System and method for cybersecurity risk management

1 . A method for cyber risk assessment, comprises:

determining asset weights for each of one or more assets in a network environment, wherein each of the one or more assets is associated with one or more functions, and wherein the asset weights for each asset in the one or more assets are determined as a weighted average of a function impact vector of the one or more functions using a corresponding business impact value and a corresponding relative asset value of the asset within the function impact vector;

determining a vulnerability impact vector for each of one or more vulnerabilities associated with each asset in the one or more assets;

generating one or more attack paths based on the one or more vulnerabilities, wherein each of the one or more attack paths indicate paths for lateral movement between a subset of assets from the one or more assets; and

determining a cyber risk value based on the one or more attack paths using the asset weights and the vulnerability impact vectors of each asset in the subset of assets.

2 . The method of claim 1 , wherein for determining the cyber risk value, the method comprises:

determining an impact value for each attack path in the one or more attack paths; and

selecting a highest impact value from the impact values associated with the one or more attack paths as the cyber risk value.

3 . The method of claim 2 , wherein for determining the impact value, the method comprises:

determining a dot product of the asset weight and the corresponding impact vector for each asset in the subset of assets associated with each attack path; and

aggregating the dot products for each of the assets in the subset of assets to obtain the impact value for each attack path.

4 . The method of claim 2 , wherein for selecting the attack path having the highest impact value, the method comprises:

initializing a partial impact value for each of the one or more assets to a predetermined value;

identifying one or more entry point assets from the one or more assets; and

until one or more target assets are reached, iteratively

identifying one or more next/subsequent assets reachable from a prior asset; and

traversing to each of the one or more next assets and incrementing the partial impact values associated with each of the next assets by a sum of

a dot product of the corresponding asset weights and the corresponding vulnerability impact vector, and

the partial impact value of the prior asset.

5 . The method of claim 1 , wherein the cyber risk value is determined periodically at predetermined intervals or each time a configuration of the one or more assets is changed.

6 . A method for cyber risk treatment, comprising;

until a cyber risk value of a network environment having one or more assets falls below a predetermined threshold, iteratively:

generating one or more attack paths based on an asset weight and a vulnerability impact vector associated with each asset in the one or more assets, wherein each of the one or more assets is associated with one or more functions, and wherein the asset weight for each asset in the one or more assets is determined as a weighted average of a function impact vector of the one or more functions using a corresponding business impact value and a corresponding relative asset value of the asset within the function; and

applying/executing a security control to mitigate attack techniques associated with the one or more vulnerabilities.

7 . The method of claim 6 , wherein the security control is applied in a simulated environment, and wherein the method comprises providing the security control applied in each iteration as a recommendation to operators of the network environment.

8 . The method of claim 6 , wherein the one or more attack paths are generated by tracing the lateral movement taken by an attacker.

9 . A system for cyber risk assessment, comprising:

a processor; and

a memory coupled to the processor, wherein the memory comprises one or more processor-executable instructions that cause the processor to:

determine asset weights for each of one or more assets in a network environment, wherein each of the one or more assets is associated with one or more functions, and wherein the asset weights for each asset in the one or more assets are determined as a weighted average of a function impact vector of the one or more functions using a corresponding business impact value and a corresponding relative asset value of the asset within the function impact vector;

determine a vulnerability impact vector for each of one or more vulnerabilities associated with each asset in the one or more assets;

generate one or more attack paths based on the one or more vulnerabilities, wherein each of the one or more attack paths indicate paths for lateral movement between a subset of assets from the one or more assets; and

determine a cyber risk value based on the one or more attack paths using the asset weights and the vulnerability impact vectors of each asset in the subset of assets.

10 . A system for cyber risk treatment, comprising:

a processor; and

a memory coupled to the processor, wherein the memory comprises one or more processor-executable instructions that cause the processor to:

until a cyber risk value of a network environment having one or more assets falls below a predetermined threshold, iteratively:

generate one or more attack paths based on an asset weight and a vulnerability impact vector associated with each asset in the one or more assets, wherein each of the one or more assets is associated with one or more functions, and wherein the asset weight for each asset in the one or more assets is determined as a weighted average of a function impact vector of the one or more functions using a corresponding business impact value and a corresponding relative asset value of the asset within the function impact vector; and

apply/execute a security control to mitigate attack techniques associated with the one or more vulnerabilities.

11 . A non-transitory computer-readable medium comprising processor-executable instructions that cause a processor to:

determine asset weights for each of one or more assets in a network environment, wherein each of the one or more assets is associated with one or more functions, and wherein the asset weights for each asset in the one or more assets are determined as a weighted average of a function impact vector of the one or more functions using a corresponding business impact value and a corresponding relative asset value of the asset within the function impact vector;

determine a vulnerability impact vector for each of one or more vulnerabilities associated with each asset in the one or more assets;

generate one or more attack paths based on the one or more vulnerabilities, wherein each of the one or more attack paths indicate paths for lateral movement between a subset of assets from the one or more assets; and

determine a cyber risk value based on the one or more attack paths using the asset weights and the vulnerability impact vectors of each asset in the subset of assets.

12 . A non-transitory computer-readable medium comprising processor-executable instructions that cause a processor to:

until a cyber risk value of a network environment having one or more assets falls below a predetermined threshold, iteratively:

generate one or more attack paths based on an asset weight and a vulnerability impact vector associated with each asset in the one or more assets, wherein each of the one or more assets is associated with one or more functions, and wherein the asset weight for each asset in the one or more assets is determined as a weighted average of a function impact vector of the one or more functions using a corresponding business impact value and a corresponding relative asset value of the asset within the function impact vector; and

apply/execute a security control to mitigate attack techniques associated with the one or more vulnerabilities.