Non-intrusive techniques for discovering and using organizational relationships
The present disclosure provides techniques for calculating an entity's cybersecurity risk based on identified relationships between the entity and one or more vendors. Customer/vendor relationships may impact the cybersecurity risk for each of the parties involved because a security compromise of a downstream or upstream provider can lead to a compromise of multiple other companies. For example, if organization A uses B (e.g., a cloud service provider) to store files, and B is compromised, this may lead to organization A being compromised (e.g., the files organization A stored using B may have been compromised by the breach of B's cybersecurity). Embodiments of the present disclosure further provide a technique for calculating a cybersecurity risk score for an organization based on identified customer/vendor relationships.
1 . A method for adjusting cybersecurity risk scores of companies based on cybersecurity postures of vendors, the method comprising:
non-intrusively searching, by one or more processors, for information that is indicative of a relationship between a company and a vendor, wherein the vendor and the company are different entities, wherein non-intrusively searching for the information comprises:
obtaining network data, wherein the network data is generated by taking snapshots of portions of an Internet;
applying searches to the network data for specific device fingerprints within a network footprint of the company;
determining, based on searching the network data for specific device fingerprints, a presence of signatures and patterns for specific device fingerprints known to be associated with a particular software provider, wherein the particular software provider is associated with the company, and wherein the information that is indicative of a relationship between the company and the vendor is generated based on determining the presence of signatures and patterns for specific device fingerprints;
combining, by the one or more processors and based on the information that is indicative of a relationship between the company and the vendor, first information corresponding to a website attributable to the vendor and second information corresponding to the company to generate a candidate universal resource locator (URL), wherein the candidate URL is generated based on at least one of a plurality of URL templates;
validating, by the one or more processors, whether the candidate URL resolves to a second website that is valid and attributable to the vendor, wherein the validating is based on whether the second website includes an indication that the company uses a service offered by the vendor, wherein the validating comprises:
using a machine learning algorithm to prune false positives from a set of candidate URLs that includes the candidate URL;
calculating a cutoff point based on a total count of candidate URLs included in the set of candidate URLs as a fraction of a list for the same template; and
validating URL templates based on a dynamically configured threshold, wherein the threshold is dynamically configured based on historical data analysis associated with URL templates and candidate URLs, and wherein the threshold is dynamically adjusted based on changes in counts and changes in a determined number of relationships over time for the vendor;
modeling the relationship between the company and the vendor in a graph of an Internet ecosystem based on an output of validating whether the candidate URL resolves to a second website that is valid and attributable to the vendor;
in response to validation of the candidate URL:
adjusting, by the one or more processors and based on the graph of the Internet ecosystem, a cybersecurity risk score of the company based on a cybersecurity posture for the vendor; and
in response to adjusting the cybersecurity risk score of the company based on the cybersecurity posture for the vendor, proactively preventing a cybersecurity risk;
in response to a failure to validate the candidate URL:
maintaining, by the one or more processors, the cybersecurity risk score of the company; and
outputting the cybersecurity risk score of the company to a graphical user interface.
2 . The method of claim 1 , wherein the first information corresponds to a domain of the website attributable to the vendor and the second information is combined with the first information as a subdomain of the domain.
3 . The method of claim 1 , wherein the first information corresponds to a domain of the website attributable to the vendor and the second information is combined with the first information as a directory within the domain.
4 . The method of claim 1 , further comprising:
performing, by the one or more processors, the non-intrusive searching of the one or more websites to identify information that is indicative of the relationship between the vendor and the company.
5 . The method of claim 1 , wherein the validating is further based on analysis of source code of the second website, image content of the second website, text content of the second website, or a combination thereof.
6 . The method of claim 1 , further comprising:
identifying, by the one or more processors, additional services used by the company and that are offered by additional vendors that are different from the vendor based on other information sources, wherein the other information sources comprise network footprints of the additional vendors, social network information, press release information for the additional vendors, or a combination thereof; and
further adjusting, by the one or more processors, the cybersecurity risk score of the company based on cybersecurity postures of the additional vendors.
