Model framework and system for cyber security services

Patent metadata

Field	Value
Publication number	US-2017302668-A1
Application number	US-201615099654-A
Country	US
Kind code	A1
Filing date	Apr 15, 2016
Priority date	Apr 15, 2016
Publication date	Oct 19, 2017
Grant date	—

Abstract

Systems, computer program products, and methods are described herein for a model framework and system for cyber security services. The present invention is configured to determine one or more access paths to the internal computing device from an external computing device; determine one or more controls associated with each access path; determine one or more types of access that may be made via one or more of the access paths by the external computing device to access the internal computing device; determine whether the one or more controls associated with the at least one of the one or more access paths is capable of detecting the access; determine one or more tools configured to regulate the one or more controls; and incorporate the one or more tools within the network to regulate the one or more controls to detect and monitor the access.

First claim

What is claimed is:

1 . A model framework and system for cyber security services, the system comprising:
at least one non-transitory storage device; at least one processor; and at least one module stored in said storage device and comprising instruction code that is executable by the at least one processor and configured to cause said at least one processor to:
electronically receive, via a distributed network of servers, information associated with an internal computing device within a network;
determine one or more access paths to the internal computing device from an external computing device;
determine one or more controls associated with each of the one or more access paths associated with the internal computing device, wherein the one or more controls are configured to determine access to the internal computing device;
determine one or more types of access that may be made via one or more of the access paths by the external computing device to access the internal computing device;
determine whether the one or more controls associated with the at least one of the one or more access paths is capable of detecting the access by the external computing device via at least one of the one or more types of access;
determine one or more tools configured to regulate the one or more controls to monitor the accessing of the internal computing device, wherein the one or more tools comprises one or more capabilities to facilitate the regulation of the one or more controls to detect and prohibit access to the internal computing device via at least one of the one or more types of access; and
incorporate the one or more tools within the network to regulate the one or more controls to detect and monitor the accessing of the internal computing device by the external computing device via at least one of the one or more types of access.

2 . The system of claim 1 , wherein the module is further configured to cause the at least one processor to:
determine that the one or more controls associated with at least one of the one or more access paths is not capable of detecting the access by the external computing device via at least one of the one or more types of access, wherein determining further comprises determining that the one or more controls is not capable of regulating one or more conditions associated with the one or more types of access.

3 . The system of claim 2 , wherein the module is further configured to cause the at least one processor to:
determine one or more capabilities associated with the one or more types of access, the one or more types of access incapable of being regulated by the one or more controls; identify one or more tools based on at least the one or more determined capabilities, wherein the one or more identified tools facilitate the regulation of the one or more controls to detect and prohibit access to the internal computing device via at least one of the one or more types of access; and incorporate the one or more identified tools within the network to regulate the one or more controls to detect and monitor the accessing of the internal computing device by the external computing device via at least one of the one or more types of access previously not capable of detecting the access.

4 . The system of claim 1 , wherein the module is further configured to cause the at least one processor to:
determine that access to the internal computing device by the external computing device via at least one of the one or more types of access causes a loss event; determine a probability score associated with the loss event, wherein the probability score indicates the chances of occurrence of the loss event; determine a magnitude of impact score associated with the loss event, wherein the magnitude of impact score indicates a consequence of the loss event; and determine an exposure score associated with the loss event based on at least the probability score and the magnitude of impact score.

5 . The system of claim 4 , wherein the one or more controls are configured to be regulated to detect and prohibit access to the internal computing device via at least one of the one or more types of access, thereby reducing the exposure score associated with the loss event.

6 . The system of claim 4 , wherein the module is further configured to cause the at least one processor to:
determine that the exposure score associated with the loss event is greater than a predetermined threshold; determine one or more capabilities associated with the one or more types of access, the one or more types of access incapable of being regulated by the one or more controls; identify one or more tools based on at least the one or more determined capabilities, wherein the one or more identified tools facilitate the regulation of the one or more controls to detect and prohibit access to the internal computing device by the external computing device; and incorporate the one or more identified tools within the network to regulate the one or more controls to detect and prohibit access to the internal computing device by the external computing device, wherein the incorporation of the one or more identified tools results in the exposure score associated with the loss event to be lower than the predetermined threshold.

7 . The system of claim 1 , wherein the module is further configured to cause the at least one processor to:
determine that a first tool identified to facilitate the regulation of the one or more controls comprises one or more capabilities that overlap with the capabilities of a second tool also identified to facilitate the regulation of the one or more controls, wherein the first tool and the second tool associated with the one or more tools identified; initiate a presentation of a user interface to enable a user to select the first tool or the second tool for the one or more overlapped capabilities; receive a user input comprising the selection of the first tool and/or the second tool for the one or more overlapped capabilities; and incorporate the first tool and the second tool within the network to regulate the one or more controls to detect and prohibit access to the internal computing device by the external computing device.

8 . A computerized method for a model framework and system for cyber security services, the method comprising:
electronically receiving, via a distributed network of servers, information associated with an internal computing device within a network; determining, using a computing device processor, one or more access paths to the internal computing device from an external computing device; determining, using a computing device processor, one or more controls associated with each of the one or more access paths associated with the internal computing device, wherein the one or more controls are configured to determine access to the internal computing device; determining, using a computing device processor, one or more types of access that may be made via one or more of the access paths by the external computing device to access the internal computing device; determining, using a computing device processor, whether the one or more controls associated with the at least one of the one or more access paths is capable of detecting the access by the external computing device via at least one of the one or more types of access; determining, using a computing device processor, one or more tools configured to regulate the one or more controls to monitor the accessing of the internal computing device, wherein the one or more tools comprises one or more capabilities to facilitate the regulation of the one or more controls to detect and prohibit access to the internal computing device via at least one of the one or more

Assignees

• Bank Of America

Inventors

• Kling John Howard
• Brubaker Mark Earl
• Quon Cora Yan
• Bierner Rachel Yun Kim
• Moloian Armen
• Kuhlmeier Ronald James

Classifications

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title