Method of cyber security and system thereof

1 . A computerized cyber security system for generating a consolidated risk score of an entity, usable for analysing the vulnerabilities of plurality of entities to cyber risks, the computerized cyber security system comprising a processor and memory circuitry (PMC) configured to:

determine a first set of IP addresses for scanning;

scan the first set of IP addresses, and for each IP address in the set, and perform, including:

(1) identify at least one risk and extract corresponding at least one risk criticality score, wherein each risk criticality score is informative of the vulnerability of network assets associated with the IP address to the risk;

(2) determining a misconfiguration score being informative of the vulnerability of network assets associated with the IP address to a misconfiguration;

map a second set of IP addresses, of said first set, to at least one entity of interest, wherein each one of said entities of interest is associated with a respective sub-set of IP addresses of said second set;

provide IP address criticality weights associated respectively with said second set of IP addresses, each IP address criticality weight being informative of the IP address's sensitivity to cyber threats relative to the sensitivity of other IP addresses to the cyber threats;

provide an entity criticality weight associated respectively with said at least one entity of interest; the entity criticality weight being informative of the entity's sensitivity to cyber threats, and being distinct from the sensitivity to cyber threats of the IP addresses of the entity, relative to the sensitivity of other entities to cyber threats;

wherein said scanning is performed by at least two scan tools each configured to obtain a subset of said set of risks and wherein each scan tool is associated with a respective tool weight, being informative of the reliability of the tool in detecting risks,

for each entity of interest, determine an entity consolidated risk score based on at least (i) the risk criticality scores associated with the IP addresses of the entity of interest, (ii) the misconfiguration scores associated with the IP addresses of the entity of interest (iii) IP criticality weights associated with the IP addresses of the entity of interest, (iv) the entity criticality weight of the entity of interest, and (v) the corresponding tool weight of the tool that was used for the scanning,

thereby obtaining a plurality of entity consolidated risk scores associated with respective entities of interest.

2 . The computerized cyber security system of claim 1 , wherein, for each entity of interest, the PMC is configured to determine the IP risk scores of respective IP addresses associated with the entity of interest, wherein each IP address risk score of an IP address is determined by combining at least (i) the risk criticality scores associated with the IP address (ii) the misconfiguration score associated with the IP address, and (iii) IP criticality weight associated with the IP address,

and wherein said PMC is further configured to determine said consolidated risk score per each entity of interest by combining the determined IP address risk scores of the respective IP addresses that are associated with the entity (iv) entity criticality weight of the entity of interest and (v) the corresponding tool weight of the tool that was used for the scanning.

3 . The computerized cyber security system of claim 1 wherein said PMC is further configured to actively scan said second set of mapped IP addresses by utilizing additional information derived from the mapped IP address to the entity of interest and the entity operator's consent scanning the IP address, to thereby enhance said risk criticality scores and misconfiguration scores.

4 . The computerized cyber security system of claim 3 , wherein a tool of said tools is Shodan.

5 . The computerized cyber security system of claim 1 , wherein each IP address is associated with a plurality of ports and wherein said scan includes determining a respective port value for each scan port, wherein each port value is informative of whether the “open ports” comply with a policy, and wherein said misconfiguration associated with an IP address is determined by combining the port values of the ports associated with the IP address.

6 . The computerized cyber security system of claim 1 , wherein said combining includes using one or more of the following functions: average, weighted average, sum, and max.

7 . The computerized cyber security system of claim 1 , wherein said first set of IP addresses is obtained using at least a national ISP data source.

8 . The computerized cyber security system of claim 1 , wherein said mapping utilizes at least the WhoIs and DNS repository data sources.

9 . The computerized cyber security system of claim 1 , wherein said risk criticality scores that are associated with the respective known risks comply with the National Institute of Standards and Technology (NIST) data source.

10 . A computerized cyber security method for generating a consolidated risk score of an entity, usable for analysing the vulnerabilities of plurality of entities to cyber risks, the computerized cyber security method comprising:

(a) determining a first set of IP addresses for scanning;

(b) scanning the first set of IP addresses, and for each IP address in the set, and perform, including:

(1) identify at least one risk, and extract corresponding at least one risk criticality score, wherein each risk criticality score is informative of the vulnerability of network assets associated with the IP address to the risk;

(2) determining a misconfiguration score being informative of the vulnerability of network assets associated with the IP address to a misconfiguration;

(c) mapping a second set of IP addresses, of said first set, to at least one entity of interest, wherein each one of said entities of interest is associated with a respective sub-set of IP addresses of said second set;

(d) providing IP address criticality weights associated respectively with said second set of IP addresses; each IP address criticality weight being informative of the IP address's sensitivity to cyber threats relative to the sensitivity of other IP addresses to the cyber threats;

