Anti-tamper process toolset

• US 8,266,518 B2
• Filed: 01/16/2008
• Issued: 09/11/2012
• Est. Priority Date: 01/16/2008
• Status: Active Grant

• Current Assignee: Raytheon Company (Rtx Corporation)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: Di Beneditto, Joseph
• Primary Examiner(s): Hong, Stephen
• Assistant Examiner(s): Vaughn, Gregory J
• Application Number:
  US12/007,904
• Publication Number:
  US 20090183061A1
• Time in Patent Office: 1,700 Days
• Field of Search: 715/212, 715/213, 715/219, 715/255, 715/267
• US Class Current: 715/213
• CPC Class Codes: G06F 21/554 involving event detection and direct action

Abstract

A tool set is provided that uses a series of modules (e.g. spreadsheet workbooks) for assessing risks/threats to and attacks against a project and developing countermeasures against such risks/threats/attacks. The project may cover a wide berth of functionality from alarm systems, computer security, building projects, etc. The roll up feature of the spreadsheet may be employed to evaluate changing scenarios in a short period of time. Ranked threats and countermeasures operable to defeat such threats may be displayed in a tree diagram generated by one or more of the modules.

Claims

1. A programmable computer useable medium having computer readable code embodied in said medium configured to cause a computer to:

process data records comprising information concerning risk, threat vulnerability, impact and security attack;

apply an algorithm to said data records to rate time-factored risks and select appropriate countermeasures and technical implementations therefor against said time-factored risks; and

generate forms in connection with providing a graphical user interface provided by a computer spreadsheet application,

wherein said computer spreadsheet application generates a plurality of workbooks comprising;

a critical program information (CPI) tool workbook configured to identify data records that are determined to be critical assets according to a predefined criteria; and

a work breakdown structure (WBS) critical program information (CPI) workbook configured to provide a plurality of tasks for completion within a project which cross references said tasks with the data records that are determined to be critical assets according to said predefined criteria.

2. A programmable computer useable medium as recited in claim 1 selected from the group consisting of software programming languages.

3. A programmable computer useable medium as recited in claim 1 wherein said plurality of workbooks define interrelationships among data to be entered in said workbooks by said user.

4. A programmable computer useable medium as recited in claim 1 wherein the data records that are determined to be critical assets are automatically assigned an asset identification number by said medium.

5. A programmable computer medium as recited in claim 4 wherein the wherein the plurality of workbooks further comprises an asset identification and valuation workbook is configured to provide automatic roll-up of the critical assets to allow input of descriptive information about each said asset, asset value information and an impact rating for each said asset corresponding to a rating of value should the asset become lost.

6. A programmable computer medium as recited in claim 5 wherein the plurality of workbooks further comprises a threat and vulnerability workbook configured to provide an assessment of susceptibilities of each asset to a threat of a subsystem and to provide an input of a susceptibility rating for each threat to said asset.

7. A programmable computer medium as recited in claim 6 wherein the plurality of workbooks further comprises an attack workbook configured to define one or more attack scenarios against each said asset, said attack workbook is configured to:

store input of data providing a likelihood of success of an attack against an asset; and

provide a rating of success of the attack against said asset, an attack tree being capable of being generated from said attack workbook information.

8. A programmable computer medium as recited in claim 7 wherein the plurality of workbooks further comprises a risk workbook configured to perform an exploitation risk computation wherein a worst case initial rating and a time-factored risk rating is computed for each asset using data from workbooks comprising the CPI Tool workbook, the asset ID and Valuation workbook, the threat and vulnerability workbook, and the attack workbook.

9. A programmable computer medium as recited in claim 8 wherein the plurality of workbooks further comprises a countermeasure workbook configured to determine a worst case risk and a negligible risk for each method of attack against a corresponding asset.

10. A programmable computer medium as recited in claim 9 wherein the plurality of workbooks further comprises a concepts selection workbook attack methods from said countermeasure workbook are provided along with a solution set for each countermeasure.

11. A programmable computer medium as recited in claim 10 wherein an implementation parameters workbook comprises contract requirements for each countermeasure included in said countermeasures workbook and methods used to confirm successful treatment of risks to corresponding assets.

12. A programmable computer medium as recited in claim 11 wherein the plurality of workbooks further comprises a health status workbook comprising status information of sub-systems and overall system progress for evaluating said possible countermeasures against elements of a project.

13. A programmable computer medium as recited in claim 12 wherein the plurality of workbooks further comprises a tool initialization workbook configured to empty a AT toolset database or transfer data from an earlier version of the AT Toolset into a new version.

14. A programmable computer medium as recited in claim 13 wherein the plurality of workbooks further comprises a tool setup workbook configured to place a shortcut on a desktop and in a Windows Start program menu.

15. A programmable computer medium as recited in claim 14 wherein the plurality of workbooks further comprises an implementation flow workbook configured to display a flow diagram describing the functionality and sequence of various AT Toolset components.