Method and a software system for end-to-end security assessment for security and CIP professionals

• US 20070143849A1
• Filed: 12/19/2005
• Published: 06/21/2007
• Est. Priority Date: 12/19/2005
• Status: Abandoned Application

• Current Assignee: White Cyber Knight Limited
• Original Assignee: White Cyber Knight Limited
• Inventors: Adar, Eyal
• Application Number:
  US11/305,196
• Publication Number:
  US 20070143849A1
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling

Abstract

A method and software system for Security and CIP Professionals (CIP) that addresses the shortcomings in today'"'"'s Critical Infrastructure Protection (CIP) methods, and offers a new security assessment methodology equipped to meet the present challenges of CIP, as well as future challenges. The method is based on an End-to-End Security Assessment (EESA) that provides a wide examination of system information flows. The method disclosed is for implementing end-to-end security assessment (EESA) for use by Security and CIP professionals for large, complex, critical infrastructure (LCCI) systems. The first step of the method is determining security policy and sensitivity levels of data. Further steps include identifying and analyzing critical business-derived information flows for the layers, security mechanisms, formats and communications protocols of the system; assessing each of said information flows for security gaps; determining the risk level of each of said information flows by applying a formula that takes into account the threat, its likelihood and its potential impact on the system; comparing the required defence levels to said security mechanisms, listing all gaps found according to a prioritization process that determines the urgency of closing each gap and creating a detailed list of the prioritized gaps; and offering specific countermeasures to close each of said gaps, wherein emphasis is put on optimizing said countermeasures.

Claims

1. A method for implementing end-to-end security assessment (EESA) for use by Security and CIP professionals for large, complex, critical infrastructure (LCCI) systems, comprsing:

determining security policy and sensitivity levels of data;

identifying and analyzing critical business-derived information flows for the layers, security mechanisms, formats and communications protocols of the system;

assessing each of said information flows for security gaps;

determining the risk level of each of said information flows by applying a formula that takes into account the threat, its likelihood and its potential impact on the system;

comparing the required defence levels to said security mechanisms, listing all gaps found according to a prioritization process that determines the urgency of closing each gap and creating a detailed list of the prioritized gaps; and

offering specific countermeasures to close each of said gaps, wherein emphasis is put on optimizing said countermeasures.

2. The method according to claim 1, wherein offering specific countermeasures further comprises addressing said risk levels as a whole, so that said countermeasures will ensure the adequacy of the entire system'"'"'s level of security.

3. The method according to claim 2, further comprising creating a detailed implementation work plan is created, which includes the technical processes as well as the responsibilities, budget and timetable.

4. The method according to claim 3, further comprising analyzing the risks that remain after all of said counter-measures are carried out.

5. A software system according to the method of claim 1, comprising an automated tool for real-time end-to-end security assessment (EESA) for use by Security and CIPsecurity professionals for large, complex, critical infrastructure (LCCI) computer systems.

6. A software system according to the method of claim 5, adapted for use with personal computer systems.

7. A software system according to the method of claim 5, comprising an automated tool for real-time end-to-end security assessment (EESA) for use by Security and CIPsecurity professionals for large, complex, critical infrastructure (LCCI) systems, wherein the automated tool is primarily adapted for monitoring purposes.

8. A software system according to the method of claim 7, further comprising an agent for providing the monitoring.

9. A software system according to the method of claim 8, further comprising a separate agent for each component of the computer system.

10. A software system according to the method of claim 8, wherein each agent collects and sends sends information to a service provider for analysis.