REDUCING CYBERSECURITY RISK LEVEL OF A PORTFOLIO OF COMPANIES USING A CYBERSECURITY RISK MULTIPLIER

• US 20190034845A1
• Filed: 07/28/2017
• Published: 01/31/2019
• Est. Priority Date: 07/28/2017
• Status: Active Grant

• Current Assignee: SecurityScorecard, Inc.
• Original Assignee: SecurityScorecard, Inc.
• Inventors: MO, JUE, VARGAS, LUIS, SOHVAL, A. ROBERT
• Granted Patent: US 10,614,401 B2
• Time in Patent Office: Days
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A multiplier is utilized to quantify a cybersecurity risk level of a portfolio of entities (e.g., companies) and enable actions to mitigate that quantified risk. In doing so, features or attributes of one or more companies in a portfolio are compared to features or attributes of one or more companies that experienced an adverse cybersecurity event (e.g. a data breach). Further, a degree of dependency, such as a matrix of a number of shared vendors and the proximity of those vendors to the companies, can be measured between (1) portfolio companies and one or more companies that experienced a cybersecurity event, and/or (2) the portfolio companies themselves to better quantify the risk. That is, to more meaningfully analyze a cybersecurity event that occurred at one or more companies and better predict the likelihood of an occurrence at portfolio companies, embodiments can determine an n-degree interdependency between companies. I

Claims

1. A method for reducing a cybersecurity risk level for a portfolio of companies, the method comprising:

determining an initial cybersecurity risk level for the portfolio;

identifying at least one company that experienced a cybersecurity risk event during a certain time period;

identifying;

at least one attribute common to the at least one identified company that experienced the cybersecurity risk event and a plurality of companies in the portfolio, and

a degree of mutuality of the at least one attributes;

determining a probability that another cybersecurity risk event will occur with respect to the plurality of companies in the portfolio, where the probability depends on;

the number of identified common attributes, and

degrees of mutuality of the number of identified attributes;

generating, from the determined probability, a cybersecurity risk multiplier for the portfolio;

generating a refined cybersecurity risk level that is a function of the initial cybersecurity risk level and the cybersecurity risk multiplier; and

enabling a tool for using the refined cybersecurity risk level.

2. The method of claim 1 where enabling the tool for using the refined cybersecurity risk level comprises:

displaying, to a user, an interactive tool enabling the user to view the refined cybersecurity risk level for the portfolio.

3. The method of claim 2 where the interactive tool further enables the user to view:

an action the user can take to reduce the refined cybersecurity risk level.

4. The method of claim 3 where the action the user can take to reduce the refined cybersecurity risk level comprises:

an action to remove a company from the portfolio of companies;

an action to replace the removed company with a new company, where the new company was not previously included in the portfolio; and

an action to identify a critical cybersecurity attribute and remove the identified attribute from the portfolio.

5. The method of claim 1 where the refined cybersecurity risk level is expressed as a product of the initial cybersecurity risk level and the cybersecurity risk multiplier.

6. The method of claim 1 where the at least one identified company that experienced a cybersecurity risk event during the certain time period is in the portfolio.

7. The method of claim 6 where the certain time period is historical.

8. The method of claim 1 where the at least one identified company that experienced a cybersecurity risk event during the certain time period is not in the portfolio.

9. The method of claim 8 where the certain time period is historical.

10. The method of claim 1 where the initial cybersecurity risk level is generated, at least in part, from cybersecurity data relating to at least one company in the portfolio during the certain time period.

11. The method of claim 1 where the initial cybersecurity risk level is generated, at least in part, by comparing attributes indicative of cybersecurity risk level of companies in the portfolio to the attributes indicative of cybersecurity risk level of companies in another portfolio comprising randomly selected companies.

12. The method of claim 1 where the identified common attributes are weighted according to their correlation with an incidence of a cybersecurity risk event, and the determined probability further depends on the weights of the identified common attributes.

13. The method of claim 1 where the identified common attributes comprise an internal attribute that is shared by companies in the portfolio.

14. The method of claim 13 where the internal attribute comprises one or more of:

vulnerable host, obsolete user agent, number of new malware events, open ports, slow patching cadence, and inadequate use of firewalls and inadequate use of intrusion detection system.

15. The method of claim 1 where the identified common attributes comprise an external attribute that is shared by companies in the portfolio and one or more companies not in the portfolio.

16. The method of claim 15 where the external attribute comprises one or more of:

inadequate use of social media accounts, lost or stolen passwords, and inadequate social network sentiment.

17. The method of claim 1 where the identified common attributes comprises a first-degree common attribute.

18. The method of claim 17 where the first-degree common attribute comprises at least one vendor that is common to two or more companies in the portfolio.

19. The method of claim 1 where the identified common attributes comprises a second-degree common attribute.

20. The method of claim 18 where the second-degree common attribute comprises at least one vendor that is common to two or more vendors, where the two or more vendors are common to two or more companies in the portfolio.

40. The method of claim 18 where the second-degree common attribute comprises at least one vendor that is common to two or more vendors, where the two or more vendors are common to two or more companies in the portfolio.

