Inferential Analysis Using Feedback for Extracting and Combining Cyber Risk Information Including Proxy Connection Analyses

• US 20170093904A1
• Filed: 12/08/2016
• Published: 03/30/2017
• Est. Priority Date: 12/29/2014
• Status: Active Grant

• Current Assignee: Cyence LLC. (Guidewire Software Incorporated)
• Original Assignee: Cyence Inc. (Guidewire Software Incorporated)
• Inventors: Ma, Don, Ooi, Yuen Tsing, Ng, George Y., Zhang, Feiyin, Tancioco, Fernando Jr.
• Granted Patent: US 10,050,989 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 40/06 Asset management; Financial planning or analysis
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Various embodiments of the present technology include methods of assessing risk of a cyber security failure in one or more computer networks for an entity. Various embodiments include establishing a plurality of proxy connections with entity resources, evaluating performance of the proxy connections, and scoring the proxy connections based on performance. Various embodiments may further include automatically determining, based on the proxy score, a change or setting regarding the proxy connections. Various embodiments may also include automatically recommending, based on the assessed risk, computer network changes for the one or more computer networks to reduce the assessed risk. Some embodiments may include providing recommended computer network and/or policy changes to reduce the assessed risk, determining the entity has enacted some recommended network changes, and in response, automatically reassessing the risk of a cyber security failure based on the enacted recommended computer network changes.

Claims

1. A method, comprising:

assessing risk of a cyber security failure in one or more computer networks for an entity, by collecting information from at least one accessible network element by;

establishing a plurality of proxy connections with entity resources of the entity;

evaluating performance of the plurality of proxy connections; and

scoring the proxy connections based on their performance;

automatically determining, based on the proxy score, a change or a setting regarding the proxy connections; and

automatically recommending, based on the assessed risk, computer network changes for the one or more computer networks to reduce the assessed risk.

2. The method according to claim 1, wherein establishing the plurality of proxy connections with entity resources of the entity further comprises establishing the proxy connections with the entity resources in a randomized manner, wherein the proxy connections are established at different times of a day and different days in a week.

3. The method according to claim 2, further comprising evaluating the plurality of proxy connections for connection quality.

4. The method according to claim 3, wherein the proxy connections are established between the entity resources and a proxy endpoint, wherein the proxy endpoint is located in various locations.

5. The method according to claim 4, wherein the proxy connections are randomly established and terminated to create ephemeral proxy data that is indicative of performance of the proxy connections.

6. The method according to claim 5, further comprising randomly rotating through the plurality of proxy connections.

7. The method according to claim 1, wherein the performance of the proxy connections comprise proxy connection availability and proxy connection reliability.

8. The method according to claim 1, wherein each of the plurality of proxy connections comprises unique characteristics that allow for testing proxy capabilities of a resource and its response to proxy connections of varying characteristics.

9. The method of claim 1, further comprising:

evaluating the collected information to obtain circumstantial or indirect information that is indicative of the entity;

cross referencing data in the collected information to confirm or infer that the entity is referenced in the circumstantial or indirect information that is indicative of the entity being referenced in the circumstantial or indirect information;

automatically determining a change or a setting to at least one element of policy criteria of a cyber security policy;

automatically recommending computer network changes to reduce the assessed risk;

providing one or more recommended computer network changes to reduce the assessed risk, enactment by the entity of at least one of the one or more of the recommended computer network changes to reduce the assessed risk to the entity;

determining that the entity has enacted at least a portion of the recommended computer network changes, and in response, automatically reassessing the risk of a cyber security failure in the computer network of the entity based on the enacted recommended computer network changes; and

dynamically re-determining, based on the reassessed risk of a cyber security failure in the computer network of the entity, the change or the setting to the at least one element of policy criteria of the cyber security policy.

10. The method of claim 1, wherein the cyber security failure comprises a cyber attack.

11. The method of claim 1, wherein the cyber security failure comprises a privacy incident involving sensitive information.

12. The method of claim 9, wherein the risk is assessed using a computer agent configured to collect information from the at least one accessible network element, the computer agent being further configured to perform at least one of collecting information from the computer network of the entity, and analyzing information from the computer network of the entity.

13. The method of claim 9, further comprising:

based on the assessing of risk of the cyber security failure, plotting one or more features of the entity and other members of a peer group of the entity, the plotting being configured to visually illustrate the risk of a cyber security failure in the computer network of the entity; and

the automatically recommending of computer network changes being based on the plotting.

14. The method of claim 13, further comprising:

in response to the determining that the entity has enacted at least a portion of the recommended computer network changes, initiating the change or the setting to the at least one element of policy criteria of the cyber security policy.

15. The method of claim 13, wherein the assessing of risk further comprises assessing, using a plurality of sophistication elements for the entity, a sophistication for the entity with respect to preventing the cyber security failure, the sophistication being one of a plurality of features of the entity.

16. The method of claim 1, wherein the assessing of risk further comprises assessing, using a plurality of motivation elements regarding the entity, a motivation of an actor to initiate the cyber security failure, the motivation being one of a plurality of features of the entity.

17. The method of claim 1, wherein the assessing of risk further comprises:

assessing, using a plurality of sophistication elements for the entity, a sophistication for the entity with respect to preventing the cyber security failure, the sophistication being one of a plurality of features of the entity; and

assessing, using a plurality of motivation elements regarding the entity, a motivation of an actor to initiate the cyber security failure, the motivation being another one of the plurality of features of the entity.

18. The method of claim 17, further comprising calculating a composite score from a motivation score and a sophistication score, the motivation score representing the plurality of motivation elements, the sophistication score representing the plurality of sophistication elements.

19. The method of claim 18, further comprising:

creating an aggregate risk score of a portfolio of entities based on a plurality of motivation scores including the motivation score and a plurality of sophistication scores including the sophistication score; and

benchmarking over time at least one of the sophistication score, the motivation score, the composite score, and the aggregate risk score.

20. The method of claim 9, further comprising at least one of increasing and decreasing the assessed risk if the circumstantial or indirect information is negative or positive.

21. A method, comprising:

assessing risk of a cyber security failure in one or more computer networks for an entity, using a computer agent configured to collect information from at least one accessible network element, wherein the assessing of risk comprises;

evaluating the collected information to obtain circumstantial or indirect information that is indicative of the entity;

cross referencing data in the collected information to confirm or infer that the entity is referenced in the circumstantial or indirect information that is indicative of the entity being referenced in the circumstantial or indirect information;

establishing a plurality of proxy connections with entity resources of the entity;

evaluating performance of the plurality of proxy connections;

scoring the proxy connections based on their performance; and

automatically determining proxy connection changes based on the scoring;

automatically determining, based on the assessed risk, a change or a setting to at least one element of policy criteria of a cyber security policy; and

automatically recommending, based on the assessed risk, computer network changes to reduce the assessed risk.

22. The method of claim 21, further comprising

providing one or more recommended computer network changes to reduce the assessed risk, enactment by the entity of at least one of the one or more of the recommended computer network changes to reduce the assessed risk to the entity;

determining that the entity has enacted at least a portion of the recommended computer network changes, and in response, automatically reassessing the risk of a cyber security failure in the computer network of the entity based on the enacted recommended computer network changes; and

dynamically re-determining, based on the reassessed risk of a cyber security failure in the computer network of the entity, the change or the setting to the at least one element of policy criteria of the cyber security policy.

23. The method of claim 21, wherein the assessing of risk further comprises at least one of increasing and decreasing the assessed risk if the circumstantial or indirect information is negative or positive.