Security risk analysis system and method
View Patent ↗A system and method for assessing risks to computer network is provided. The system includes a first module assesses a human factor related to a risk to the computer network. A second module assesses a remediation to the computer network, and a third module is operable to assess a life cycle of an asset on the computer network. A fourth module assesses a type of the asset used by the computer network.
1. A method for assessing risk in executing vulnerability remediations to a computer network, comprising:
identifying at least one human factor related to a risk posed by each of one or more individuals that have access to a portion of the computer network;
determining one of a plurality of levels of risk for each of the individuals using at least one human factor, wherein determining the level of risk for each individual further comprises calculating a risk score for a plurality of vulnerability remediations to be considered for application to the portion of the computer network based at least in part on the levels of risk for each individual that has access to the portion of the computer network;
selecting at least one of the vulnerability remediations to execute based at least in part on the relative risk scores of the plurality of vulnerability remediations considered; and
executing the selected vulnerability remediations on the portion of the computer network.
2. The method of claim 1 , wherein the human factor is further defined as a demographic factor.
3. The method of claim 2 , wherein the demographic factor is selected from a group of demographic factors consisting of gender, age, marital status, nationality.
4. The method of claim 1 , wherein the human factor is further defined as an employment status.
5. The method of claim 4 , wherein the employment status is selected from a group consisting of full-time employees, part-time employees, contractors.
6. The method of claim 1 , wherein the human factor is further defined as geographic location of the individuals that have access to the portion of the computer network.
7. The method of claim 1 , wherein the human factor is further defined as a criminal record of the individuals that have access to the portion of the computer network.
8. The method of claim 1 , wherein the human factor is further defined as a credit record of the individuals that have access to the portion of the computer network.
9. The method of claim 1 , wherein the human factor is further defined as a seniority of the individuals that have access to the portion of the computer network.
10. The method of claim 1 , wherein the human factor is further defined as job information selected from a group consisting of a job responsibility, a job title, and a computer network security access level.
11. The method of claim 1 , further comprising:
prioritizing the plurality of vulnerability remediations for selection; and
scheduling the execution of the selected remediations.
12. The method of claim 1 , further comprising automatically selecting and executing a vulnerability remediation on the portion of the computer network based at least in part on its risk score.
13. The method of claim 1 , wherein the level of risk posed by each of the individuals is determined using only the human factor.
14. The method of claim 1 , wherein the level of risk posed by each of the individuals is determined using the human factor in combination with one of an event factor and a type of access factor.
15. The method of claim 1 , wherein the human factor is selected from a group of human factors consisting of an emotional disposition factor, a geopolitical factor, a demographic factor, a job positions factor, and a behavior factor.
16. A system for protecting a computer network from vulnerabilities, the system comprising:
a risk assessment module to evaluate one or more risk factors to determine one of a plurality of levels of risk to each of a puerility of devices within the computer network, wherein at least one of the risk factors is a human factor used to assess risk posed by individuals that have access to each of the devices; and
a remediation module to prioritize a plurality of remediations for remediating the devices, wherein the prioritization is based on the level of risk to each of the devices.
17. The system of claim 16 , wherein the human factor is selected from a group of human factors comprising an emotional disposition factor, a geopolitical factor, a demographic factor, ajob positions factor, and a behavior factor.
18. The system of claim 16 , wherein the risk assessment module further evaluates risk factors to each of the devices based on a type of access factor selected from a group comprising a location from which each of the devices accesses the computer network and a mobility of each of the devices.
19. The system of claim 16 , wherein the remediation module remediates each of the devices with at least one patch, and wherein the risk assessment module further includes a patch component operable to assess a risk posed by the at least one patch.
20. The system of claim 16 , wherein the risk assessment module further includes a life cycle component operable to assess risk to each of the devices based on variations of a value of each of the devices over time.
21. The system of claim 16 , wherein the risk assessment module further includes an asset type component operable to assess an asset type risk factor to assess risk to each of the devices based on each of the devices being a particular type of device.
22. The system of claim 16 , wherein the risk assessment module further includes a scheduling component to schedule remediation of the devices on the computer network based on the prioritization.
