Annotation platform for a security risk system

Patent metadata

Field	Value
Publication number	US-9680858-B1
Application number	US-201615134845-A
Country	US
Kind code	B1
Filing date	Apr 21, 2016
Priority date	Sep 9, 2013
Publication date	Jun 13, 2017
Grant date	Jun 13, 2017

Abstract

Among other things, information is acquired and stored that is indicative of security risks associated with security subjects and with entities to which the security subjects belong. The stored information is analyzed by computer to derive security indicators for the entities. With respect to entities selected by the users, security information is presented by computer to users. The security information includes security indicators for the entities and security information for security subjects. The security information for security subjects includes annotations provided by users. The annotations are managed by computer based on communications from the users.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
by a computer, acquiring and storing information indicative of security risks associated with security subjects and with entities to which the security subjects belong,
by the computer, analyzing the stored information to derive security indicators for the entities,
by the computer, presenting security information including the security indicators for the entities and security information for the security subjects, the security information for the security subjects including human-supplied annotations entered via an input device by an individual with specialized knowledge of the security subjects, and
by the computer, managing the annotations based on communications from a user, wherein the annotations comprise tags based at least in part on the individual's specialized knowledge of the security subjects wherein managing the annotations comprises curating, screening, editing, or monitoring the annotations and managing permissions to view or create annotations.

2. The method of claim 1 in which the security subjects comprise IP addresses.

3. The method of claim 2 in which the IP addresses comprise blocks of IP addresses that conform to Classless Inter-Domain Routing.

4. The method of claim 1 in which the entities own, control, or manage the IP addresses that belong to them.

5. The method of claim 1 in which the security subjects comprise domains.

6. The method of claim 5 in which the entities own, control, or manage the domains that belong to them.

7. The method of claim 1 in which the annotations are specified by selection from an existing set of available tags.

8. The method of claim 1 in which the analyzing of the stored information comprises updating a stored entity map between entities and security subjects.

9. The method of claim 1 comprising, by computer, managing permissions of users based on relationships of users to entities to which the annotations relate.

10. The method of claim 1 in which the annotations describe characteristics of the security subjects that comprise at least one of a type, a location, a time period, a relationship with other security subjects, a relationship with an entity, or a combination of any two or more of them.

11. The method of claim 1 in which the annotations comprise groupings of security subjects.

12. The method of claim 11 in which the groupings comprise subnets.

13. The method of claim 1 in which the presenting to the users of the security information comprises managing the presenting based on the user's relationship with one or more of the entities.

14. The method of claim 13 in which at least some of the users are affiliated with corresponding entities and can add, alter, or remove annotations for the corresponding entities, can view public information for other entities, and cannot add, alter, or remove annotations for any other entities.

15. A computer-implemented method comprising:
by a computer, operating an annotation facility that enables an individual with specialized knowledge of security subjects via an input device in real-time to manually add, alter, or remove annotations indicative of security risks associated with respective security subjects or entities to which the technology assets belong, and
by the computer and through a communication network, presenting to a user information about security risks associated with security subjects and with entities to which the security subjects belong, the information about the security risks including the annotations,
the presenting of the information to the user including at least one of visually associating the annotations with the respective security subjects or entities, allowing the user to filter information that is being presented based on the annotations, and allowing authorized users to add, alter, or remove annotations in the annotation facility, wherein the annotations comprise tags based at least in part on the individual's specialized knowledge of the security subjects,
by the computer, managing the annotations, wherein managing the annotations comprises curating, screening, editing, or monitoring the annotations and managing permissions to view or create annotations.

16. The method of claim 15 in which the security subjects comprise IP addresses.

17. The method of claim 16 in which the IP addresses comprise blocks of IP addresses that conform to Classless Inter-Domain Routing.

18. The method of claim 15 in which the entities own, control, or manage the IP addresses that belong to them.

19. The method of claim 15 in which the security subjects comprise domains.

20. The method of claim 19 in which the entities own, control, or manage the domains that belong to them.

21. The method of claim 15 in which the annotations comprise tags specified by the users.

22. The method of claim 21 in which the annotations are specified by the users selecting from sets of available tags.

23. The method of claim 15 in which the annotations describe characteristics of the security subjects that comprise at least one of a type, a location, a time period, a relationship with other security subjects, a relationship with an entity, or a combination of any two or more of them.

24. The method of claim 15 in which the annotations comprise groupings of IP addresses.

25. The method of claim 24 in which the groupings comprise subnets.

26. The method of claim 15 in which the presenting to the users of the information about security risks comprises managing the presenting based on the user's relationship with one or more of the entities.

27. The method of claim 26 in which at least some of the users are affiliated with corresponding entities and can add, alter, or remove annotations for the corresponding entities, can view public information for other entities, and cannot add, alter, or remove annotations for any other entities.

28. The method of claim 15 in which the information presented to the users comprises information about at least one of events indicative of the security risks, information about diligence, information about behavior of users of the security subjects, or information about forensics.

29. A system comprising:
a computer configured to acquire and store information indicative of security risks associated with security subjects and with entities to which the security subjects belong,
the computer analyzing the stored information to derive security indicators for the entities,
the computer presenting security information including the security indicators for the entities and security information for security subjects, the security information for security subjects including annotations entered via an input device by an individual with specialized knowledge of the security subjects, and
the computer managing the annotations based on communications from a user, wherein the annotations comprise tags based at least in part on the individual's specialized knowledge of the security subjects, wherein managing the annotations comprises curating, screening, editing, or monitoring the annotations and managing permissions to view or create annotations.

Assignees

• Bitsight Tech Inc

Inventors

• Boyer Stephen
• Venna Nagarjuna
• Gladstone Philip John Steuart
• Whalen Nicholas

Classifications

• G06Q10/40

  Business processes related to social networking or social networking services · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06Q30/0277

  Online advertisement · CPC title

• G06F3/0484

  for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range · CPC title