System and method of cyber threat structure mapping and application to cyber threat mitigation

Patent metadata

Field	Value
Publication number	US-9749343-B2
Application number	US-201414244884-A
Country	US
Kind code	B2
Filing date	Apr 3, 2014
Priority date	Apr 3, 2014
Publication date	Aug 29, 2017
Grant date	Aug 29, 2017

Abstract

A security system comprising a computer, a memory, a data store comprising a cyber threat intent dictionary and a technology dictionary; and an application stored in the memory. When executed by the computer, the application generates a report that comprises an identification of a cyber threat intent and the identification of a cyber threat technology, wherein the cyber threat intent is selected from a plurality of cyber threat intents listed in the cyber threat intent dictionary and wherein the cyber threat technology is selected from the technology dictionary. The application also populates values in a cyber threat progression vector, where the cyber threat progression vector comprises elements that each corresponds to an action in a chain of actions associated with a cybercrime, where the values correspond to one of present or not present. The vector is used to manage the cyber risk of an enterprise or organization.

First claim

What is claimed is:

1. A security system, comprising:
a computer system;
a memory accessible to the computer system;
a data store comprising a cyber threat intent dictionary and a technology dictionary;
an application stored in the memory that, when executed by the computer system:
generates a cyber threat report for one or more cyber threats based on user inputs, wherein the report comprises an identification of a cyber threat intent and an identification of a cyber threat technology associated with a cyber threat, wherein the cyber threat intent is selected from a plurality of cyber threat intents listed in the cyber threat intent dictionary, and wherein the cyber threat technology is selected from the technology dictionary, and
populates a cyber threat progression vector for each of a plurality of different cyber threats comprising a plurality of predefined elements that each correspond to a step of a plurality of separate steps that are taken in carrying out a corresponding cyber threat of the plurality of different cyber threats, the cyber threat progression vectors having the same predefined elements with values corresponding to one of present or not present but with a different value in at least one of the plurality of pre-defined elements, wherein the cyber threat progression vector for the corresponding cyber threat comprises one or more predefined elements of the plurality of predefined elements with a value corresponding to not present in the corresponding cyber threat,
wherein the cyber threat report and the cyber threat progression vectors are used to select cyber risk mitigation actions to manage cyber risks of an enterprise or organization, wherein a first cyber threat of the plurality of different cyber threats is interdicted at at least a first step of the plurality of steps corresponding to a predefined element of the plurality of predefined elements on the cyber threat progression vector for the first cyber threat having a value corresponding to present for the first cyber threat, and wherein a second cyber threat of the plurality of different cyber threats is interdicted at at least a different step than the first step corresponding to a predefined element of the plurality of predefined elements on the cyber threat progression vector for the second cyber threat having a value corresponding to present in the second cyber threat; and

a computer system interface to provide the report and the cyber threat progression vectors.

2. The system of claim 1 , wherein the cyber threat intent indicates a goal or object of the cyber threat, and wherein the cyber threat technology is targeted by the cyber threat.

3. The system of claim 1 , wherein the plurality of predefined elements of the cyber threat progression vectors comprise an element corresponding to capturing credit card account numbers, an element corresponding to collecting credit card credentials, and deploying cyber attack automation tools.

4. The system of claim 1 , wherein at least one of the plurality of different cyber threats comprises a potential cyber attack.

5. The system of claim 1 , wherein the cyber risk mitigation actions selected comprise at least one electronic or procedural control or countermeasure, and wherein the application initiates performance of at least a first of the selected cyber risk mitigation actions.

6. A method of mitigating cyber attack risk, comprising:
receiving a cyber threat report for at least one cyber threat, wherein the cyber threat report comprises at least one cyber threat intent selected from a list of predefined cyber threat intents and at least one identity of a technology item selected from a list of technology items deployed within an enterprise or organization;
matching the at least one cyber threat intent in the cyber threat report to a potential business effect in a list of potential business effects;
matching the at least one identity of a technology item in the cyber threat report to a technology item in the list of technologies deployed within the enterprise or organization;
receiving a cyber threat progression vector for each of a plurality of different cyber threats comprising a plurality of predefined elements that each correspond to a step of a plurality of separate steps that are taken in carrying out a corresponding cyber threat of the plurality of different cyber threats, the cyber threat progression vectors having the same predefined elements with values corresponding to one of present or not present but with a different value in at least one of the plurality of predefined elements, wherein the cyber threat progression vector for the corresponding cyber threat comprises one or more predefined elements of the plurality of predefined elements with a value corresponding to not present in the corresponding cyber threat;
deploying at least one electronic or procedural control or countermeasure to mitigate a cyber attack risk associated with the matching to the potential business impact and the matching to the technology item deployed within the enterprise or organization, where the at least one electronic or procedural control or counter measure is selected based on the cyber threat progression vector for at least one cyber threat of the plurality of different cyber threats;
wherein a first cyber threat of the plurality of different cyber threats is interdicted at least a first step of the plurality of steps corresponding to a predefined element of the plurality of predefined elements on the cyber threat progression vector for the first cyber threat having a value corresponding to present for the first cyber threat, and wherein a second cyber threat of the plurality of different cyber threats is interdicted at least a different step than the first step corresponding to a predefined element of the plurality of predefined elements on the cyber threat progression vector for the second cyber threat having a value corresponding to present in the second cyber threat.

7. The method of claim 6 , further comprising:
receiving a second cyber threat report;
comparing an at least one cyber threat intent of the second cyber threat report to the potential business effects in the list of potential business effects; and
when there is no match of the at least one cyber threat intent of the second cyber threat report to the potential business effects, not deploying an additional electronic or procedural control or countermeasure.

8. The method of claim 6 , further comprising:
receiving a third cyber threat report;
comparing an at least one identity of a technology item in the third cyber threat report to the list of technologies deployed within the enterprise or organization; and
when there is no match of the at least one identity of the technology item in the third cyber threat report to the list of technologies deployed within the enterprise or organization, not deploying an additional electronic or procedural control or countermeasure.

9. The method of claim 6 , wherein the at least one electronic or procedural control or counter measure deployed interdicts the first cyber threat at the first step.

10. The method of claim 9 , wherein two electronic or procedural control or counter measures are selected and deployed to interdict the first cyber threat at the first step.

11. The method of claim 6 , further comprising adding a new technology item to the list of technologies deployed within the enterprise or organization after building the list of technologies.

12. The method of claim 6 , wherein the cyber threat report and the cyber threat progression vector for each of the plurality of different cyber threats are received from a cyber security consulting com

Assignees

• Isight Partners Inc
• Fireeye Inc

Inventors

• Watters John P
• Doyle Frederick
• Peltokangas Henry
• Keane Matthew

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title