(e) providing an entity criticality weight associated respectively with said at least one entity of interest; the entity criticality weight being informative of the entity's sensitivity to cyber threats, and being distinct from the sensitivity to cyber threats of the IP addresses of the entity, relative to the sensitivity of other entities to cyber threats;

wherein said scanning is performed by at least two scan tools each configured to obtain a subset of said set of risks and wherein each scan tool is associated with a respective tool weight, being informative of the reliability of the tool in detecting risks, and

for each entity of interest,

(f) determining an entity consolidated risk score based on at least (i) the risk criticality scores associated with the IP addresses of the entity of interest, (ii) the misconfiguration scores associated with the IP addresses of the entity of interest (iii) IP criticality weights associated with the IP addresses of the entity of interest, (iv) the entity criticality weight of the entity of interest, and (v) the corresponding tool weight of the tool that was used for the scanning,

thereby obtaining a plurality of entity consolidated risk scores associated with respective entities of interest.

11 . The computerized cyber security method of claim 10 ,

further comprising:

for each entity of interest, determining IP risk scores of respective IP addresses associated with the entity of interest, wherein each IP address risk score of an IP address is determined by combining at least (i) the risk criticality scores associated with the IP address (ii) the misconfiguration score associated with the IP address, and (iii) IP criticality weight associated with the IP address, and

determining said consolidated risk score per for each entity of interest by combining the determined IP address risk scores of the respective IP addresses that are associated with the entity (iv) entity criticality weight of the entity of interest and (v) the corresponding tool weight of the tool that was used for the scanning.

12 . The computerized cyber security method of claim 10 , further comprising: actively scanning said second set of mapped IP addresses by utilizing additional information derived from the mapped IP address to the entity of interest and the entity operator's consent scanning the IP address, to thereby enhance said risk criticality scores and misconfiguration scores.

13 . The computerized cyber security method of claim 12 , wherein a tool of said tools is Shodan.

14 . The computerized cyber security method of claim 10 , wherein each IP address is associated with a plurality of ports and wherein said scanning includes determining a respective port value for each scan port, wherein each port value is informative of whether the “open ports” comply with a policy, and wherein said misconfiguration associated with an IP address is determined by combining the port values of the ports associated with the IP address.

15 . The computerized cyber security method of claim 10 , wherein said combining includes using one or more of the following functions: average, weighted average, sum, and max.

16 . The computerized cyber security method of claim 10 , wherein said first set of IP addresses is obtained using at least a national ISP data source.

17 . The computerized cyber security method of claim 10 , wherein said mapping utilizes at least the WhoIs and DNS repository data sources.

18 . The computerized cyber security method of claim 10 , wherein said risk criticality scores that are associated with the respective known risks comply with the National Institute of Standards and Technology (NIST) data source.

19 . A non-transitory program storage device readable by a computer, tangibly embodying computer readable instructions executable by the computer to perform a method of generating a consolidated risk score of an entity, usable for analysing the vulnerabilities of plurality of entities to cyber risks, the method comprising:

(a) determining a first set of IP addresses for scanning;

(b) scanning the first set of IP addresses, and for each IP address in the set, perform, including:

(1) identify at least one risk and extract corresponding at least one risk criticality score, wherein each risk criticality score is informative of the vulnerability of network assets associated with the IP address to the risk;

(2) determining a misconfiguration score being informative of the vulnerability of network assets associated with the IP address to a misconfiguration;

(c) mapping a second set of IP addresses, of said first set, to at least one entity of interest, wherein each one of said entities of interest is associated with a respective sub-set of IP addresses of said second set;

(d) providing IP address criticality weights associated respectively with said second set of IP addresses; each IP address criticality weight being informative of the IP address's sensitivity to cyber threats relative to the sensitivity of other IP addresses to the cyber threats;

(e) providing an entity criticality weight associated respectively with said at least one entity of interest; the entity criticality weight being informative of the entity's sensitivity to cyber threat, and being distinct from the sensitivity to cyber threats of the IP addresses of the entity, relative to the sensitivity of other entities to cyber threats;

wherein said scanning is performed by at least two scan tools each configured to obtain a subset of said set of risks and wherein each scan tool is associated with a respective tool weight, being informative of the reliability of the tool in detecting risks, and

for each entity of interest,

(f) determining an entity consolidated risk score based on at least (i) the risk criticality scores associated with the IP addresses of the entity of interest, (ii) the misconfiguration scores associated with the IP addresses of the entity of interest (iii) IP criticality weights associated with the IP addresses of the entity of interest, (iv) the entity criticality weight of the entity of interest, and (v) the corresponding tool weight of the tool that was used for the scanning,

thereby obtaining a plurality of entity consolidated risk scores associated with respective entities of interest.