7 . The method of claim 1 , further comprising:
determining, by the one or more processors, a risk factor based on use, by the company, of the service offered by the vendor, wherein the risk factor represents a risk that a cybersecurity breach of the vendor will expose sensitive data of the company; and
determining, by the one or more processors, a weighting factor associated with the risk factor, wherein the cybersecurity risk score of the company is adjusted based on the risk factor and the weighting factor.
8 . The method of claim 1 , further comprising:
generating, by the one or more processors, a graph that depicts the relationship between the company and the vendor and relationships between the company and one or more additional vendors, wherein each relationship depicted by the graph indicates that the company uses the service of a corresponding vendor.
9 . The method of claim 1 , further comprising, in response to the validation of the candidate URL:
generating, by the one or more processors, a second candidate URL comprising the first information and other second information that is different than the second information, wherein the other second information corresponds to a second company that is different from the company; and
in response to a determination that the second candidate URL resolves to a third website that is valid and attributable to the vendor, adjusting, by the one or more processors, a cybersecurity risk score of the second company based on the cybersecurity posture for the vendor to generate an adjusted cybersecurity risk score of the second company.
10 . The method of claim 1 , further comprising:
generating, by the one or more processors, a third candidate URL comprising other first information and the second information, wherein the other first information is different from the first information and corresponds to a second vendor that is different from the vendor; and
in response to a determination that the third candidate URL resolves to a fourth website that is valid and attributable to the second vendor, further adjusting, by the one or more processors, the cybersecurity risk score of the company based on a cybersecurity posture for the second vendor.
11 . A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
non-intrusively searching for information that is indicative of a relationship between a company and a vendor, wherein the vendor and the company are different entities, wherein non-intrusively searching for information comprises:
obtaining network data, wherein the network data is generated by taking snapshots of portions of an Internet;
applying searches to the network data for specific device fingerprints within a network footprint of the company;
determining, based on searching the network data for specific device fingerprints, a presence of signatures and patterns for specific device fingerprints known to be associated with a particular firewall software provider, wherein the particular firewall software provider is associated with the company; and
identifying the information that is indicative of a relationship between the company and the vendor based on determining the presence of signatures and patterns for specific device fingerprints;
combining, based on the information that is indicative of a relationship between the company and the vendor, first information corresponding to a website attributable to the vendor and second information corresponding to the company to generate a candidate universal resource locator (URL), wherein the candidate URL is generated based on at least one of a plurality of URL templates generated with a template generation block comprising a search engine; and
validating whether the candidate URL resolves to a second website that is valid and attributable to the vendor, wherein the validating is based on whether the second website includes an indication that the company uses a service offered by the vendor wherein the validating comprises:
using a machine learning algorithm to prune false positives from a set of candidate URLs that includes the candidate URL;
calculating a cutoff point based on a total count of candidate URLs included in the set of candidate URLs as a fraction of a list for the same template; and
validating URL templates based on a dynamically configured threshold, wherein the threshold is dynamically configured based on historical data analysis associated with URL templates and candidate URLs, and wherein the threshold is dynamically adjusted based on changes in counts and changes in a determined number of relationships over time for the vendor;
modeling the relationship between the company and the vendor in a graph of an Internet ecosystem based on an output of validating whether the candidate URL resolves to a second website that is valid and attributable to the vendor;
in response to validation of the candidate URL:
adjusting, based on the graph of the Internet ecosystem, a cybersecurity risk score of the company based on a cybersecurity posture for the vendor; and
in response to adjusting the cybersecurity risk score of the company based on the cybersecurity posture for the vendor, proactively preventing a cybersecurity risk;
in response to a failure to validate the candidate URL:
maintaining the cybersecurity risk score of the company.
12 . The non-transitory computer-readable storage medium of claim 11 , wherein the operations further comprise:
determining the cybersecurity posture of the vendor based on cybersecurity risk scores of other vendors that have relationships with the vendor.
13 . The non-transitory computer-readable storage medium of claim 11 , wherein the validating is further based on analysis of content identified from traversing one or more links of the second website.
14 . The non-transitory computer-readable storage medium of claim 11 , wherein the operations further comprise:
periodically determining whether a change has occurred with respect to the relationship between the company and the vendor; and
recalculating the cybersecurity risk score for the company based on a determination that the change has occurred with respect to the relationship between the company and the vendor.
