Comparing an organization's security data to aggregate security data

• US 9,509,711 B1
• Filed: 02/01/2012
• Issued: 11/29/2016
• Est. Priority Date: 02/01/2012
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Torre, Brent R., Acquaviva, James A., McNerthney, Patrick J., Thomas, Robert W., Keanini, Timothy D.
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): ALMEIDA, DEVIN E
• Application Number:
  US13/363,857
• Time in Patent Office: 1,763 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

An organization'"'"'s security data is compared to an aggregation of multiple organizations'"'"' security data. Security data is received from multiple organizations having organizational characteristics. The received security data is aggregated based on the organizational characteristics to generate sets of aggregate data associated with the organizational characteristics. A query is received from an organization of the multiple organizations. The query specifies a particular organizational characteristic. A set of aggregate data associated with the specified organizational characteristic is identified. A representation of the organization'"'"'s security data in relation to the identified set of aggregate data is generated. The representation is transmitted to the organization in response to the query.

Claims

1. A computer-implemented method of comparing an organization'"'"'s security data to an aggregation of multiple organizations'"'"' security data, the method comprising:

receiving, at a single repository, security data separately from each of multiple organizations having a plurality of organizational characteristics, the security data received at each of multiple accounts corresponding to the multiple organizations;

authenticating the security data to each of the multiple accounts;

aggregating, at the single repository, the received security data based on the organizational characteristics to generate sets of aggregate data associated with the organizational characteristics of the multiple organizations, wherein the receiving and aggregating takes place without communicating at least a portion of the security data associated with at least one of the multiple organizations to at least another of the multiple organizations;

receiving a query from an organization of the multiple organizations, the query specifying a particular organizational characteristic of the plurality of organizational characteristics and a staleness parameter indicating a time period of desired data;

in response to the query, identifying a set from the sets of aggregate data, the identified set associated with the specified organizational characteristic and falling within the indicated time period of the staleness parameter;

generating a representation of the organization'"'"'s security data in relation to the identified set from the sets of aggregate data, wherein the representation comprises at least a first indication of the security data for the organization and a second indication of cumulative security data for the remaining multiple organizations, the first indication being separate from the second indication; and

transmitting the representation to the organization in response to the query.

2. The method of claim 1, further comprising storing the received security data in separate database instances, wherein security data from a first organization is stored in a separate database instance from security data from a second organization.

3. The method of claim 1, wherein an organizational characteristic describes demographic information regarding an organization, and wherein the demographic information comprises one or more elements selected from the group consisting of an industry within which the organization operates, a size of the organization, a number of assets under management by the organization, and a geographic region within which the organization operates.

4. The method of claim 1, wherein an organizational characteristic describes information regarding an organization, and wherein the information comprises one or more elements of a group containing compliance with a regulation, implementation of a best practice, membership in a consortium, and money spent on security.

5. The method of claim 1, wherein an organizational characteristic includes an attribute and one or more values for that attribute.

6. The method of claim 1, wherein the query further specifies an additional organizational characteristic, and wherein identifying the set of aggregate data associated with the specified organizational characteristic comprises identifying the set of aggregate data associated with the specified organizational characteristic and associated with the additional organizational characteristic.

7. The method of claim 1, wherein the query further specifies the organization'"'"'s security data, and further comprising obtaining the organization'"'"'s security data from the query.

8. The method of claim 1, further comprising obtaining the organization'"'"'s security data from storage.

9. The method of claim 1, wherein the representation comprises a visual representation of security data that shows how a particular aspect of a security infrastructure is performing.

10. The method of claim 1, wherein the representation comprises a first visual component that describes the organization'"'"'s security data and a second visual component that describes the identified set of aggregate data.

11. The method of claim 1, wherein the representation can be annotated by a first user, and wherein the first user'"'"'s annotation can be viewed by a second user.

12. A non-transitory computer-readable storage medium storing executable computer program instructions for comparing an organization'"'"'s security data to an aggregation of multiple organizations'"'"' security data, the instructions performing steps comprising:

receiving, at a single repository, security data separately from each of multiple organizations having organizational characteristics;

aggregating, at the single repository, the received security data based on the organizational characteristics to generate sets of aggregate data associated with the organizational characteristics of the multiple organizations, wherein the receiving and aggregating takes place without communicating at least a portion of the security data associated with at least one of the multiple organizations to at least another of the multiple organizations;

receiving a query from an organization of the multiple organizations, the query specifying a particular organizational characteristic of the organizational characteristics and a staleness parameter indicating a time period of desired data;

in response to the query, identifying a set from the sets of aggregate data, the identified set associated with the specified organizational characteristic and falling within the indicated time period of the staleness parameter;

generating a representation of the organization'"'"'s security data in relation to the identified set from the sets of aggregate data, wherein the representation comprises at least a first indication of the security data for the organization and a second indication of cumulative security data for the remaining multiple organizations, the first indication being separate from the second indication; and

transmitting the representation to the organization in response to the query.

13. The storage medium of claim 12, wherein an organizational characteristic describes demographic information regarding an organization, and wherein the demographic information comprises one or more elements selected from the group consisting of an industry within which the organization operates, a size of the organization, a number of assets under management by the organization, and a geographic region within which the organization operates.

14. The storage medium of claim 12, wherein the query further specifies a staleness preference that specifies how current the set of aggregate data associated with the specified organizational characteristic must be for the set of aggregate data to be used to answer the query.

15. The storage medium of claim 12, wherein the representation comprises a first visual component that describes the organization'"'"'s security data and a second visual component that describes the identified set of aggregate data.

16. A computer system for comparing an organization'"'"'s security data to an aggregation of multiple organizations'"'"' security data, the computer system comprising:

at least one non-transitory computer-readable storage medium storing executable computer program instructions comprising instructions for;

receiving, at a single repository, security data separately from each of multiple organizations having organizational characteristics;

aggregating, at the single repository, the received security data based on the organizational characteristics to generate sets of aggregate data associated with the organizational characteristics of the multiple organizations, wherein the receiving and aggregating takes place without communicating any of the security data from the multiple organizations to any other one of the multiple organizations;

receiving a query from an organization of the multiple organizations, the query specifying a particular organizational characteristic and a staleness parameter indicating a time period of desired data;

identifying a set from the sets of aggregate data, the identified set associated with the specified organizational characteristic and falling within the indicated time period of the staleness parameter;

generating a representation of the organization'"'"'s security data in relation to the identified set from the sets of aggregate data, wherein the representation comprises first metrics data associated with the organization'"'"'s security data, and second metrics data associated with security data from the identified set of aggregate data associated with the multiple organizations; and

transmitting the representation to the organization in response to the query; and

a processor for executing the computer program instructions.

17. The computer system of claim 16, wherein an organizational characteristic describes demographic information regarding an organization, and wherein the demographic information comprises one or more elements selected from the group consisting of an industry within which the organization operates, a size of the organization, a number of assets under management by the organization, and a geographic region within which the organization operates.

18. The computer system of claim 16, wherein the representation comprises a first visual component that describes the organization'"'"'s security data and a second visual component that describes the identified set of aggregate data.