Network asset security risk surface assessment apparatus and method

• US 20070006315A1
• Filed: 06/29/2006
• Published: 01/04/2007
• Est. Priority Date: 07/01/2005
• Status: Abandoned Application

• Current Assignee: EEYE Digital Security
• Original Assignee: EEYE Digital Security
• Inventors: Bushnaq, Firas
• Application Number:
  US11/477,270
• Publication Number:
  US 20070006315A1
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

In accordance with at least one embodiment of the present invention, a method of computing a risk surface vector, comprises the operations of gathering raw assessments, forming single assessments, creating asset values, scaling by asset values, calculating higher-level assessment formulas per asset, creating asset-value weighted averages for aggregate groups, and calculating a final high-level risk surface value.

Claims

1. A method of computing a risk surface vector, comprising the operations of:

gathering raw assessments;

forming single assessments;

creating asset values;

scaling by asset values;

calculating higher-level assessment formulas per asset;

creating asset-value weighted averages for aggregate groups; and

calculating a final high-level risk surface value.

2. The method of claim 1, wherein the operation of forming single assessments, comprises:

normalizing the plurality of raw assessments to form normalized raw assessments; and

thresholding the raw normalized raw assessments to form a plurality of single assessments.

3. The method of claim 1, wherein the process of creating asset values includes the process of scaling user asset criticality values.

4. The method of claim 3, wherein the process of creating asset values includes an exponentiation of the user asset criticality values, the exponentiation being at least one of base-3.5, base 3, and base-e.

5. The method of claim 3, wherein criticality is factored into each vector.

6. The method of claim 5, wherein criticality is factored in by scaling a predetermined plurality of raw assessments by a predetermined asset value.

7. A method claim 1, further comprising the operation of displaying the final risk surface value, the operation of displaying the final risk surface value including at least one of:

displaying the final risk surface value on a computer monitor;

printing the final risk surface value on a document; and

recording the final risk surface value on a recordable medium.

8. A risk surface graphical element providing a two-dimensional representation of risk, comprising:

four normalized vectors disposed on two non-parallel lines, each normalized vector defining a risk factor area, a crossing point of the two orthogonal lines defining a zero point for each of the four normalized vectors, a risk factor vector length corresponding to a distance from the zero point so that a non-zero vector length for at least two adjacent vectors describes a risk surface having a risk surface area value.

9. The risk surface graphical element of claim 8, wherein a first normalized vector corresponds to a network asset vulnerabilities (V) area.

10. The risk surface graphical element of claim 8, wherein a second normalized vector corresponds to a network asset attacks (A) area.

11. The risk surface graphical element of claim 8, wherein a third normalized vector corresponds to a network asset exposure (E) area.

12. The risk surface graphical element of claim 8, wherein a fourth normalized vector corresponds to a network asset threat (T) area.

13. The risk surface graphical element of claim 8,

wherein a first normalized vector corresponding to a network asset vulnerabilities (V) area and a fourth normalized vector corresponding to a network asset threat (T) area are oriented in opposite directions on a first line, and

wherein a second normalized vector corresponding to a network asset attacks (A) area and a third normalized vector corresponding to a network asset exposure (E) area are oriented in opposite directions on a second line, the first line being orthogonal to the second line.

14. The risk surface graphical element of claim 8,

wherein a first normalized vector corresponding to a network asset vulnerabilities (V) area and the second normalized vector corresponding to a network asset attacks (A) area are oriented in opposite directions on a first line, and

wherein the third normalized vector corresponding to a network asset exposure (E) area and the fourth normalized vector corresponding to a network asset threat (T) area are oriented in opposite directions on a second line, the first line being orthogonal to the second line.

15. A risk surface tile element providing a two-dimensional representation of risk, comprising:

a risk surface graphical element;

an attribute type icon;

an attribute type field; and

an attribute value.

16. The risk surface tile element of claim 15, wherein the attribute icon includes a representation of a number of assets in the group and an aggregated criticality factor.

17. The risk surface tile element of claim 15, further comprising:

an information button configured to provide access to a detailed data breakdown of one or more risk vectors.

18. A risk assessment system, comprising:

a display device configured to display information to a user; and

a plurality of risk surface tiles reproduced on the display device, each risk surface tile being configured to display a risk assessment for a predetermined network resource at a predetermined time, a computation for each risk surface vector comprising the operations of;

gathering raw assessments;

forming single assessments;

creating asset values;

scaling by asset values;

calculating higher-level assessment formulas per asset;

creating asset-value weighted averages for aggregate groups; and

calculating a final high-level risk surface value.

19. The risk assessment system of claim 18, further comprising:

a computer processor configured to fetch, decode, and execute a computer program including instructions to at least one of compute each risk surface vector comprising the risk surface tile, and display the computed risk surface tile on the display device.

20. A computer readable medium on which is stored a computer program for executing the following instructions:

gathering raw assessments;

forming single assessments;

creating asset values;

scaling by asset values;

calculating higher-level assessment formulas per asset;

creating asset-value weighted averages for aggregate groups; and

calculating a final high-level risk surface value.