NETWORk THREAT RISK ASSESSMENT TOOL

• US 20130212685A1
• Filed: 03/15/2013
• Published: 08/15/2013
• Est. Priority Date: 09/22/2004
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kelley, Jeremy D., Lahann, Jeffrey S., Mackey, David H.
• Application Number:
  US13/842,914
• Publication Number:
  US 20130212685A1
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method, system and computer program product is disclosed that provides timely, accurate and summarized information about possible threats to information technology environments. It is a tool that looks at multiple aspects of an IT threat, including both specific (traditional) IT threats and general (non-traditional) IT threats, and rates each threat'"'"'s overall potential to do harm. A matrix is created that identifies a “threat score” to allow prioritization and reaction to the threats. The matrix takes both traditional IT threats and non-traditional IT threats and normalizes them on the same scale, giving users of the matrix the ability to understand the risks of both.

Claims

1. A computer-implemented method of assessing a weather-related threat to an Information Technology (IT) system, the method comprising the steps of:

collecting weather data for a location of the IT system;

determining, by one or more processors, a likelihood of a predetermined type of adverse weather event occurring at the location of the IT system, based on the weather data;

determining, by one or more processors, a likelihood of a problem caused by the adverse weather event to the IT system if the type of adverse weather event occurs;

determining, by one or more processors, an impact of the problem on a business dependent on the IT system if the problem occurs; and

determining, by one or more processors, a risk based on (a) the likelihood of the predetermined type of adverse weather event occurring, (b) the likelihood of the problem caused by the type of adverse weather event to the IT system, and (c) the impact on the problem on the business dependent on the IT system; and

generating an electronic alert if the risk exceeds a threshold.

2. The method of claim 1, wherein the risk determining step includes the steps of:

scoring the risk according to one or more predetermined characteristics, using a predetermined ratings scale for each characteristic; and

combining, according to a formula, said scoring of each of said characteristics into an overall threat score.

3. The method of claim 2, wherein said predetermined characteristics include one or more of the following:

probability, propulsion, potential, pervasiveness.

4. The method of claim 2, wherein said predetermined characteristics include all of the following:

probability, propulsion, potential, pervasiveness.

5. The method of claim 1, further comprising the step of:

configuring said one or more processors to develop a decayed threat score for the overall threat score; and

distributing said decayed threat score to the business dependent on the IT system via an electronic alert.

6. The method of claim 5, wherein said decayed threat score is developed and distributed on a daily basis.

7. A system for assessing a weather-related threat to an Information Technology (IT) system, the method comprising:

means for collecting weather data for a location of the IT system;

means for determining, by one or more processors, a likelihood of a predetermined type of adverse weather event occurring at the location of the IT system, based on the weather data;

means for determining, by one or more processors, a likelihood of a problem caused by the adverse weather event to the IT system if the type of adverse weather event occurs;

means for determining, by one or more processors, an impact of the problem on a business dependent on the IT system if the problem occurs; and

means for determining, by one or more processors, a risk based on (a) the likelihood of the predetermined type of adverse weather event occurring, (b) the likelihood of the problem caused by the type of adverse weather event to the IT system, and (c) the impact on the problem on the business dependent on the IT system; and

means for generating an electronic alert if the risk exceeds a threshold.

8. The system of claim 7, wherein the risk determining means includes:

means for scoring the risk according to one or more predetermined characteristics, using a predetermined ratings scale for each characteristic; and

means for combining, according to a formula, said scoring of each of said characteristics into an overall threat score.

9. The system of claim 8, wherein said predetermined characteristics include one or more of the following:

probability, propulsion, potential, pervasiveness.

10. The system of claim 8, wherein said predetermined characteristics include all of the following:

probability, propulsion, potential, pervasiveness.

11. The system of claim 7, further comprising:

means for configuring said one or more processors to develop a decayed threat score for the overall threat score; and

means for distributing said decayed threat score to the business dependent on the IT system via an electronic alert.

12. The system of claim 11, wherein said decayed threat score is developed and distributed on a daily basis.

13. A computer program product for assessing a weather-related threat to an Information Technology (IT) system, the computer program product comprising computer-readable storage medium having computer-readable program code embodied in the medium, the computer-readable program code comprising:

computer readable program code that collects weather data for a location of the IT system;

computer readable program code that determines, by one or more processors, a likelihood of a predetermined type of adverse weather event occurring at the location of the IT system, based on the weather data;

computer readable program code that determines, by one or more processors, a likelihood of a problem caused by the adverse weather event to the IT system if the type of adverse weather event occurs;

computer readable program code that determines, by one or more processors, an impact of the problem on a business dependent on the IT system if the problem occurs; and

computer readable program code that determines, by one or more processors, a risk based on (a) the likelihood of the predetermined type of adverse weather event occurring, (b) the likelihood of the problem caused by the type of adverse weather event to the IT system, and (c) the impact on the problem on the business dependent on the IT system; and

computer readable program code that generates an electronic alert if the risk exceeds a threshold.

14. The computer program product of claim 13, wherein the risk determining computer readable program code includes:

computer readable program code that scores the risk according to one or more predetermined characteristics, using a predetermined ratings scale for each characteristic; and

computer readable program code that combines, according to a formula, said scoring of each of said characteristics into an overall threat score.

15. The computer program product of claim 14, wherein said predetermined characteristics include one or more of the following:

probability, propulsion, potential, pervasiveness.

16. The computer program product of claim 14, wherein said predetermined characteristics include all of the following:

probability, propulsion, potential, pervasiveness.

17. The computer program product of claim 13, further comprising:

computer readable program code that configures said one or more processors to develop a decayed threat score for the overall threat score; and

computer readable program code that distributes said decayed threat score to the business dependent on the IT system via an electronic alert.

18. The computer program product of claim 17, wherein said decayed threat score is developed and distributed on a daily basis.