Practical threat analysis

• US 20070016955A1
• Filed: 08/02/2005
• Published: 01/18/2007
• Est. Priority Date: 09/24/2004
• Status: Active Grant

• Current Assignee: Michael Levy, Ygor Goldberg
• Original Assignee: Michael Levy, Ygor Goldberg
• Inventors: Levy, Michael, Goldberg, Ygor
• Granted Patent: US 8,312,549 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G01S 7/36 Means for anti-jamming , e.g. ECCM, i.e. electronic counter-counter measures
• CPC Class Codes: G06Q 40/08 Insurance

Abstract

The following subject matter provides a computer-implemented method and system for calculation of cost-effectiveness of countermeasures in mitigating the threats on a system through calculating risk of threats. The calculation is run on a model of assets, threats, vulnerabilities and countermeasures and enables the production of easy to understand reports and action item lists showing the financial value of threat risks and countermeasures priorities and cost-effectiveness.

Claims

1. A method for performing risk management of a given system having known vulnerabilities and weaknesses, based on system assets values, the risks of possible threats, potential asset damages in relation to each threat, possible countermeasure and relative threat mitigation in relation to a single countermeasure or to a set of countermeasures, wherein said method comprises the following steps:

valuating relative threat monetary risk, wherein each threat is correlated to the possible damage to system assets based on possible threat scenarios in accordance with relevant vulnerabilities and weaknesses of the system and valuation of relative threat damage;

calculating cost effectiveness for each countermeasure or each set of countermeasures, taking into account the relative relevant threats damages and estimating the contribution of each countermeasure or set of countermeasures to reduce said damages.

2. The method of claim 1 further comprising the step of calculating the current overall countermeasure mitigation level for each countermeasure, wherein the current overall countermeasure mitigation (CurCM) of a specific countermeasure is the percentage of contribution of a specific countermeasure to the reduction of the current total system risk.

3. The method of claim 2 wherein the current cost effectiveness (CurCCE) of a specific countermeasure is calculated by dividing the overall countermeasure mitigation by the implementation cost (IC) of the countermeasure.

4. The method of claim 1 wherein the valuating relative threat risk is based on calculating the following:

the mitigation level for each threat, calculating the total value of and relative value of system assets, calculating the relative damage level of each threat, calculating the risk level of each threat, calculating the risk for each asset and calculating the total system risk.

5. The method of claim 1 further comprising the step of calculating an optimized risk reduction plan, wherein said optimized risk reduction plan is an optimized subset of the countermeasures that if implemented will reduce the total current risk level below a given target risk level within the limits of a given target budget (TarB).

6. The method of claim 5 wherein the optimization is based on optimizing cost effectiveness.

7. The method of claim 5 wherein the optimization is based on optimizing the risk.

8. The method of claim 5 wherein the optimization is based on optimizing the cost.

9. The method of claim 5 wherein the optimization is based on optimizing countermeasure execution complexity.

10. The method of claim 5 wherein the optimization includes an iterative process for testing various combinations of counter measurements.

11. The method of claim 10 wherein the iterative process is performed manually enabling the user to change combinations according the received mitigation results.

12. The method of claim 10 wherein the iterative process is automatic wherein the combinations are changed in accordance with calculated mitigation results.