ONLINE PORTAL FOR IMPROVING CYBERSECURITY RISK SCORES

• US 20160248797A1
• Filed: 03/16/2016
• Published: 08/25/2016
• Est. Priority Date: 12/13/2014
• Status: Active Grant

• Current Assignee: SecurityScorecard, Inc.
• Original Assignee: SecurityScorecard, Inc.
• Inventors: Kassoumeh, Samuel, Yampolskiy, Aleksandr, Blackin, Rob, Heid, Alexander
• Granted Patent: US 10,491,619 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G06Q 10/06393 Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Determining an entity'"'"'s cybersecurity risk and benchmarking that risk includes non-intrusively collecting one or more types of data associated with an entity. Embodiments further include calculating a security score for at least one of the one or more types of data based, at least in part, on processing of security information extracted from the at least one type of data, wherein the security information is indicative of a level of cybersecurity. Some embodiments also comprise assigning a weight to the calculated security score based on a correlation between the extracted security information and an overall security risk determined from analysis of one or more previously-breached entities in the same industry as the entity. Additional embodiments include calculating an overall cybersecurity risk score for the entity based, at least in part, on the calculated security score and the weight assigned to the calculated security score.

Claims

1. A method for improving an entity'"'"'s cybersecurity risk using a cybersecurity risk assessment portal, the method comprising:

receiving, via a cybersecurity risk assessment portal operating on one or more machines, a request to calculate an entity'"'"'s cybersecurity risk based, at least in part, on a first set of attributes of the entity, the first set of attributes comprising one or more of an identity of the entity, a number of employees of the entity, an industry in which the entity operates, and an identification of one or more of the entity'"'"'s competitors;

identifying, based on the first set of attributes, one or more data sources from which to collect one or more types of data relating to the entity'"'"'s cybersecurity;

calculating a cybersecurity risk score for the entity based on data collected from the one or more data sources;

transmitting, in response to the request, via the cybersecurity risk assessment portal operating on the one or more machines, the calculated cybersecurity risk score.

2. The method of claim 1 further comprising:

classifying the calculated cybersecurity risk score according to cyber security risk scores calculated for one or more of the entity'"'"'s competitors.

3. The method of claim 1 further comprising:

comparing the calculated cybersecurity risk score to at least one historical cybersecurity score previously calculated for the entity; and

transmitting, via the cybersecurity risk assessment portal, trend information based on the comparison.

4. The method of claim 1 wherein the cybersecurity risk assessment portal is an online portal.

5. The method of claim 1 further comprising:

transmitting access credentials required to access the cybersecurity risk assessment portal, and

wherein receiving, via a cybersecurity risk assessment portal, a request to calculate an entity'"'"'s cybersecurity risk is conditioned upon a user providing the access credentials.

6. The method of claim 1 further comprising:

calculating, on a periodic basis, updated cybersecurity risk scores for the entity based on data collected from the one or more data sources;

comparing one or more of the updated cybersecurity risk scores to a threshold; and

if the one or more updated cybersecurity risks scores is below the threshold, transmitting, via the cybersecurity risk assessment portal, an alert.

7. The method of claim 6 further comprising:

if the one or more updated cybersecurity risks scores is below the threshold, transmitting, via the cybersecurity risk assessment portal, the one or more cybersecurity risk scores and an identification of one or more updated objectives to complete to improve the entity'"'"'s cybersecurity risk score.

8. An apparatus comprising:

a memory; and

a processor coupled to the memory, the processor configured to execute the steps of;

receiving, via a cybersecurity risk assessment portal operating on one or more machines, a request to calculate an entity'"'"'s cybersecurity risk based, at least in part, on a first set of attributes of the entity, the first set of attributes comprising one or more of an identity of the entity, a number of employees of the entity, an industry, an industry in which the entity operates, and an identification of one or more of the entity'"'"'s competitors;

identifying, based on the first set of attributes, one or more data sources from which to collect one or more types of data relating to the entity'"'"'s cybersecurity;

calculating a cybersecurity risk score for the entity based on data collected from the one or more data sources;

transmitting, in response to the request, via the cybersecurity risk assessment portal operating on the one or more machines, the calculated cybersecurity risk score.

9. The apparatus of claim 8 where the processor is further configured to execute the steps of:

transmitting, in response to the request, via the cybersecurity risk assessment portal operating on the one or more machines, an identification of one or more objectives to complete to improve the entity'"'"'s cybersecurity risk score.

10. The apparatus of claim 8 where the processor is further configured to execute the steps of:

receiving, via the cybersecurity risk assessment portal, an indication that the objective has been achieved;

calculating an updated cybersecurity risk score for the entity based on data collected from the one or more data sources and the achieved objective; and

transmitting, via the cybersecurity risk assessment portal, the updated calculated cybersecurity risk score.

11. The apparatus of claim 8 where the processor is further configured to execute the steps of:

classifying the calculated cybersecurity risk score according to cybersecurity risk scores calculated for one or more of the entity'"'"'s competitors.

12. The apparatus of claim 8 where the processor is further configured to execute the steps of:

comparing the calculated cybersecurity risk score to at least one historical cybersecurity score previously calculated for the entity; and

transmitting, via the cybersecurity risk assessment portal, trend information based on the comparison.

13. The apparatus of claim 8 wherein the cybersecurity risk assessment portal is an online portal.

14. The apparatus of claim 8 where the processor is further configured to execute the steps of:

transmitting access credentials required to access the cybersecurity risk assessment portal, and

wherein receiving, via a cybersecurity risk assessment portal, a request to calculate an entity'"'"'s cybersecurity risk is conditioned upon a user providing the access credentials.

15. The apparatus of claim 8 where the processor is further configured to execute the steps of:

calculating, on a periodic basis, updated cybersecurity risk scores for the entity based on data collected from the one or more data sources;

comparing one or more of the updated cybersecurity risk scores to a threshold; and

if the one or more updated cybersecurity risks scores is below the threshold, transmitting, via the cybersecurity risk assessment portal, an alert.

16. The apparatus of claim 15 where the processor is further configured to execute the steps of:

if the one or more updated cybersecurity risks scores is below the threshold, transmitting, via the cybersecurity risk assessment portal, the one or more cybersecurity risk scores and an identification of one or more updated objectives to complete to improve the entity'"'"'s cybersecurity risk score.