Disaster scenario based inferential analysis using feedback for extracting and combining cyber risk information

• US 10,498,759 B2
• Filed: 05/04/2018
• Issued: 12/03/2019
• Est. Priority Date: 12/29/2014
• Status: Active Grant

• Current Assignee: Guidewire Software Incorporated
• Original Assignee: Guidewire Software Incorporated
• Inventors: Ng, George Y., Beier, Frank, Giulieri, Olivier, Yamamoto, Yoshifumi, Cheung, Zheng
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US15/972,027
• Publication Number:
  US 20180359276A1
• Time in Patent Office: 578 Days
• CPC Class Codes: G06Q 40/06 Asset management; Financial planning or analysis
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

Various embodiments of the present technology include methods of assessing risk of a cyber security failure in a computer network of an entity. Some embodiments include generating a disaster scenario that includes elements of a disaster event, modeling the disaster scenario against a profile of the computer network and the entity, determining theoretical damage based on the modeling, and updating a cyber security policy or a network change to mitigate the theoretical damage.

Claims

1. A method, comprising:

assessing risk of an entity, using a computer agent configured to collect information from at least publicly accessible Internet elements, wherein the assessing of risk comprises;

generating a disaster scenario that comprises elements of a disaster event;

modeling the disaster scenario against a profile of the entity; and

determining theoretical damage based at least in part on the modeling;

automatically recommending, based at least in part on the assessed risk, changes to reduce the assessed risk to mitigate the theoretical damage;

providing a user interface for receiving from an end user selections of disaster events from a plurality of disaster events; and

based at least in part on the selections, generating an updated disaster scenario;

wherein the selections are inputs for machine learning and generating the updated disaster scenario is based, at least in part, on the machine learning.

2. The method of claim 1, wherein the assessed risk comprises a cyber security failure risk in a computer network of the entity, and the changes include one or more of:

an update to a cyber security policy, a setting to the cyber security policy, a network change, and/or a network setting.

3. The method of claim 1, further comprising:

determining that the entity has enacted at least a portion of the automatically recommended changes, and in response, automatically reassessing the risk of the entity; and

dynamically re-determining, based at least in part on the reassessed risk, an update, a setting, or both to a cyber security policy.

4. The method of claim 3, wherein outcome data of the modeling is incorporated into the reassessed the risk of the entity.

5. The method of claim 2, further comprising generating recommended suggestions for the computer network relative to the disaster scenario and based at least in part on the collected information obtained for the computer network and the entity.

6. The method of claim 1, further comprising generating optimized or improved disaster scenarios based at least in part on outcomes of disaster scenario modeling of a plurality of computer networks.

7. The method of claim 2, wherein the cyber security failure comprises a cyber attack, a privacy incident involving sensitive information, or both.

8. The method of claim 2, wherein the cyber security policy includes:

a cyber security policy from another entity;

a product warranty for first and/or third party costs that the entity purchases from at least one of a networking, security product, and services provider;

or

both.

9. The method of claim 1, wherein the computer agent is further configured to perform:

collecting information from a computer network of the entity, analyzing information from the computer network of the entity, or both.

10. A system, comprising:

one or more processors configured to;

assess risk of an entity, using a computer agent configured to collect information from at least publicly accessible Internet elements, wherein to assess the risk comprises to;

generate a disaster scenario that comprises elements of a disaster event;

model the disaster scenario against a profile of the entity; and

determine theoretical damage based at least in part on the modeling of the disaster scenario;

automatically recommend, based at least in part on the assessed risk, changes to reduce the assessed risk to mitigate the theoretical damage; and

provide a user interface for receiving from an end user selections of disaster events from a plurality of disaster events; and

based at least in part on the selections, generating an updated disaster scenario;

wherein the selections are inputs for machine learning and generating the updated disaster scenario is based, at least in part, on the machine learning; and

one or more memories coupled to the one or more processors, configured to provide the one or more processors with instructions.

11. The system of claim 10, wherein the assessed risk comprises a cyber security failure risk in a computer network of the entity, and the changes include one or more of:

an update to a cyber security policy, a setting to the cyber security policy, a network change, and/or a network setting.

12. The system of claim 10, wherein the one or more processors are further configured to:

determine that the entity has enacted at least a portion of the automatically recommended changes, and in response, automatically reassessing the risk of the entity; and

dynamically re-determine, based at least in part on the reassessed risk, an update, a setting, or both to a cyber security policy.

13. The system of claim 12, wherein outcome data of the modeling is incorporated into the reassessed the risk of the entity.

14. The system of claim 11, wherein the one or more processors are further configured to generate recommended suggestions for the computer network relative to the disaster scenario and based at least in part on the collected information obtained for the computer network and the entity.

15. The system of claim 10, wherein the one or more processors are further configured to generate optimized or improved disaster scenarios based at least in part on outcomes of disaster scenario modeling of a plurality of computer networks.

16. The system of claim 11, wherein the cyber security failure comprises a cyber attack, a privacy incident involving sensitive information, or both.

17. The system of claim 11, wherein the cyber security policy includes:

a cyber security policy from another entity;

a product warranty for first and/or third party costs that the entity purchases from at least one of a networking, security product, and services provider;

or

both.

18. The system of claim 10, wherein the computer agent is further configured to perform:

collecting information from a computer network of the entity, analyzing information from the computer network of the entity, or both.

19. A computer program product embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

assessing risk of an entity, using a computer agent configured to collect information from at least publicly accessible Internet elements, wherein the assessing of risk comprises;

generating a disaster scenario that comprises elements of a disaster event;

modeling the disaster scenario against a profile of the entity; and

determining theoretical damage based at least in part on the modeling;

automatically recommending, based at least in part on the assessed risk, changes to reduce the assessed risk to mitigate the theoretical damage;

providing a user interface for receiving from an end user selections of disaster events from a plurality of disaster events; and

based at least in part on the selections, generating an updated disaster scenario;

wherein

the selections are inputs for machine learning and generating the updated disaster scenario is based, at least in part, on the machine learning.