Information system service-level security risk analysis
First Claim
1. An apparatus comprising:
- a risk analyzer configured to identify one or more assets of an information system that have respective relationships with a service provided by the information system, and to determine one or more security risks to the service by analyzing effects of security vulnerabilities which are associated with the identified assets and are propagated to the service through the relationships; and
an interface operatively coupled to the risk analyzer and configured to provide a consolidated representation of the service, the consolidated representation comprising an indication of the one or more determined security risks and an indication of at least one of the respective relationships between the service and the one or more identified assets, the indication of the one or more determined security risks comprising, for each determined security risk, an indication of an overall security state associated with the security risk and respective indications of a plurality of security sub-states comprising the overall security state,wherein at least one of the risk analyzer and the interface is implemented using hardware,wherein the one or more identified assets comprise an asset that has a relationship with the service only through a relationship with an asset that has a relationship with the service,wherein the indication of the one or more determined security risks comprises different representations of a security risk arising from a security vulnerability associated with an asset that has a relationship with the service and a security risk arising from a security vulnerability associated with an asset that has a relationship with the service only through a relationship with an asset that has a relationship with the service.
4 Assignments
0 Petitions
Accused Products
Abstract
Information system service-level security risk analysis systems, methods, and Graphical User Interfaces are disclosed. Assets of an information system that have relationships with a service provided by the information system are identified, and at least one security risk to the service is determined by analyzing security vulnerabilities associated with the identified assets. A consolidated representation of the service is provided, and includes an indication of the determined security risk(s) and an indication of a relationship between the service and at least one of the identified assets. The security risk indication may include indications of multiple security parameters. Security risks may be represented differently depending on whether they arise from a security vulnerability of an asset that has a relationship with the service or a security vulnerability of an asset that has a relationship with the service only through a relationship with an asset that has a relationship with the service.
-
Citations
16 Claims
-
1. An apparatus comprising:
-
a risk analyzer configured to identify one or more assets of an information system that have respective relationships with a service provided by the information system, and to determine one or more security risks to the service by analyzing effects of security vulnerabilities which are associated with the identified assets and are propagated to the service through the relationships; and an interface operatively coupled to the risk analyzer and configured to provide a consolidated representation of the service, the consolidated representation comprising an indication of the one or more determined security risks and an indication of at least one of the respective relationships between the service and the one or more identified assets, the indication of the one or more determined security risks comprising, for each determined security risk, an indication of an overall security state associated with the security risk and respective indications of a plurality of security sub-states comprising the overall security state, wherein at least one of the risk analyzer and the interface is implemented using hardware, wherein the one or more identified assets comprise an asset that has a relationship with the service only through a relationship with an asset that has a relationship with the service, wherein the indication of the one or more determined security risks comprises different representations of a security risk arising from a security vulnerability associated with an asset that has a relationship with the service and a security risk arising from a security vulnerability associated with an asset that has a relationship with the service only through a relationship with an asset that has a relationship with the service. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-
-
13. A method comprising:
-
a risk analyzer identifying one or more assets of an information system that have respective relationships with a service provided by the information system; the risk analyzer analyzing effects of security vulnerabilities, which are associated with the identified assets and are propagated to the service through the relationships, to determine one or more security risks to the service; and the risk analyzer providing through an interface, in a consolidated representation of the service, an indication of the one or more determined security risks and an indication of at least one of the respective relationships between the service and the one or more identified assets, the indication of the one or more determined security risks comprising, for each determined security risk, an indication of an overall security state associated with the security risk and respective indications of a plurality of security sub-states comprising the overall security state, wherein at least one of the risk analyzer and the interface is implemented using hardware, wherein identifying comprises identifying an asset that has a relationship with the service only through a relationship with an asset that has a relationship with the service, wherein the indication of the one or more determined security risks comprises different representations of a security risk arising from a security vulnerability associated with an asset that has a relationship with the service and a security risk arising from a security vulnerability associated with an asset that has a relationship with the service only through a relationship with an asset that has a relationship with the service. - View Dependent Claims (14, 15, 16)
-
Specification