OPERATIONAL RISK CONTROL APPARATUS AND METHOD FOR DATA PROCESSING

• US 20080195407A1
• Filed: 03/07/2008
• Published: 08/14/2008
• Est. Priority Date: 09/09/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Whyte, Barry Douglas, Hurley, Steven Michael
• Granted Patent: US 8,010,447 B2
• Time in Patent Office: Days
• US Class Current: 705/1.1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof

Abstract

An apparatus for controlling operational risk in a data processing system comprises a risk domain segmenter for segmenting the data processing system into a plurality of risk domains, a domain risk threshold selector for selecting a domain risk threshold for at least one of the plurality of risk domains, a system element monitor operable to query the data processing system for an indication of presence of system elements, a risk quantizer for evaluating a system element for element risk and for computing the potential contribution of the element risk to a domain risk total, a risk threshold comparator for comparing the domain risk total with the domain risk threshold, and a domain assignor operable to assign the system element to a risk domain in dependency upon an output of the risk threshold comparator.

Claims

1. An apparatus for controlling operational risk in a data processing system, comprising:

a risk domain segmenter for segmenting said data processing system into a plurality of risk domains;

a domain risk threshold selector for selecting a domain risk threshold for at least one of said plurality of risk domains;

a system element monitor operable to query said data processing system for an indication of presence of system elements;

a risk quantizer for evaluating a system element for element risk and for computing the potential contribution of said element risk to a domain risk total;

a risk threshold comparator for comparing said domain risk total with said domain risk threshold; and

a domain assignor operable to assign said system element to a risk domain in dependency upon an output of said risk threshold comparator.

2. The apparatus for controlling operational risk in a data processing system of claim 1, wherein said domain risk total is increased for a positive value of said potential contribution and decreased for a negative value of said potential contribution.

3. The apparatus for controlling operational risk in a data processing system of claim 1, wherein said risk threshold is operable as at least one of:

a budget value to be drawn from by a risk value drawer operating subtractively using one or more said element risk values; and

an upper limit to be approached by a risk value accumulator operating additively using one or more said element risk values.

4. The apparatus for controlling operational risk in a data processing system of claim 3, wherein said system element comprises at least one of an application, a host system, a data storage system, an I/O system and a data communication system.

5. The apparatus for controlling operational risk in a data processing system of claim 4, wherein said element risk value comprises at least one of a weighting factor for criticality of function and an element reliability factor.

6. The apparatus for controlling operational risk in a data processing system of claim 2, wherein said risk threshold is operable as at least one of:

a budget value to be drawn from by a risk value drawer operating subtractively using one or more said element risk values; and

an upper limit to be approached by a risk value accumulator operating additively using one or more said element risk values.

7. The apparatus for controlling operational risk in a data processing system of claim 6, wherein said system element comprises at least one of an application, a host system, a data storage system, an I/O system and a data communication system.

8. The apparatus for controlling operational risk in a data processing system of claim 7, wherein said element risk value incorporates at least one of a weighting factor for criticality of function and an element reliability factor.

9. A method for controlling operational risk in a data processing system comprising:

segmenting, by a risk domain segmenter, said data processing system into a plurality of risk domains;

selecting, by a domain risk threshold selector, a domain risk threshold for at least one of said plurality of risk domains;

querying, by a system element monitor, said data processing system for an indication of presence of system elements;

evaluating, by a risk quantizer, a system element for element risk and computing a potential contribution of said element risk to a domain risk total;

comparing, by a risk threshold comparator, said domain risk total with said domain risk threshold; and

assigning, by a domain assignor, said system element to a risk domain in dependency upon an output of said risk threshold comparator.

10. The method for controlling operational risk in a data processing system of claim 9, wherein a positive value of said potential contribution increases said domain risk total and a negative value of said potential contribution decreases said domain risk total.

11. The method for controlling operational risk in a data processing system of claim 9 wherein said risk threshold is operable as at least one of:

a budget value to be drawn from by a risk value drawer operating subtractively using one or more said element risk values; and

an upper limit to be approached by a risk value accumulator operating additively using one or more said element risk values.

12. The method for controlling operational risk in a data processing system of claim 10, wherein said risk threshold is operable as at least one of:

a budget value to be drawn from by a risk value drawer operating subtractively using one or more values of said element risk; and

an upper limit to be approached by a risk value accumulator operating additively using one or more values of said element risk.

13. A computer-program product for controlling operational risk in a data processing system, comprising:

a computer-readable medium;

means, provided on the computer-readable medium, for segmenting said data processing system into a plurality of risk domains;

means, provided on the computer-readable medium, for selecting a domain risk threshold for at least one of said plurality of risk domains;

means, provided on the computer-readable medium, for querying said data processing system for an indication of presence of system elements;

means, provided on the computer-readable medium, for evaluating a system element for element risk and computing the potential contribution of said element risk to a domain risk total;

means, provided on the computer-readable medium, for comparing said domain risk total with said domain risk threshold; and

means, provided on the computer-readable medium, for assigning said system element to a risk domain in dependency upon an output of said risk threshold comparator.

14. The computer-program product for controlling operational risk in a data processing system of claim 13, further comprising means, provided on the computer-readable medium, for increasing the domain risk total for a positive value of the potential contribution and decreasing the domain risk total for a negative value of the potential contribution.

15. The computer-program product for controlling operational risk in a data processing system of claim 14, wherein said risk threshold corresponds to at least one of a budget value to be drawn from by a risk value drawer operating subtractively using one or more said element risk values and an upper limit to be approached by a risk value accumulator operating additively using one or more values of said element risk.

16. A computer implemented method of deploying a service comprising steps of deploying computer program code operable to, when deployed into a computer infrastructure and executed thereon, cause said computer system to perform steps comprising:

segmenting, by a risk domain segmenter, said data processing system into a plurality of risk domains;

selecting, by a domain risk threshold selector, a domain risk threshold for at least one of said plurality of risk domains;

querying, by a system element monitor, said data processing system for an indication of presence of system elements;

evaluating, by a risk quantizer, a system element for element risk and computing a potential contribution of said element risk to a domain risk total;

comparing, by a risk threshold comparator, said domain risk total with said domain risk threshold; and

assigning, by a domain assignor, said system element to a risk domain in dependency upon an output of said risk threshold comparator.

17. The computer implemented method of claim 16, wherein a positive value of said potential contribution increases said domain risk total and a negative value of said potential contribution decreases said domain risk total.

18. The computer implemented method of claim 17, wherein said risk threshold is operable as at least one of:

a budget value to be drawn from by a risk value drawer operating subtractively using one or more said element risk values; and

an upper limit to be approached by a risk value accumulator operating additively using one or more said element risk values.