Optimizing risk-based compliance of an information technology (IT) system

Patent metadata

Field	Value
Publication number	US-9456004-B2
Application number	US-201414297061-A
Country	US
Kind code	B2
Filing date	Jun 5, 2014
Priority date	Jun 6, 2013
Publication date	Sep 27, 2016
Grant date	Sep 27, 2016

Abstract

For each of a plurality of endpoints of an information technology system having a plurality of security policies, a probability of being safe of each of said endpoints is determined according to each of said security policies. Said determining takes into account probability of security compromise for a single violation of each given one of said security policies. A risk-aware compliance metric is determined for said information technology system based on each of said probabilities of being safe for each of said endpoints and each of said policies. At least one of an operation and a remediation is carried out on said information technology system based on said risk-aware compliance metric. Techniques for optimizing risk-aware compliance are also provided.

First claim

What is claimed is:

1. A method comprising the steps of:
determining, for each of a plurality of endpoints of an information technology system having a plurality of security policies, probability of being safe of each of said endpoints according to each of said security policies, wherein said determining takes into account probability of security compromise for a single violation of each given one of said security policies;
determining a risk-aware compliance metric for said information technology system based on each of said probabilities of being safe for each of said endpoints and each of said policies; and
carrying out at least one of an operation and a remediation on said information technology system based on said risk-aware compliance metric.

2. The method of claim 1 , wherein said carrying out said at least one of an operation and a remediation on said information technology system based on said risk-aware compliance metric comprises determining a remediation plan for said information technology system by maximizing said risk-aware compliance metric while minimizing remediation costs, subject to at least one of resource constraints and time constraints.

3. The method of claim 2 , wherein said carrying out said at least one of an operation and a remediation on said information technology system based on said risk-aware compliance metric further comprises remediating said information technology system in accordance with said remediation plan.

4. The method of claim 2 , wherein said carrying out said at least one of an operation and a remediation on said information technology system based on said risk-aware compliance metric further comprises providing said remediation plan to an operator of said information technology system.

5. The method of claim 1 , wherein, in said step of determining said probability of being safe, said determining further takes into account probability of security compromise for a single violation of each given one of said security policies as a function of duration of said single violation.

6. The method of claim 5 , further comprising periodically repeating said steps of determining said probability of being safe of each of said endpoints and determining said risk-aware compliance metric, wherein said carrying out said at least one of an operation and a remediation on said information technology system based on said risk-aware compliance metric comprises issuing an alert if said risk-aware compliance metric for said information technology system falls below a predetermined value.

7. The method of claim 5 , further comprising periodically repeating said steps of determining said probability of being safe of each of said endpoints and determining said risk-aware compliance metric, wherein said carrying out said at least one of an operation and a remediation on said information technology system based on said risk-aware compliance metric comprises issuing an alert if said risk-aware compliance metric for said information technology system varies over time.

8. The method of claim 5 , further comprising periodically repeating said steps of determining said probability of being safe of each of said endpoints and determining said risk-aware compliance metric, wherein said carrying out said at least one of an operation and a remediation on said information technology system based on said risk-aware compliance metric comprises observing patterns of change in said risk-aware compliance metric to gain insight into operation of said information technology system, the patterns of change are based on correlating a policy introduction to a change in the risk-aware compliance metric, wherein the policy introduction e after a password change after a specific time period has passed.

9. The method of claim 5 , further comprising:
periodically repeating said steps of determining said probability of being safe of each of said endpoints and determining said risk-aware compliance metric; and
adjusting a frequency at which said steps of determining said probability of being safe of each of said endpoints and determining said risk-aware compliance metric are repeated, to implement at least one of:
observing high-risk policies with greater frequency and mitigating computation cost.

10. The method of claim 1 , wherein determining said risk-aware compliance metric for said information technology system based on each of said probabilities of being safe for each of said endpoints and each of said policies comprises determining said risk-aware compliance metric for said information technology system as a product of each of said probabilities of being safe for each of said endpoints and each of said policies.

11. The method of claim 1 , wherein:
said step of determining said probability of being safe of each of said endpoints according each of said security policies is carried out with a policy compliance scanner module, embodied on a non-transitory computer-readable storage medium, and obtaining as input risk per policy, executing on at least one hardware processor; and
said step of determining said risk-aware compliance metric for said information technology system is carried out with a compliance metrics model module, embodied on said non-transitory computer-readable storage medium, executing on said at least one hardware processor.

12. A method comprising the steps of:
determining a compliance metric as a function of a candidate set of remediations to be performed on an information technology system;
determining a total cost of remediation as a function of said candidate set of said remediations to be performed on said information technology system;
forming an objective function based on said compliance metric and said total cost; and
determining an optimal set of said remediations to be performed on said information technology system, based on said objective function, subject to resource and time constraints.

13. The method of claim 12 , wherein said determining of said total cost comprises taking into account cost of human operators carrying out remediation and costs of system resources needed for carrying out remediation.

14. The method of claim 13 , further comprising remediating said information technology system in accordance with said optimal set of said remediations.

15. The method of claim 12 , wherein:
said step of determining said compliance metric as said function of said candidate set of said remediations to be performed on said information technology system is carried out with an optimization engine module, embodied on a non-transitory computer- readable storage medium, based on input from a compliance metrics model, and executing on at least one hardware processor;
said step of determining said total cost of remediation as said function of said candidate set of said remediations to be performed on said information technology system is carried out with said optimization engine module, embodied on said non-transitory computer-readable storage medium, obtaining as input a cost model, and executing on said at least one hardware processor;
said step of forming said objective function based on said compliance metric and said total cost is carried out with said optimization engine module, embodied on said non-transitory computer-readable storage medium, and executing on said at least one hardware processor; and
said step of determining said optimal set of said remediations to be performed on said information technology system, based on said objective function, subject to said operational constraints, is carried out with said optimization engine module, embodied on said non-transitory computer-readabl

Assignees

• Globalfoundries Inc

Inventors

• Agrawal Bhavna
• Coffman Daniel M
• Schaffa Frank A
• Delmonico Robert M

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title