Connected asset risk management

1 . A computer-implemented method comprising:

extracting, from vulnerability data describing a vulnerability applicable to a connected asset within a network of connected assets, a set of technical impacts of the vulnerability;

extracting, from the vulnerability data, an exploitability score of the vulnerability;

generating, using a business value context of the connected asset and the set of technical impacts of the vulnerability, a network layer impact score corresponding to the connected asset and the vulnerability;

generating, using the business value context of the connected asset and the set of technical impacts of the vulnerability, an enterprise layer impact score corresponding to the connected asset and the vulnerability; and

generating, using the network layer impact score and the enterprise layer impact score, a remediation plan for the connected asset, the remediation plan comprising a planned adjustment of the connected asset to ameliorate the vulnerability wherein generating the network layer impact score comprises:

extracting, from a technical impact scorecard corresponding to the business value context, a plurality of network layer importance values, each network layer importance value in the plurality of network layer importance values corresponding to a technical impact in the set of technical impacts of the vulnerability; and

computing, by normalizing a result of multiplying the exploitability score of the vulnerability by an average of the plurality of network layer importance values, the network layer impact score.

2 . The computer-implemented method of claim 1 , wherein the vulnerability data is maintained in a vulnerability database accessible via an application programming interface.

3 . The computer-implemented method of claim 1 , wherein generating the enterprise layer impact score comprises:

extracting, from a technical impact scorecard corresponding to the business value context, a plurality of enterprise layer importance values, each enterprise layer importance value in the plurality of enterprise layer importance values corresponding to a technical impact in the set of technical impacts of the vulnerability; and

computing, by normalizing a result of multiplying the exploitability score of the vulnerability by an average of the plurality of enterprise layer importance values, the enterprise layer impact score.

4 . The computer-implemented method of claim 1 , further comprising:

adjusting, according to the planned adjustment in the remediation plan, the connected asset, the adjusting ameliorating the vulnerability.

5 . A computer program product comprising one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by a processor to cause the processor to perform operations comprising:

extracting, from vulnerability data describing a vulnerability applicable to a connected asset within a network of connected assets, a set of technical impacts of the vulnerability;

extracting, from the vulnerability data, an exploitability score of the vulnerability;

generating, using a business value context of the connected asset and the set of technical impacts of the vulnerability, a network layer impact score corresponding to the connected asset and the vulnerability;

generating, using the business value context of the connected asset and the set of technical impacts of the vulnerability, an enterprise layer impact score corresponding to the connected asset and the vulnerability; and

generating, using the network layer impact score and the enterprise layer impact score, a remediation plan for the connected asset, the remediation plan comprising a planned adjustment of the connected asset to ameliorate the vulnerability wherein generating the network layer impact score comprises:

extracting, from a technical impact scorecard corresponding to the business value context, a plurality of network layer importance values, each network layer importance value in the plurality of network layer importance values corresponding to a technical impact in the set of technical impacts of the vulnerability; and

computing, by normalizing a result of multiplying the exploitability score of the vulnerability by an average of the plurality of network layer importance values, the network layer impact score.

6 . The computer program product of claim 5 , wherein the stored program instructions are stored in a computer readable storage device in a data processing system, and wherein the stored program instructions are transferred over a network from a remote data processing system.

7 . The computer program product of claim 5 , wherein the stored program instructions are stored in a computer readable storage device in a server data processing system, and wherein the stored program instructions are downloaded in response to a request over a network to a remote data processing system for use in a computer readable storage device associated with the remote data processing system, further comprising:

program instructions to meter use of the program instructions associated with the request; and

program instructions to generate an invoice based on the metered use.

8 . The computer program product of claim 5 , wherein the vulnerability data is maintained in a vulnerability database accessible via an application programming interface.

9 . The computer program product of claim 5 , wherein generating the enterprise layer impact score comprises:

extracting, from a technical impact scorecard corresponding to the business value context, a plurality of enterprise layer importance values, each enterprise layer importance value in the plurality of enterprise layer importance values corresponding to a technical impact in the set of technical impacts of the vulnerability; and

computing, by normalizing a result of multiplying the exploitability score of the vulnerability by an average of the plurality of enterprise layer importance values, the enterprise layer impact score.

10 . The computer program product of claim 5 , further comprising:

adjusting, according to the planned adjustment in the remediation plan, the connected asset, the adjusting ameliorating the vulnerability.

11 . A computer system comprising a processor and one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by the processor to cause the processor to perform operations comprising:

extracting, from vulnerability data describing a vulnerability applicable to a connected asset within a network of connected assets, a set of technical impacts of the vulnerability;

extracting, from the vulnerability data, an exploitability score of the vulnerability;

generating, using a business value context of the connected asset and the set of technical impacts of the vulnerability, a network layer impact score corresponding to the connected asset and the vulnerability;

generating, using the business value context of the connected asset and the set of technical impacts of the vulnerability, an enterprise layer impact score corresponding to the connected asset and the vulnerability; and

generating, using the network layer impact score and the enterprise layer impact score, a remediation plan for the connected asset, the remediation plan comprising a planned adjustment of the connected asset to ameliorate the vulnerability wherein generating the network layer impact score comprises:

extracting, from a technical impact scorecard corresponding to the business value context, a plurality of network layer importance values, each network layer importance value in the plurality of network layer importance values corresponding to a technical impact in the set of technical impacts of the vulnerability; and

computing, by normalizing a result of multiplying the exploitability score of the vulnerability by an average of the plurality of network layer importance values, the network layer impact score.

12 . The computer system of claim 11 , wherein the vulnerability data is maintained in a vulnerability database accessible via an application programming interface.

13 . The computer system of claim 11 , wherein generating the enterprise layer impact score comprises:

extracting, from a technical impact scorecard corresponding to the business value context, a plurality of enterprise layer importance values, each enterprise layer importance value in the plurality of enterprise layer importance values corresponding to a technical impact in the set of technical impacts of the vulnerability; and

computing, by normalizing a result of multiplying the exploitability score of the vulnerability by an average of the plurality of enterprise layer importance values, the enterprise layer impact score.

14 . The computer system of claim 11 , further comprising:

adjusting, according to the planned adjustment in the remediation plan, the connected asset, the adjusting ameliorating the vulnerability.