23. The system of claim 16 , wherein the human factors is further defined as an emotional disposition factor.
24. The system of claim 16 , wherein the human factors is further defined as a geopolitical factor.
25. The system of claim 16 , wherein the human factors is further defined as a demographic factor.
26. The system of claim 16 , wherein the human factors is further defined ajob positions factor.
27. The system of claim 16 , wherein the human factors is further defined as a behavior factor.
28. The system of claim 16 , wherein the risk factor evaluated by the risk assessment module determines the level of risk based at least in part on whether an identified vulnerability has an associated identified threat that exploits the identified vulnerability.
29. The system of claim 16 , wherein the remediation module utilizes the level of risk to each of the devices to identify one or more devices that have a highest value, a highest risk, or would cause a greatest potential for disruption to the network upon succumbing to the one or more risk factors.
30. The system of claim 29 , wherein the remediation module prioritizes the remediations based on a set of priorities for the network.
31. The system of claim 30 , wherein the set of priorities includes at least one of a priority to first remediate the one or more devices with the highest value, the one or more devices with the highest risk, or the one or more devices with the greatest potential for disruption.
32. A method for protecting a computer network from vulnerabilities, the method comprising:
evaluating one or more risk factors to determine one of a plurality of levels of risk to each of a plurality of devices within the computer network, wherein at least one of the risk factors is a human factor used to assess risk posed by individuals that have access to each of the devices;
providing a plurality of remediation activities, wherein each remediation activity addresses a vulnerability of at least one of the plurality of devices;
prioritizing execution of the plurality of remediation activities, wherein the prioritization is based on the level of risk for each of the devices; and
executing the plurality of remediation activities in accordance with the prioritization.
33. The method of claim 32 , wherein the human factor is selected from a group of human factors comprising an emotional disposition factor, a geopolitical factor, a demographic factor, ajob positions factor, and a behavior factor.
34. The method of claim 32 , wherein another of the risk factors is a remediation factor used to assess risk posed to each of the devices by the execution of one of the remediation activities.
35. The method of claim 34 , wherein the assessment of risk using the remediation factor includes, for each remediation activity, comparing an amount of risk posed by not executing the remediation activity and an amount of risk posed by executing the remediation activity.
36. The method of claim 34 , further comprising:
recommending whether to execute each of the remediation activities based on the risk assessed by the remediation factor.
37. The method of claim 32 , wherein another of the risk factors is a life cycle factor used to assess risk to each of the devices based on variations of a value of each of the devices over time.
38. The method of claim 32 , further comprising:
scheduling an order of execution of each of the remediation activities based on the prioritization.
39. The method of claim 32 , further comprising:
identifying one or more devices that have a highest value, a highest risk, or would cause a greatest potential for disruption to the network upon succumbing to the one or more risk factors based on the evaluated level of risk to each of the devices.
40. The method of claim 39 , wherein the prioritization of the remediation activities is further based on a set of priorities for the network.
41. The method of claim 40 , wherein the set of priorities includes at least one of a priority to first remediate the one or more devices with the highest value, the one or more devices with the highest risk, or the one or more devices with the greatest potential for disruption.
42. A method for protecting a computer within a network from one or more vulnerabilities, the method comprising:
evaluating two or more risk factors to determine a level of risk to the computer, wherein a first risk factor is a human factor used to assess risk posed by individuals that have access to the computer and a second risk factor is a value of the computer;
providing at least one remediation activity for reducing the level of risk to the computer;
scheduling the at least one remediation activity to minimize adverse effects caused by the at least one remediation activity; and
executing the at least one remediation activities in accordance with the schedule.
43. The method of claim 42 , wherein the evaluated level of risk to the computer directly corresponds with the value of the computer.
44. The method of claim 42 , wherein the value of the computer dynamically changes over time in accordance with one of a periodic increase and decrease in the value over time or a steady decline in the value over time.
45. The method of claim 42 , wherein the value of the computer is based on a type of asset provided by the computer, wherein the type of asset includes one or more of a database or source code.