Systems and methods for sensitive data remediation
First Claim
Patent Images
1. A computer network auditing method, comprising:
- deploying agents on respective computers among a plurality of computers throughout a network;
using the agents to collect information about the volume and sensitivity of data stored on the respective computers and the programs running on the respective computers;
receiving the information from the agents at a central location;
for each computer for which the information has been received, calculating a risk score, where the risk score is based on the volume and sensitivity of data stored on said each computer and a security of said each computer;
comparing, at the central location, calculated risk scores of multiple computers and ranking the multiple computers in a risk score order; and
for a given one of the multiple computers in the risk score order, performing a remediation technique that has the effect of reducing the risk score for the given computer,wherein calculating the risk score comprises separately taking account of (i) for a given one of the computers, data considered to be of a first sensitivity value stored on the given one of the computers, (ii) data considered to be of a second sensitivity value, different form the first sensitivity value, stored on the given one of the computers, (iii) an exposure level of the data stored on the given one of the computers, and (iv) an integrity assessment of the given one of the computers, andwherein the risk score is based on a probability of loss that is itself based on the exposure level of the data stored on the given one of the computers and the integrity assessment of the given one of the computers, and an impact of loss metric that is itself based on the first and second sensitivity values.
12 Assignments
0 Petitions
Accused Products
Abstract
Systems and methods for sensitive data remediation include calculating a Probability of Loss of data on a given computer based on measures of control, integrity, and potential avenues of exploitation of the given computer, determining an Impact of Loss of the data on the given computer based on a type, volume, and nature of the data, and correlating the Probability of Loss with the Impact of Loss to generate a risk score for the given computer that can be compared to other computers in the network. The computers with higher risk scores can then be subjected to data remediation activity.
-
Citations
17 Claims
-
1. A computer network auditing method, comprising:
-
deploying agents on respective computers among a plurality of computers throughout a network; using the agents to collect information about the volume and sensitivity of data stored on the respective computers and the programs running on the respective computers; receiving the information from the agents at a central location; for each computer for which the information has been received, calculating a risk score, where the risk score is based on the volume and sensitivity of data stored on said each computer and a security of said each computer; comparing, at the central location, calculated risk scores of multiple computers and ranking the multiple computers in a risk score order; and for a given one of the multiple computers in the risk score order, performing a remediation technique that has the effect of reducing the risk score for the given computer, wherein calculating the risk score comprises separately taking account of (i) for a given one of the computers, data considered to be of a first sensitivity value stored on the given one of the computers, (ii) data considered to be of a second sensitivity value, different form the first sensitivity value, stored on the given one of the computers, (iii) an exposure level of the data stored on the given one of the computers, and (iv) an integrity assessment of the given one of the computers, and wherein the risk score is based on a probability of loss that is itself based on the exposure level of the data stored on the given one of the computers and the integrity assessment of the given one of the computers, and an impact of loss metric that is itself based on the first and second sensitivity values. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A method of monitoring a network of computers, comprising;
-
receiving, from respective computers in the network, an indication of the volume and sensitivity of information stored thereon; receiving, from the respective computers in the network, an indication of a level of security thereof; receiving, from the respective computers in the network, an indication of configuration of the respective computer; calculating a risk score for each respective computer based on the volume and sensitivity of information, security and configuration of each respective computer; and ranking the computers based on their respective risk scores, wherein calculating the risk score comprises separately taking account of (i) for a given one of the computers, data considered to be of a first sensitivity value stored on the given one of the computers, (ii) data considered to be of a second sensitivity value, different from the first sensitivity value, stored one the given one of the computers, (iii) an exposure level of the data stored on the given one of the computers, and (iv) an integrity assessment of the given one of the computers, and wherein the risk score is based on a probability of loss that is itself based on the exposure level of the data stored on the given one of the computers and the integrity assessment of the given one of the computers, and an impact of loss metric that is itself based on the first and second sensitivity values. - View Dependent Claims (12, 13, 14, 15, 16, 17)
-
Specification