Method for evaluating system risk

• US 20080082380A1
• Filed: 05/19/2007
• Published: 04/03/2008
• Est. Priority Date: 05/19/2006
• Status: Active Grant

• Current Assignee: Peter Stephenson
• Original Assignee: Peter Stephenson
• Inventors: Stephenson, Peter
• Granted Patent: US 8,539,586 B2
• Time in Patent Office: Days
• US Class Current: 705/7
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling

Abstract

A method for evaluating a system having at least one portal is provided, wherein the method includes examining the at least one portal to identify at least one accessible portal, performing a qualitative analysis responsive to the at least one accessible portal, performing a quantitative analysis responsive to the qualitative analysis and generating a risk profile responsive to the performing a qualitative analysis and the performing a quantitative analysis.

Claims

1. A method for evaluating a system having at least one portal, the method comprising:

examining the at least one portal to identify at least one accessible portal;

performing a qualitative analysis responsive to said at least one accessible portal;

performing a quantitative analysis responsive to said qualitative analysis; and

generating a risk profile responsive to said performing a qualitative analysis and said performing a quantitative analysis.

2. The method of claim 1, wherein said performing a qualitative analysis includes,

identifying potential threats against the system;

and

identifying qualitative risks to the system.

3. The method of claim 2, wherein said identifying potential threats against the system includes performing an inter-domain communications analysis, wherein said inter-domain communications analysis includes,

defining a suitable set of criteria for the system;

and

analyzing said criteria to generate a security policy domain.

4. The method of claim 3, wherein said security policy domain includes at least a portion of the elements of the system, wherein each of said at least a portion of the elements are subject to the same security policy.

5. The method of claim 2, wherein said identifying qualitative risks to the system includes,

obtaining system data responsive to threats to the system at a policy domain level, vulnerabilities to the system at said policy domain level and the impact of said threats and said vulnerabilities on the system;

and

generating at least one scoped ontology individual by processing said system data responsive to at least one predetermined ontology, wherein said at least one scoped ontology individual is responsive to at least one possible risk to the system.

6. The method of claim 5, wherein said identifying qualitative risks to the system includes performing a first order risk analysis on said at least one scoped ontology individual.

7. The method of claim 6, wherein said first order risk analysis is responsive to the relationship,

(T·

Vi),

where V is the vulnerability of at least one element in the system, T is the threat to said at least one element in the system and i is the impact on the system.

8. The method of claim 7, wherein the result of said first order risk analysis is either true or false.

9. The method of claim 7, wherein if said result is false, the method includes,

determining that no risk to the system is present;

and

terminating the system evaluation.

10. The method of claim 1, wherein said quantitative analysis includes,

generating a risk probability for said at least one accessible portal;

generating a total risk probability for the system; and

generating a financial representation of the risk exposure of the system.

11. The method of claim 10, wherein said generating a risk probability for said at least one accessible portal includes,

obtaining attack data responsive to the system;

identifying attack data for each of said at least one accessible portal; and

determining a weighted risk probability for each of said at least one accessible portal.

12. The method of claim 11, wherein said generating a total risk probability for the system includes,

aggregating said weighted risk probability for each of said at least one accessible portal to generate an aggregated risk probability.

13. The method of claim 10, wherein said generating a financial representation of the risk exposure of the system includes,

determining a risk exposure factor using an aggregated risk probability.

14. The method of claim 13, wherein said generating a financial representation of the risk exposure of the system further includes,

determining a risk exposure factor using a predetermined set of variables responsive to the system.

15. The method of claim 1, wherein said performing a quantitative analysis responsive to said qualitative analysis includes,

generating a risk exposure factor responsive to the relationship,

R_e=f_q(V_a),

wherein R_e is said risk exposure factor, V_a is an Attack Value Factor and f_q is a quantitative analysis factor which is responsive to the financial baseline data of the system.

16. A method for evaluating a system having at least one portal, the method comprising:

examining the at least one portal to identify at least one accessible portal;

analyzing the system responsive to the relationship given by;

R=P(T·

Vi),

wherein R is risk, V is vulnerability, T is threat, P is probability and i is the impact on the system; and

generating a risk profile responsive to said analyzing the system.

17. The method of claim 16, wherein analyzing the system includes performing a qualitative analysis responsive to said at least one accessible portal, said qualitative analysis including identifying potential threats against the system comprising,

defining a suitable set of criteria for the system;

and

analyzing said criteria to generate a security policy domain, wherein said security policy domain includes at least a portion of the elements of the system, wherein each of said at least a portion of the elements are subject to the same security policy.

18. The method of claim 16, wherein analyzing the system includes performing a qualitative analysis responsive to said at least one accessible portal, said qualitative analysis including identifying qualitative risks to the system comprising,

obtaining system data responsive to threats to the system at a policy domain level, vulnerabilities to the system at said policy domain level and the impact of said threats and said vulnerabilities on the system;

generating at least one scoped ontology individual by processing said system data responsive to at least one predetermined ontology, wherein said at least one scoped ontology individual is responsive to at least one possible risk to the system; and

performing a first order risk analysis on said at least one scoped ontology individual, said first order risk analysis being responsive to the relationship,

(T·

Vi),

where V is the vulnerability of at least one element in the system, T is the threat to said at least one element in the system and i is the impact on the system.

19. The method of claim 16, wherein analyzing the system includes, performing a quantitative analysis, said quantitative analysis including,

generating a risk probability for said at least one accessible portal,

generating a total risk probability for the system;

and

generating a financial representation of the risk exposure of the system,

wherein said generating a risk probability for said at least one accessible portal includes,

obtaining attack data responsive to the system;

identifying attack data for each of said at least one accessible portal; and

determining a weighted risk probability for each of said at least one accessible portal.

20. The method of claim 19, wherein said generating a total risk probability for the system includes,

aggregating said weighted risk probability for each of said at least one accessible portal to generate an aggregated risk probability.