Disaster scenario based inferential analysis using feedback for extracting and combining cyber risk information

Patent metadata

Field	Value
Publication number	US-10050990-B2
Application number	US-201615374212-A
Country	US
Kind code	B2
Filing date	Dec 9, 2016
Priority date	Dec 29, 2014
Publication date	Aug 14, 2018
Grant date	Aug 14, 2018

Abstract

Various embodiments of the present technology include methods of assessing risk of a cyber security failure in a computer network of an entity. Some embodiments include generating a disaster scenario that includes elements of a disaster event, modeling the disaster scenario against a profile of the computer network and the entity, determining theoretical damage based on the modeling, and updating a cyber security policy or a network change to mitigate the theoretical damage.

First claim

What is claimed is:

1. A method, comprising:
assessing risk of an entity, using a computer agent configured to collect information from at least publicly accessible Internet elements, wherein the assessing of risk comprises:
generating a disaster scenario that comprises elements of a disaster event;
modeling the disaster scenario against a profile of the entity; and
determining theoretical damage based on the modeling;

automatically recommending, based on the assessed risk, changes to reduce the assessed risk to mitigate the theoretical damage; and
automatically determining, based on the assessed risk, a change or a setting to at least one element of policy criteria, wherein the risk of the entity comprises the risk of a cyber security failure in a computer network of the entity, and wherein the profile of the entity comprises the profile of the computer network of the entity.

2. The method according to claim 1 , further comprising:
determining that the entity has enacted at least a portion of the automatically recommended changes, and in response, automatically reassessing the risk of the entity; and
dynamically re-determining, based on the reassessed risk, the change or the setting to the at least one element of policy criteria.

3. The method according to claim 1 , further comprising wherein the profile of the entity comprises the profile of the computer network of the entity; wherein the policy criteria comprises the policy criteria for a cyber security policy; and wherein the changes automatically recommended comprise computer network changes.

4. The method according to claim 2 , wherein the automatically recommended changes comprise recommended computer network changes; wherein the risk of the entity comprises the risk of a cyber security failure in a computer network of the entity; and wherein the policy criteria comprises the policy criteria for a cyber security policy.

5. The method according to claim 4 , wherein outcome data of the modeling is incorporated into the automatically reassessing of the risk of a cyber security failure in the computer network.

6. The method according to claim 4 , further comprising generating recommended suggestions for the computer network relative to the disaster scenario and based on the collected information obtained for the computer network and the entity.

7. The method according to claim 1 , further comprising generating optimized or improved disaster scenarios based on outcomes of disaster scenario modeling of a plurality of computer networks.

8. The method according to claim 1 , further comprising:
providing a user interface for receiving selections from an end use of disaster events from a plurality of disaster events; and
based on the selections, generating an updated disaster scenario.

9. The method according to claim 8 , wherein the selections are inputs for machine learning and generating the updated disaster scenario is based, at least in part, on the machine learning.

10. The method according to claim 4 , wherein the cyber security failure comprises a cyber attack.

11. The method according to claim 4 , wherein the cyber security failure comprises a privacy incident involving sensitive information.

12. The method according to claim 3 , wherein the computer agent is further configured to perform at least one of collecting information from the computer network of the entity, and analyzing information from the computer network of the entity.

13. The method according to claim 4 , wherein the cyber security policy is at least one of:
a cyber security policy from another entity; and
a product warranty for first and/or third party costs that the entity purchases from at least one of a networking, security product, and services provider.

14. A method, comprising:
assessing risk of a cyber security failure in a computer network of an entity, using a computer agent configured to collect information from at least publicly accessible Internet elements, wherein the assessing of risk comprises:
generating a disaster scenario that comprises elements of a disaster event;
modeling the disaster scenario against a profile of the computer network and the entity;
determining theoretical damage based on the modeling; and
updating a cyber security policy or a network change to mitigate the theoretical damage; and

automatically determining, based on the assessed risk, a change or a setting to at least one element of policy criteria, wherein the risk of the entity comprises the risk of a cyber security failure in a computer network of the entity, and wherein the profile of the entity comprises the profile of the computer network of the entity.

15. The method according to claim 14 , wherein outcome data of the modeling is incorporated into re-determining of the risk of a cyber security failure in the computer network.

16. The method according to claim 14 , wherein the disaster scenario is generated based on inputs from an end user and the elements are used as a portion of the collected information used in the risk assessment.

17. The method according to claim 14 , further comprising generating recommended suggestions for the computer network relative to the disaster scenario and based on the collected information obtained for the computer network and the entity.

18. The method according to claim 14 , further comprising generating optimized or improved disaster scenarios based on outcomes of disaster scenario modeling of a plurality of computer networks.

19. The method according to claim 14 , further comprising:
providing a user interface for receiving selections of disaster events from a plurality of disaster events; and
based on the selections, generating an updated disaster scenario.

20. The method according to claim 19 , wherein the selections are inputs for machine learning and generating the updated disaster scenario is based, at least in part, on the machine learning.

21. A system, comprising:
a processor; and
a memory communicatively coupled with the processor, the memory storing instructions, which when executed by the processor, perform a method comprising:
assessing risk of a cyber security failure in a computer network of an entity, using a computer agent configured to collect information from at least publicly accessible Internet elements, wherein the assessing of risk comprises:
evaluating the collected information to obtain circumstantial or indirect information regarding the entity, the circumstantial or indirect information having an impact on the risk but the circumstantial or indirect information not specifically referencing the entity;
cross referencing data in the collected information to confirm or infer that the entity is referenced in the circumstantial or indirect information that is indicative of the entity being referenced in the circumstantial or indirect information; and
at least one of increasing and decreasing the assessed risk if the circumstantial or indirect information is negative or positive;

automatically determining, based on the assessed risk, a change or a setting to at least one element of policy criteria of a cyber security policy;
automatically recommending, based on the assessed risk, computer network changes to reduce the assessed risk;
providing one or more recommended computer network changes to reduce the assessed risk, enactment by the entity of at least one of the one or more recommended computer network changes to reduce the assessed risk to the entity;
in response to determining that

Assignees

• Guidewire Software Inc

Inventors

• Ng George Y
• Beier Frank
• Giulieri Olivier
• Yamamoto Yoshifumi
• Cheung Zheng

Classifications

• G06Q40/06

  Asset management; Financial planning or analysis · CPC title

• H04L69/40

  for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title