Disaster scenario based inferential analysis using feedback for extracting and combining cyber risk information

• US 10,050,990 B2
• Filed: 12/09/2016
• Issued: 08/14/2018
• Est. Priority Date: 12/29/2014
• Status: Active Grant

• Current Assignee: Cyence LLC. (Guidewire Software Incorporated)
• Original Assignee: Guidewire Software Incorporated
• Inventors: Ng, George Y., Beier, Frank, Giulieri, Olivier, Yamamoto, Yoshifumi, Cheung, Zheng
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US15/374,212
• Publication Number:
  US 20170093905A1
• Time in Patent Office: 613 Days
• CPC Class Codes: G06Q 40/06 Asset management; Financial planning or analysis
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

Various embodiments of the present technology include methods of assessing risk of a cyber security failure in a computer network of an entity. Some embodiments include generating a disaster scenario that includes elements of a disaster event, modeling the disaster scenario against a profile of the computer network and the entity, determining theoretical damage based on the modeling, and updating a cyber security policy or a network change to mitigate the theoretical damage.

Claims

1. A method, comprising:

assessing risk of an entity, using a computer agent configured to collect information from at least publicly accessible Internet elements, wherein the assessing of risk comprises;

generating a disaster scenario that comprises elements of a disaster event;

modeling the disaster scenario against a profile of the entity; and

determining theoretical damage based on the modeling;

automatically recommending, based on the assessed risk, changes to reduce the assessed risk to mitigate the theoretical damage; and

automatically determining, based on the assessed risk, a change or a setting to at least one element of policy criteria, wherein the risk of the entity comprises the risk of a cyber security failure in a computer network of the entity, and wherein the profile of the entity comprises the profile of the computer network of the entity.

2. The method according to claim 1, further comprising:

determining that the entity has enacted at least a portion of the automatically recommended changes, and in response, automatically reassessing the risk of the entity; and

dynamically re-determining, based on the reassessed risk, the change or the setting to the at least one element of policy criteria.

3. The method according to claim 1, further comprising wherein the profile of the entity comprises the profile of the computer network of the entity;

wherein the policy criteria comprises the policy criteria for a cyber security policy; and

wherein the changes automatically recommended comprise computer network changes.

4. The method according to claim 2, wherein the automatically recommended changes comprise recommended computer network changes;

wherein the risk of the entity comprises the risk of a cyber security failure in a computer network of the entity; and

wherein the policy criteria comprises the policy criteria for a cyber security policy.

5. The method according to claim 4, wherein outcome data of the modeling is incorporated into the automatically reassessing of the risk of a cyber security failure in the computer network.

6. The method according to claim 4, further comprising generating recommended suggestions for the computer network relative to the disaster scenario and based on the collected information obtained for the computer network and the entity.

7. The method according to claim 1, further comprising generating optimized or improved disaster scenarios based on outcomes of disaster scenario modeling of a plurality of computer networks.

8. The method according to claim 1, further comprising:

providing a user interface for receiving selections from an end use of disaster events from a plurality of disaster events; and

based on the selections, generating an updated disaster scenario.

9. The method according to claim 8, wherein the selections are inputs for machine learning and generating the updated disaster scenario is based, at least in part, on the machine learning.

10. The method according to claim 4, wherein the cyber security failure comprises a cyber attack.

11. The method according to claim 4, wherein the cyber security failure comprises a privacy incident involving sensitive information.

12. The method according to claim 3, wherein the computer agent is further configured to perform at least one of collecting information from the computer network of the entity, and analyzing information from the computer network of the entity.

13. The method according to claim 4, wherein the cyber security policy is at least one of:

a cyber security policy from another entity; and

a product warranty for first and/or third party costs that the entity purchases from at least one of a networking, security product, and services provider.

14. A method, comprising:

assessing risk of a cyber security failure in a computer network of an entity, using a computer agent configured to collect information from at least publicly accessible Internet elements, wherein the assessing of risk comprises;

generating a disaster scenario that comprises elements of a disaster event;

modeling the disaster scenario against a profile of the computer network and the entity;

determining theoretical damage based on the modeling; and

updating a cyber security policy or a network change to mitigate the theoretical damage; and

automatically determining, based on the assessed risk, a change or a setting to at least one element of policy criteria, wherein the risk of the entity comprises the risk of a cyber security failure in a computer network of the entity, and wherein the profile of the entity comprises the profile of the computer network of the entity.

15. The method according to claim 14, wherein outcome data of the modeling is incorporated into re-determining of the risk of a cyber security failure in the computer network.

16. The method according to claim 14, wherein the disaster scenario is generated based on inputs from an end user and the elements are used as a portion of the collected information used in the risk assessment.

17. The method according to claim 14, further comprising generating recommended suggestions for the computer network relative to the disaster scenario and based on the collected information obtained for the computer network and the entity.

18. The method according to claim 14, further comprising generating optimized or improved disaster scenarios based on outcomes of disaster scenario modeling of a plurality of computer networks.

19. The method according to claim 14, further comprising:

providing a user interface for receiving selections of disaster events from a plurality of disaster events; and

based on the selections, generating an updated disaster scenario.

20. The method according to claim 19, wherein the selections are inputs for machine learning and generating the updated disaster scenario is based, at least in part, on the machine learning.

21. A system, comprising:

a processor; and

a memory communicatively coupled with the processor, the memory storing instructions, which when executed by the processor, perform a method comprising;

assessing risk of a cyber security failure in a computer network of an entity, using a computer agent configured to collect information from at least publicly accessible Internet elements, wherein the assessing of risk comprises;

evaluating the collected information to obtain circumstantial or indirect information regarding the entity, the circumstantial or indirect information having an impact on the risk but the circumstantial or indirect information not specifically referencing the entity;

cross referencing data in the collected information to confirm or infer that the entity is referenced in the circumstantial or indirect information that is indicative of the entity being referenced in the circumstantial or indirect information; and

at least one of increasing and decreasing the assessed risk if the circumstantial or indirect information is negative or positive;

automatically determining, based on the assessed risk, a change or a setting to at least one element of policy criteria of a cyber security policy;

automatically recommending, based on the assessed risk, computer network changes to reduce the assessed risk;

providing one or more recommended computer network changes to reduce the assessed risk, enactment by the entity of at least one of the one or more recommended computer network changes to reduce the assessed risk to the entity;

in response to determining that the entity has enacted at least a portion of the one or more recommended computer network changes, automatically reassessing the risk of a cyber security failure in the computer network of the entity based on the enacted recommended computer network changes;

dynamically re-determining, based on the reassessed risk of a cyber security failure in the computer network of the entity, the change or the setting to the at least one element of policy criteria of the cyber security policy;

generating a disaster scenario that comprises elements of a disaster event;

modeling the disaster scenario against a profile of the network;

determining theoretical damage based on the modeling; and

updating the cyber security policy or a network change to mitigate the theoretical damage.

22. The system according to claim 21, wherein outcome data of the modeling is incorporated into the automatically reassessing of the risk of a cyber security failure in the computer network.

23. The system according to claim 21, further comprising generating recommended suggestions for the computer network relative to the disaster scenario and based on the collected information obtained for the computer network and the entity.