15 . A system for adjusting cybersecurity risk scores of companies based on cybersecurity postures of vendors, the system comprising:
a memory; and
one or more processors coupled to the memory, the one or more processors configured to:
non-intrusively search for information that is indicative of a relationship between a company and a vendor, wherein the vendor and the company are different entities, wherein non-intrusively searching for information comprises:
obtaining network data, wherein the network data is generated by taking snapshots of portions of an Internet;
applying searches to the network data for specific device fingerprints within a network footprint of the company;
determining, based on searching the network data for specific device fingerprints, a presence of signatures and patterns for specific device fingerprints known to be associated with a particular content delivery network, wherein the particular content delivery network is associated with the company; and
identifying the information that is indicative of a relationship between the company and the vendor based on determining the presence of signatures and patterns for specific device fingerprints;
combine, based on the information that is indicative of a relationship between the company and the vendor, first information corresponding to a website attributable to the vendor and second information corresponding to the company to generate a candidate universal resource locator (URL), wherein the candidate URL is generated based on at least one of a plurality of URL templates;
validate whether the candidate URL resolves to a second website that is valid and attributable to the vendor, wherein the validating is based on whether the second website includes an indication that the company uses a service offered by the vendor, wherein the validating comprises:
using a first machine learning algorithm to prune false positives from a set of candidate URLs that includes the candidate URL;
calculating a cutoff point based on a total count of candidate URLs included in the set of candidate URLs as a fraction of a list for the same template; and
validating URL templates based on a dynamically configured threshold, wherein the threshold is dynamically configured by a second machine learning algorithm based on historical data analysis associated with URL templates and candidate URLs, and wherein the threshold is dynamically adjusted based on changes in counts and changes in a determined number of relationships over time for the vendor;
wherein the validating is further based on analysis of source code of the second website, image content of the second website, text content of the second website, or a combination thereof to determine a presence of patterns for fingerprints known to be associated with at least one of a particular firewall hardware or a particular software provider;
modeling the relationship between the company and the vendor in a graph of an Internet ecosystem based on an output of validating whether the candidate URL resolves to a second website that is valid and attributable to the vendor;
in response to validation of the candidate URL:
adjust, based on the graph of the Internet ecosystem, a cybersecurity risk score of the company based on a cybersecurity posture for the vendor; and
in response to adjusting the cybersecurity risk score of the company based on the cybersecurity posture for the vendor, proactively preventing a cybersecurity risk;
in response to a failure to validate the candidate URL:
maintain the cybersecurity risk score of the company.
16 . The system of claim 15 , wherein the first information corresponds to a domain of the website attributable to the vendor and the second information is combined with the first information as a subdomain of the domain.
17 . The system of claim 15 , wherein the first information corresponds to a domain of the website attributable to the vendor and the second information is combined with the first information as a directory that is associated with the company and is within the domain.
18 . The system of claim 15 , wherein the one or more processors are further configured to:
determine the cybersecurity posture of the vendor based on cybersecurity risk scores of other vendors that have relationships with the vendor.
19 . The method of claim 1 , wherein the indication comprises a login feature associated with the company, and wherein the company accesses the service offered by the vendor via the login feature.
20 . The method of claim 19 , wherein the indication further comprises a logo associated with the company, and wherein the company exchanges data with the vendor subsequent to accessing the service via the login feature.
21 . The method of claim 1 , wherein a low count for a particular URL template indicates that the URL template is not valid and candidate URLs matching the particular URL template are discarded, and wherein a high count for the particular URL template indicates that the particular URL template is valid and candidate URLs matching the particular URL template are designated for further exploration and analysis.
22 . The non-transitory computer-readable storage medium of claim 11 , wherein a low count for a particular URL template indicates that the URL template is not valid and candidate URLs matching the particular URL template are discarded, and wherein a high count for the particular URL template indicates that the particular URL template is valid and candidate URLs matching the particular URL template are designated for further exploration and analysis.
23 . The system of claim 15 , wherein a low count for a particular URL template indicates that the URL template is not valid and candidate URLs matching the particular URL template are discarded, and wherein a high count for the particular URL template indicates that the particular URL template is valid and candidate URLs matching the particular URL template are designated for further exploration and analysis.