21. An apparatus for reducing a cybersecurity risk level for a portfolio of companies, the apparatus comprising:

a non-transitory memory; and

one or more processors coupled to the memory, where the one or more processors are configured to;

determine an initial cybersecurity risk level for the portfolio;

identify at least one company that experienced a cybersecurity risk event during a certain time period;

identify;

at least one attribute common to the at least one identified company that experienced the cybersecurity risk event and a plurality of companies in the portfolio, and

a degree of mutuality of the at least one attributes;

determine a probability that another cybersecurity risk event will occur with respect to the plurality of companies in the portfolio, where the probability depends on;

the number of identified common attributes, and

degrees of mutuality of the number of identified attributes;

generate, from the determined probability, a cybersecurity risk multiplier for the portfolio;

generate a refined cybersecurity risk level that is a function of the initial cybersecurity risk level and the cybersecurity risk multiplier; and

enable a tool for using the refined cybersecurity risk level.

22. The apparatus of claim 21 where enabling the tool for using the refined cybersecurity risk level comprises:

displaying, to a user, an interactive tool enabling the user to view the refined cybersecurity risk level for the portfolio.

23. The apparatus of claim 22 where the interactive tool further enables the user to view:

an action the user can take to reduce the refined cybersecurity risk level.

24. The apparatus of claim 23 where the action the user can take to reduce the refined cybersecurity risk level comprises:

an action to remove a company from the portfolio of companies; and

an action to replace the removed company with a new company, where the new company was not previously included in the portfolio.

25. The apparatus of claim 21 where the refined cybersecurity risk level is expressed as a product of the initial cybersecurity risk level and the cybersecurity risk multiplier.

26. The apparatus of claim 21 where the at least one identified company that experienced a cybersecurity risk event during the certain time period is in the portfolio.

27. The apparatus of claim 26 where the certain time period is historical.

28. The apparatus of claim 21 where the at least one identified company that experienced a cybersecurity risk event during the certain time period is not in the portfolio.

29. The apparatus of claim 28 where the certain time period is historical.

30. The apparatus of claim 21 where the initial cybersecurity risk level is generated, at least in part, from cybersecurity data relating to at least one company in the portfolio during the certain time period.

31. The apparatus of claim 21 where the initial cybersecurity risk level is generated, at least in part, by comparing attributes indicative of cybersecurity risk level of companies in the portfolio to the attributes indicative of cybersecurity risk level of companies in another portfolio comprising randomly selected companies.

32. The apparatus of claim 21 where the identified common attributes are weighted according to their correlation with an incidence of a cybersecurity risk event, and the determined probability further depends on the weights of the identified common attributes.

33. The apparatus of claim 21 where the identified common attributes comprise an internal attribute that is shared by companies in the portfolio.

34. The apparatus of claim 33 where the internal attribute comprises one or more of:

vulnerable host, obsolete user agent, number of new malware events, open ports, and slow patching cadence.

35. The apparatus of claim 21 where the identified common attributes comprise an external attribute that is shared by companies in the portfolio and one or more companies not in the portfolio.

36. The apparatus of claim 35 where the external attribute comprises one or more of:

inadequate use of social media accounts, lost or stolen passwords, and inadequate social network sentiment.

37. The apparatus of claim 21 where the identified common attributes comprises a first-degree common attribute.

38. The apparatus of claim 37 where the first-degree common attribute comprises at least one vendor that is common to two or more companies in the portfolio.

39. The apparatus of claim 21 where the identified common attributes comprises a second-degree common attribute.

41. A method for reducing a cybersecurity risk level of a portfolio of companies, the method comprising:

identifying at least one company that experienced a cybersecurity risk event during a certain time period;

identifying;

at least one attribute common to the at least one identified company that experienced the cybersecurity risk event and a plurality of companies in the portfolio, and

a degree of mutuality of the at least one attributes;

generating a cybersecurity risk multiplier for the portfolio based on;

a number of the identified attributes,

a number of the plurality of companies having the identified attributes, and

degrees of mutuality of the number of identified attributes;

generating a portfolio cybersecurity risk level that is a function of cybersecurity risk multiplier; and

enabling a tool for reducing the generated portfolio cybersecurity risk level.

42. An apparatus for reducing a cybersecurity risk level of a portfolio of companies, the method comprising:

a non-transitory memory; and

one or more processors coupled to the memory, where the one or more processors are configured to;

identify at least one company that experienced a cybersecurity risk event during a certain time period;

identify;

at least one attribute common to the at least one identified company that experienced the cybersecurity risk event and a plurality of companies in the portfolio, and

a degree of mutuality of the at least one attributes;

generate a cybersecurity risk multiplier for the portfolio based on;

a number of the identified attributes,

a number of the plurality of companies having the identified attributes, and

degrees of mutuality of the number of identified attributes;

generate a portfolio cybersecurity risk level that is a function of cybersecurity risk multiplier; and

enable a tool for reducing the generated portfolio cybersecurity risk level.