Object-oriented method, system and medium for risk management by creating inter-dependency between objects, criteria and metrics
A method, system, and medium for assessing and/or managing risks for an organization is described. The method, for example, comprises the steps of inventorying a number of assets of the organization, identifying at least one criterion defining a security objective of the organization, and identifying one or more inventoried assets that relate to the identified criterion. The assets may include one or more computers, networking equipment therefor and physical locations where the computers and networking equipment are located. The method may also include the step of formulating one or more metric equations, each metric equation being defined, in part, by the one or more identified assets. Each metric equation yields an outcome value when one or more measurements are made relating to the identified assets. The method may also include the step of assessing the risk to the organization based on the measured values of the one or more metric equations. Corresponding system, medium and means are also described.
1. A method for assessing and/or managing risks for an organization, comprising the steps of:
inventorying a plurality of assets of the organization, wherein each asset is defined to be one of an electronic asset type and a location asset type, and wherein the electronic asset type includes computers and networking equipment therefor and the location asset type includes physical locations where the electronic asset types are placed;
identifying the plurality of assets, wherein at least a portion of the plurality of assets are identified by utilizing a computer to electronically scan the plurality of assets via a network;
storing the identified assets electronically in the computer;
identifying at least one criterion defining a security objective of the organization, and electronically storing the at least one identified criterion in the computer;
identifying one or more inventoried assets that relate to the identified criterion by utilizing the computer;
formulating one or more metric equations for each identified criterion by utilizing the computer, each metric equation being defined, in part, by the one or more identified assets, wherein each metric equation yields an outcome value when one or more measurements are made relating to the identified assets; and
assessing the risk to the organization based on the measured values of the one or more metric equations by utilizing the computer.
2. The method of claim 1 , wherein the step of identifying the plurality of assets further comprises at least one of:
interviewing members of the organization to identify the plurality of assets; and
manually identifying the plurality of assets.
3. The method of claim 1 , wherein the plurality of assets are defined to be one of a user type, a user population type, a data type and a network type in addition to the electronic type and the location type, wherein the user type relates to an individual user and the user population type relates to a group of users.
4. The method of claim 3 , further comprising the step of:
establishing at least one relationship between the plurality of assets.
5. The method of claim 4 , wherein the step of establishing the at least one relationship further comprises the step of:
linking a first asset defined to be in one asset type with a second asset defined to be in another asset type.
6. The method of claim 4 , wherein the step of establishing the at least one relationship further comprises the step of:
linking a first asset defined to be in one asset type with a second asset defined to be in the same asset type.
7. The method of claim 4 , wherein the step of identifying one or more inventoried assets further comprises the step of:
identifying one or more inventoried assets that relate to the identified criterion based on the at least one established relationship between the plurality of assets.
8. A computing system configured to:
identify a plurality of assets of the organization, wherein each asset is defined to be one of an electronic asset type and a location asset type, wherein the electronic asset type includes computers and networking equipment therefore and the location asset type includes physical locations where the electronic asset types are placed, and store the identified assets into a database;
identify a plurality of criteria, each criterion defining a security objective of the organization;
identify a plurality of inventoried assets that relate to each identified criterion; and
formulate one or more metric equations for each identified criterion, each metric equation being defined, in part, by the one or more identified assets, wherein each metric equation yields an outcome value when one or more measurements are made relating to the identified assets, thereby allowing a user to assess the risk to the organization based on the measured values of the one or more metric equations.
9. The computing system of claim 8 , further configured to identify the plurality of assets by electronically scanning at least a portion of the plurality of assets via a network.
10. The computing system of claim 8 , wherein the plurality of assets are defined to be one of a user type, a user population type, a data type and a network type in addition to the electronic type and the location type, wherein the user type relates to an individual user and the user population type relates to a group of users.
11. The computing system of claim 10 , further configured to establish at least one relationship between the plurality of assets.
12. The computing system of claim 11 , further configured to establish the at least one relationship by linking a first asset defined to be in one asset type with a second asset defined to be in another asset type.
