CYBER SECURITY RISK MODEL AND INDEX

• US 20200137101A1
• Filed: 10/24/2018
• Published: 04/30/2020
• Est. Priority Date: 10/24/2018
• Status: Active Grant

• Current Assignee: American Bureau of Shipping (American Bureau of Shipping Incorporated)
• Original Assignee: American Bureau of Shipping (American Bureau of Shipping Incorporated)
• Inventors: Scott, Richard G., DeWitt, Cris Owen, Mowrer, Matthew
• Granted Patent: US 10,791,139 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A cyber security risk model mitigates cyber security risks for an asset environment (including a virtual asset) by utilizing a functions, connections and identities to determine a cyber security risk index (CSRI). An asset environment may comprise one or more functions where each function has one or more connections associated with any one or more of the functions and one or more identities associated with the virtual asset. A CSRI may be determined for each function based on the cyber security risk model that takes into account the cyber security risks or attributes associated with each function, connection and identity associated with the virtual environment or virtual asset. The asset environment may be adjusted, reconfigured, or otherwise altered based on the CSRI for any given function or for an overall CSRI. An alert may also be triggered based, at least in part, on a determined CSRI.

Claims

1. A method for determining a cyber security risk index associated with a virtual asset, comprising:

determining one or more functions associated with one or more devices of the virtual asset;

determining one or more connections associated with each function;

determining one or more identities associated with each function;

determining the cyber security risk index for the virtual asset based, at least in part, on the one or more functions, the one or more connections and the one or more identities; and

altering a configuration of the virtual asset based, at least in part, on the cyber security risk index.

2. The method of claim 1, further comprising:

wherein determining the one or more functions comprises;

determining a cardinality of each function set associated with a virtual asset, wherein each function set comprises at least one of the one or more functions; and

determining a function set connection type for each of the at least one of the one or more functions.

3. The method of claim 2, further comprising:

wherein determining the one or more connections comprises;

determining a number of protected connection points for each function set; and

determining a number of vulnerable connection points for each function set.

4. The method of claim 3, further comprising:

wherein determining the one or more identities comprises;

determining a number of trusted human identities that can access each function;

determining a number of untrusted human identities that can access each function;

determining a number of trusted devices that can access the function; and

determining the number of untrusted devices that can access the function.

5. The method of claim 4, further comprising:

determining a cyber security risk index associated with each of the one or more functions; and

wherein determining the cyber security risk index for the virtual asset is further based, at least in part, on the cyber security risk index associated with each of the one or more functions.

6. The method of claim 1, further comprising associating a weight with at least one of the one or more functions, the one or more connections and the one or more identities.

7. The method of claim 1, further comprising triggering an alert based on the cyber security risk index.

8. A non-transitory computer-readable medium storing one or more instructions that, when executed by a processor, cause the processor to:

determine one or more functions associated with one or more devices the virtual asset;

determine one or more connections associated with each function;

determine one or more identities associated with each function;

determine the cyber security risk index for the virtual asset based, at least in part, on the one or more functions, the one or more connections and the one or more identities; and

alter a configuration of the virtual asset based, at least in part, on the cyber security risk index.

9. The non-transitory computer-readable medium of claim 8, wherein determining the one or more functions comprises:

determining a cardinality of each function set associated with a virtual asset, wherein each function set comprises at least one of the one or more functions; and

determining a function set connection type for each of the at least one of the one or more functions.

10. The non-transitory computer-readable medium of claim 9, wherein determining the one or more connections comprises:

determining a number of protected connection points for each function set; and

determining a number of vulnerable connection points for each function set.

11. The non-transitory computer-readable medium of claim 10, wherein determining the one or more identities comprises:

determining a number of trusted human identities that can access each function;

determining a number of untrusted human identities that can access each function;

determining a number of trusted devices that can access the function; and

determining the number of untrusted devices that can access the function.

12. The non-transitory computer-readable medium of claim 11, wherein the one or more instructions when executed by the processor, further cause the processor to:

determine a cyber security risk index associated with each of the one or more functions; and

wherein determining the cyber security risk index for the virtual asset is further based, at least in part, on the cyber security risk index associated with each of the one or more functions.

13. The non-transitory computer-readable medium of claim 11, wherein the one or more instructions when executed by the processor, further cause the processor to associate a weight with at least one of the one or more functions, the one or more connections and the one or more identities.

14. The non-transitory computer-readable medium of claim 11, trigger an alert based on the cyber security risk index.

15. An information handling system comprising:

a memory;

a processor coupled to the memory, wherein the memory comprises one or more instructions executable by the processor to;

determine one or more functions associated with one or more devices of the virtual asset;

determine one or more connections associated with each function;

determine one or more identities associated with each function;

determine the cyber security risk index for the virtual asset based, at least in part, on the one or more functions, the one or more connections and the one or more identities; and

alter a configuration of the virtual asset based, at least in part, on the cyber security risk index.

16. The information handling system of claim 15, further comprising:

wherein determining the one or more functions comprises;

determining a cardinality of each function set associated with a virtual asset, wherein each function set comprises at least one of the one or more functions; and

determining a function set connection type for each of the at least one of the one or more functions.

17. The information handling system of claim 16, further comprising:

wherein determining the one or more connections comprises;

determining a number of protected connection points for each function set; and

determining a number of vulnerable connection points for each function set.

18. The information handling system of claim 17, further comprising:

wherein determining the one or more identities comprises;

determining a number of trusted human identities that can access each function;

determining a number of untrusted human identities that can access each function;

determining a number of trusted devices that can access the function; and

determining the number of untrusted devices that can access the function.

19. The information handling system of claim 18, wherein the one or more instructions are further executable by the processor to:

determine a cyber security risk index associated with each of the one or more functions; and

wherein determining the cyber security risk index for the virtual asset is further based, at least in part, on the cyber security risk index associated with each of the one or more functions.

20. The information handling system of claim 15, wherein the one or more instructions are further executable by the processor to associate a weight with at least one of the one or more functions, the one or more connections and the one or more identities.