Security risk analysis system and method

• US 20060191012A1
• Filed: 02/22/2005
• Published: 08/24/2006
• Est. Priority Date: 02/22/2005
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Davies, John, Banzhof, Carl E.
• Granted Patent: US 7,278,163 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 10/06311 Scheduling, planning or task assignment for a person or group
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system and method for assessing risks to computer network is provided. The system includes a first module assesses a human factor related to a risk to the computer network. A second module assesses a remediation to the computer network, and a third module is operable to assess a life cycle of an asset on the computer network. A fourth module assesses a type of the asset used by the computer network.

Claims

1. A method for assessing a risk to a computer network, comprising:

identifying a human factor related to a risk to the computer network;

determining a risk level using the human factor; and

remediating at least a portion of the computer network based on the risk level.

2. The method of claim 1, wherein determining the risk level is further defined calculating a risk quotient based on a potential vulnerability to at least the portion of the computer network.

3. The method of claim 1, wherein the human factor is further defined as demographic factor.

4. The method of claim 3, wherein the demographic factor is selected from a group of demographic factors consisting of gender, age, marital status, nationality.

5. The method of claim 1, wherein the human factor is further defined as an employment status.

6. The method of claim 5, wherein the employment status is selected from a group consisting of full-time employees, part-time employees, contractors.

7. The method of claim 1, wherein the human factor is further defined as geographic location of the user of the computer network.

8. The method of claim 1, wherein the human factor is further defined as a criminal record of the user of the computer network.

9. The method of claim 1, wherein the human factor is further defined as a credit record of the user of the computer network.

10. The method of claim 1, wherein the human factor is further defined as a seniority of the user of the computer network.

11. The method of claim 1, wherein the human factor is further defined as job information selected from a group consisting of a job responsibility, a job title, and a computer network security access level.

12. The method of claim 1, further comprising:

prioritizing the remediation;

scheduling the remediation; and

scoring a remediation option.

13. The method of claim 1, further comprising automatically implementing the remediation.

14. The method of claim 1, wherein the risk level is determined using only the human factor.

15. The method of claim 1, wherein the risk level is determined using the human factor in combination with one of an event factor and a type of access factor.

16. The method of claim 1, wherein the human factor is selected from a group of human factors consisting of an emotional disposition factor, a geopolitical factor, a demographic factor, a job positions factor, and a behavior factor.

17. A method for assessing a risk to a computer network, comprising:

identifying a remediation signature to remediate vulnerabilities on at least a portion of the computer network;

determining a remediation signature risk related to the remediation signature to remediate at least a portion of the computer network; and

deciding whether to remediate the portion of the computer network using the remediation signature based on the remediation signature risk.

18. The method of claim 17, further comprising:

identifying risks to a plurality of systems of the computer network;

identifying remediation signatures to remediate the plurality of systems of the computer network;

determining the remediation signature risk for each of the remediation signatures; and

deciding whether to remediate the systems of the computer network using the remediation signatures based on the remediation signature risk for each of the remediation signatures.

19. The method of claim 17, wherein determining the remediation signature risk includes identifying known problems with the remediation signature.

20. The method of claim 19, further comprising quantifying the remediation signature risk identified.

21. The method of claim 17, wherein determining the remediation signature risk includes determining whether the portion of the computer network to be remediated is compatible with software installed by the remediation signature.

22. The method of claim 17, wherein determining the remediation signature risk includes identifying warranty information related warranty of the portion of the computer network to be remediated and whether the software installed by the remediation signature effects the warranty.

23. The method of claim 17, wherein the remediation signature is further defined as a patch and wherein the remediation signature risk is further defined as a patch risk.

24. Software capable of assessing a risk to a computer network, comprising:

a first software module operable to assess a human factor related to a risk to the computer network;

a second software module operable to assess a patch to the computer network;

a third software module operable to assess a life cycle of an asset on the computer network; and

a fourth software module operable to assess a type of the asset used by the computer network.

25. The software of claim 24, further comprising a fifth software module to assess a remediation option based on the assessment of risk.

26. The software of claim 25, wherein the fifth software module which assesses the remediation option comprises:

a first component to score a remediation option;

a second component to prioritize a remediation activity; and

a third component to schedule a remediation activity.

27. The software of claim 26, further comprising an installation module to automatically implements the remediation option based on the assessment of risk and the assessment of the remediation option.

28. A system for protecting a computer network from vulnerabilities, the system comprising:

an analysis module operable to determine whether a specified device resides on the computer network;

a risk assessment module to evaluate at least one risk factor used to assess risk to the computer network; and

a remediation module to remediate the specified device on the computer network.

29. The system of claim 28, wherein the risk assessment module includes a human factor component operable to assess a human factor related risk to the computer network.

30. The system of claim 29, wherein the human factors is selected from a group of human factors consisting of an emotional disposition factor, a geopolitical factor, a demographic factor, a job positions factor, and a behavior factor.

31. The system of claim 28, risk factors is selected from a group consisting of one of an event factor and a type of access factor.

32. The system of claim 28, wherein the risk assessment module includes a patch component operable to assess a patch related risk to the computer network.

33. The system of claim 28, wherein the risk assessment module includes a life cycle component operable to assess a life cycle related risk to the computer network.

34. The system of claim 28, wherein the risk assessment module includes an asset type component operable to assess an asset type related risk to the computer network.

35. The system of claim 28, wherein the risk assessment module further includes a scheduling component to schedule remediation of the specified device on the computer network.

36. The system of claim 28, wherein the risk assessment module further includes a prioritization component operable to prioritize remediation of one or more devices of the computer network.

37. The system of claim 29, wherein the human factors is further defined as an emotional disposition factor.

38. The system of claim 29, wherein the human factors is further defined as a geopolitical factor.

39. The system of claim 29, wherein the human factors is further defined as a demographic factor.

40. The system of claim 29, wherein the human factors is further defined a job positions factor.

41. The system of claim 29, wherein the human factors is further defined as a behavior factor.

42. The system of claim 28, wherein the risk factor evaluated by the risk assessment module includes whether an identified vulnerability has an associated identified threat that exploits the identified vulnerability.

43. The system of claim 28, wherein the risk assessment module is operable for rating the at least one risk factor to compute a risk level to the specified device on the computer network.

44. The system of claim 43, wherein the risk assessment module is operable to rate the risk level to the specified device based on a plurality of risk factors.

45. The system of claim 44, wherein the risk levels are operably prioritized for remediation by the remediation module, the prioritization based on the risk level ratings of the specified device.