficient factors.

18. The method according to claim 17 further comprising, for a plurality of categories, determining the coverage of the system by calculating the average of all of the coverages per category weighted with an importance coefficient factor of the category, wherein the sum of the weighted coverages per category are divided by the sum of the importance coefficient factors.

19. The method according to claim 18 further comprising:

determining the total number overall risks per category at a certain severity band level in the covered part of the system;

dividing that number by the percentage of the system that is under coverage to estimate the total number of overall risks per category at that risk level in the entire system by utilizing the risk analysis program;

assigning a second value to each overall risk per category by utilizing the risk analysis program;

multiplying each second risk value by a second relative risk coefficient factor by utilizing the risk analysis program;

adding the factored second risk values to determine the overall risk for the system by utilizing the risk analysis program; and

outputting an indication of the overall risk for the system in a humanly readable form.

20. A system for conducting a risk assessment of a computer network system, the system comprising:

at least one risk assessment database for storing risk assessment information associated with the computer network system;

at least one internet scanner database for storing risk assessment information associated with the computer network system;

a processor for accessing and analyzing data from said at least one risk assessment database and at least one internet scanner database, and for determining an overall risk value associated with at least one component associated with the computer network system;

a user computer for inputting risk assessment information to and for receiving risk assessment information from said risk assessment database; and

an interface for displaying said overall risk value determined by said processor.

21. The system of claim 20 further comprising an automated vulnerability scanner tool in communication with said internet scanner database to populate said internet scanner database with risk assessment information.

22. The system of claim 20, wherein said interface displays visual representation of individual risk values of vulnerabilities in the computer network system based on relative contribution to overall risk.

23. The system of claim 20, wherein the risk assessment database includes information from at least one of a back office analysis, interviews with different actors of the computer network system and a physical walk through.

24. The system of claim 20, wherein the at least one component is a server associated with the computer network system.