SECURE INTEGRATED CYBERSPACE SECURITY AND SITUATIONAL AWARENESS SYSTEM

• US 20130086685A1
• Filed: 09/29/2011
• Published: 04/04/2013
• Est. Priority Date: 09/29/2011
• Status: Abandoned Application

• Current Assignee: Unisys Corporation
• Original Assignee: Unisys Corporation
• Inventors: Haynes, Stephen Ricky
• Application Number:
  US13/248,114
• Publication Number:
  US 20130086685A1
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

An integrated cube security system for an organization, such as a governmental or private organization, is disclosed, as well as a method of monitoring security for such an organization against cyberspace vulnerabilities. One such method includes receiving a definition of physical and logical locations of data managed by the organization, and receiving a definition of one or more business rules representing detected circumstances under which the data may be compromised. The method also includes monitoring the data based on the business rules and definition of the physical and logical locations of data to detect a cyberspace or electronic data vulnerability. The method includes generating one or more reports based on monitoring the data and relating at least in part to access of the data, and communicating, via a secure communications module, the one or more reports to an individual included within a community of interest.

Claims

1. A method of securing an organization against cyberspace vulnerabilities, the method comprising:

receiving a definition of physical and logical locations of data managed by the organization;

receiving a definition of one or more business rules representing detected circumstances under which the data may be compromised;

monitoring the data based on the business rules and definition of the physical and logical locations of data to detect a cyberspace or electronic data vulnerability;

generating one or more reports based on monitoring the data and relating at least in part to access of the data; and

communicating, via a secure communications module, the one or more reports to an individual included within a community of interest, the secure communications module cryptographically securing the one or more reports using an encryption key associated with the community of interest.

2. The method of claim 1, wherein defining the physical and logical locations of data includes defining known data vulnerabilities within the organization.

3. The method of claim 1, wherein the organization includes a governmental organization.

4. The method of claim 1, further comprising defining one or more response plans to be executed in response to detection of a cyberspace or electronic data vulnerability.

5. The method of claim 4, further comprising, upon detection of a cyberspace or electronic data vulnerability, executing a response plan associated with the detected cyberspace or electronic data vulnerability.

6. The method of claim 1, further comprising:

while monitoring, determining an existence of one or more additional circumstances under which data may be compromised; and

defining one or more additional business rules representing the one or more additional circumstances.

7. The method of claim 1, wherein the circumstances under which the data may be compromised are selected from the group consisting of:

cyberspace attacks;

unauthorized user access to organizational data;

environmental threats;

unauthorized wireless communication in protected areas; and

damage to physical facilities.

8. The method of claim 1, further comprising, prior to communicating the one or more reports to the individual, personally authenticating the individual using credentials uniquely associated with the individual.

9. The method of claim 8, wherein the credentials uniquely associated with the individual include biometric data.

10. A method of operating a security system associated with an organization, the security system configured to protect against cyberspace and electronic data vulnerabilities, the method comprising:

defining one or more physical and logical locations of data managed by the organization;

defining one or more business rules representing detected circumstances under which the data may be compromised;

submitting authentication information of a user to personally authenticate the user using credentials uniquely associated with the user;

upon authentication of the user, establishing a secure communication connection between a computing device operated by the user and a report engine, the secure communication connection providing cryptographic security between the computing device and the report engine and using an encryption key associated with a community of interest including the user; and

receiving, via the secure communication connection, one or more reports based on monitoring the data based on the business rules and definition of the physical and logical locations of data, the one or more reports including information regarding detected cyberspace and electronic data vulnerabilities and encrypted by the encryption key.

11. The method of claim 10, further comprising defining one or more communities of interest useable by the secure communication connection, the one or more communities of interest each associated with a different encryption key.

12. The method of claim 10, wherein the authentication information includes biometric data associated with the user.

13. The method of claim 10, further comprising defining a plurality of response plans to be executed in response to detection of a cyberspace or electronic data vulnerability.

14. The method of claim 10, wherein the plurality of reports includes reports selected from the group consisting of:

vulnerability mitigation strategy reports;

vulnerability mitigation process reports;

risk assessments; and

system alerts.

15. The method of claim 14, wherein the plurality of communities of interest are selected from one or more groups consisting of:

state government organizations;

at least partially public sector organizations;

intelligence organizations; and

executive departments.

16. A method of monitoring vulnerability of an organization against cyberspace and electronic data attacks, the method comprising:

receiving, via a secure communications module, one or more reports based on monitoring of sensitive data affiliated with an organization and relating at least in part to access of the sensitive data;

wherein the sensitive data is monitored across a network affiliated by the organization to detect a cyberspace or electronic data vulnerability; and

wherein the one or more reports are communicated to an individual included within a community of interest defined using a secure communications module, the secure communications module cryptographically securing the one or more reports using an encryption key associated with the community of interest.

17. The method of claim 16, wherein the cyberspace or electronic data vulnerability is detected based on a definition of physical and logical locations of data managed by the organization as well as one or more business rules representing detected circumstances under which the data may be compromised.

18. The method of claim 16, further comprising, prior to receiving the one or more reports, personally authenticating an individual as being a member of the community of interest.

19. The method of claim 16, wherein the one or more reports are generated by a situational awareness application.

20. The method of claim 16, wherein the community of interest is included within a plurality of communities of interest, and wherein the plurality of communities of interest are each associated with a different encryption key.