13. The computing system of claim 11 , further configured to establish the at least one relationship by linking a first defined to be in one asset type with a second asset defined to be in the same asset type.
14. The computing system of claim 11 , further configured to identify one or more inventoried assets that relate to the identified criterion based on the at least one established relationship between the plurality of assets.
15. A system for assessing and/or managing risks for an organization, comprising:
a computer configured to identify a plurality of assets of the organization, wherein each asset is defined to be one of an electronic asset type and a location asset type, and wherein the electronic asset type includes computers and networking equipment therefor and the location asset type includes physical locations where the electronic asset types are placed;
a database configured to store the identified assets along with their asset types;
means for identifying at least one criterion defining a security objective of the organization, wherein the computer is further configured to identify one or more inventoried assets that relate to the identified criterion and configured to formulate one or more metric equations for each identified criterion, each metric equation being defined, in part, by the one or more identified assets, wherein each metric equation yields an outcome value when one or more measurements are made relating to the identified assets, thereby allowing a user to assess the risk to the organization based on the measured values of the one or more metric equations.
16. The system of claim 15 , wherein the computer is further configured to:
electronically scan the plurality of assets;
interview members of the organization to identify the plurality of assets; and
manually identify the plurality of assets.
17. The system of claim 15 , wherein the plurality of assets are defined to be one of a user type, a user population type, a data type and a network type in addition to the electronic type and the location type, wherein the user type relates to an individual user and the user population type relates to a group of users.
18. The system of claim 17 , wherein the computer is further configured to establish at least one relationship between the plurality of assets.
19. The system of claim 18 , wherein the computer is further configured to link a first asset defined to be in one asset type with a second asset defined to be in another asset type.
20. The system of claim 18 , wherein the computer is further configured to link a first asset defined to be in one asset type with a second asset defined to be in the same asset type.
21. The system of claim 18 , wherein the computer is further configured to identify one or more inventoried assets that relate to the identified criterion based on the at least one established relationship between the plurality of assets.
22. A computer readable medium including instructions being executed by one or more computers, the instructions instructing the one or more computers for assessing and/or managing risks for an organization, the instructions comprising implementation of the steps of:
(a) inventorying a plurality of assets of the organization, wherein each asset is defined to be one of an electronic asset type and a location asset type, and wherein the electronic asset type includes computers and networking equipment therefor and the location asset type includes physical locations where the electronic asset types are placed;
(b) identifying at least one criterion defining a security objective of the organization;
(c) identifying one or more inventoried assets that relate to the identified criterion; and
(d) formulating one or more metric equations for each identified criterion, each metric equation being defined, in part, by the one or more identified assets, wherein each metric equation yields an outcome value when one or more measurements are made relating to the identified assets, thereby allowing a user to assess the risk to the organization based on the measured values of the one or more metric equations.
23. The medium of claim 22 , wherein the step (a) comprises the step of:
identifying the plurality of assets and storing the identified assets into a database.
24. The medium of claim 23 , wherein the step of identifying the plurality of assets comprises at least one of:
electronically scanning the plurality of assets;
interviewing members of the organization to identify the plurality of assets; and
manually identifying the plurality of assets.
25. The medium of claim 22 , wherein the plurality of assets are defined to be one of a user type, a user population type, a data type and a network type in addition to the electronic type and the location type, wherein the user type relates to an individual user and the user population type relates to a group of users.
26. The medium of claim 25 , further comprising the step of:
establishing at least one relationship between the plurality of assets.
27. The medium of claim 26 , wherein the step of establishing the at least one relationship further comprises the step of:
linking a first asset defined to be in one asset type with a second asset defined to be in another asset type.
28. The medium of claim 26 , wherein the step of establishing the at least one relationship further comprises the step of:
linking a first asset defined to be in one asset type with a second asset defined to be in the same asset type.
29. The medium of claim 26 , wherein the step (c) further comprises the step of:
identifying one or more inventoried assets that relate to the identified criterion based on the at least one established relationship between the plurality of assets.