Enterprise integrity simulation

• US 8,781,930 B2
• Filed: 10/07/2005
• Issued: 07/15/2014
• Est. Priority Date: 10/07/2005
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Paulus, Sachar M., Wagner, Guido, Bitz, Gunter
• Primary Examiner(s): Kalinowski, Alexander
• Assistant Examiner(s): Vyas, Abhishek
• Application Number:
  US11/245,996
• Publication Number:
  US 20070100642A1
• Time in Patent Office: 3,203 Days
• Field of Search: 705/35, 705/38
• US Class Current: 705/35
• CPC Class Codes: G06Q 10/067 Enterprise or organisation modelling
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 99/00 Subject matter not provided for in other groups of this subclass

Abstract

Methods and apparatus, including computer program products, for risk assessment and analysis. Asset data representing a set of assets is received. Threat data representing a set of threats is received. Measures data representing a set of measures is received. A loss expectancy based upon the value of the assets, the potential reduction of value caused by the threats, and the protection of the value caused by the measures is automatically calculated. Project data representing a simulated project is received. A revised loss expectancy is automatically calculated based upon the value of the assets, the potential reduction of value caused by the threats, and the protection of the value caused by the measures as modified by the simulated project. A savings caused by the simulated project is automatically calculated based upon the loss expectancy and revised loss expectancy.

Claims

1. A computer program product, tangibly embodied in a tangible machine-readable storage medium, for execution by a processor, the computer program product being operable to cause data processing apparatus to:

present a questionnaire form on display, the form adapted to collect reporting data from a plurality of users pertaining to a set of measures;

receive asset data representing a set of assets, the asset data including a respective value for each asset in the set of assets having a value;

receive threat data representing a set of threats, each threat in the set of threats potentially reducing the value of one or more of the assets in the set of assets;

receive measures data representing the set of measures, each measure in the set of measures protecting the value of one or more assets such that i) asset data representing one of the assets in the set of assets or ii) measures data representing a measure in the set of measures, is based on reporting data collected from the plurality of users through the questionnaire form;

automatically calculate a loss expectancy based upon the value of the assets, a potential reduction of value caused by the threats, and a protection of value caused by the measures;

receive project data representing a simulated project, the simulated project modifying one or more assets, threats, or measures;

automatically calculate a revised loss expectancy based upon the value of the assets, the potential reduction of value caused by the threats, and the protection of the value caused by the measures as modified by the simulated project;

automatically calculate a savings caused by the simulated project based upon the loss expectancy and revised loss expectancy; and

generate a report, the report including at least one of the savings caused by one or more simulated projects.

2. The computer program product of claim 1, the computer program product being further operable to cause data processing apparatus to:

receive a cost of the simulated project; and

calculate a return on investment based on the savings and the cost, wherein the report includes the return on investment of one or more simulated projects.

3. The computer program product of claim 2, the computer program product being further operable to cause data processing apparatus to:

modify a value of asset data representing a first asset in the set of assets, wherein the value is modified in response to reporting data received from a user, the reporting data directed to the first asset.

4. A computer-implemented method comprising the following steps performed by at least one processor:

presenting a questionnaire form on a display, the form adapted to collect reporting data from a plurality of users pertaining to a set of measures;

receiving asset data representing a set of assets, the asset data including a respective value for each asset in the set of assets having a value;

receiving threat data representing the set of measures, each measure in the set of measures protecting the value of one or more assets such that i) asset data, representing one of the assets in the set of assets or ii) measures data representing a measure in the set of measures, is based on reporting data collected from the plurality of users through the questionnaire form;

receiving measures data representing a set of measures, each measure in the set of measures protecting the value of one or more assets;

automatically calculating a loss expectancy based upon the value of the assets, a potential reduction of value caused by the threats, and a protection of value caused by the measures;

receiving project data representing a simulated project, the simulated project modifying one or more assets, threats, or measures;

automatically calculating a revised loss expectancy based upon the value of the assets, the potential reduction of value caused by the threats, and the protection of the value caused by the measures as modified by the simulated project;

automatically calculating a savings caused by the simulated project based upon the loss expectancy and revised loss expectancy; and

generating a report, the report including at least one of the savings caused by one or more simulated projects.

5. The method of claim 4, further comprising:

receiving a cost of the simulated project; and

calculating a return on investment based on the savings and the cost, wherein the report includes the return on investment of one or more simulated projects.

6. The method of claim 4, wherein the reporting data comprises feedback from users relating to real world implementation of the set of measures.