Security reliance scoring for cryptographic material and processes
View Patent ↗In representative embodiments, a system and method to calculate a security reliance score is illustrated. The security reliance score is calculated from an aggregation of property sub-scores. The property sub-scores are, in turn, based on scores for attributes that make up the properties. A learning model is employed to adjust scores over time based on collected information. Additionally, statistical sampling can adjust scores based on context, including geo-location context. Security reliance scores can be used to identify weaknesses that should be fixed in cryptographic material and/or configurations. The system can also make recommendations for changes that will have the biggest impact on security reliance scores. Additional uses are also identified.
1. A computer implemented method for scoring the security reliance of cryptographic material comprising:
identify a plurality of security properties relevant to cryptographic material of a cryptographic key certificate, each of the plurality of security properties having a plurality of attributes; assigning an initial attribute score to each of the attributes;
calculating, by one or more computers, a property score for each of the plurality of properties based on the initial attribute score for the corresponding plurality of attributes and an aggregation function selected from a plurality of aggregation functions;
aggregating, by the one or more computers, the corresponding property score for each of the plurality of properties to produce a security reliance score for the cryptographic material;
calculating, by the one or more computers, an anomaly score for the cryptographic material based on statistical sampling of survey data, obtained via a network from a plurality of systems, comprising at least one context factor for a population of cryptographic material;
adjusting, by the one or more computers, the security reliance score based on the anomaly score based on a mapping function that takes as an input the security reliance score and the anomaly score; and
presenting the adjusted security reliance score as part of a security evaluation.
2. The method of claim 1 , further comprising:
calculating at least one parameter from the survey data for a model that captures changes of at least one security attribute over time;
calculating an update vector using the calculated parameters and the survey data to identify a change in at least one security attribute over time;
updating a score for the at least one security attribute using the update vector and an existing score for the at least one security attribute, thereby adjusting the existing score for the at least one security attribute for the change in the at least one security attribute over time.
3. The method of claim 2 further comprising:
recalculating a property score based on the updated score for the at least one security attribute; and
reaggregating the property scores for each of the plurality of properties to produce an updated security reliance score for the cryptographic material.
4. The method of claim 1 wherein the at least one context factor is a geo-location associated with the cryptographic material.
5. The method of claim 4 wherein the anomaly score is based upon a probability that certificates within the geo-location adhere to a given configuration.
6. The method of claim 1 further comprising:
aggregating adjusted security reliance scores across a system, a business line, enterprise or a business vertical to obtain an aggregated security reliance score;
comparing the aggregated security score to peer aggregated security scores and presenting a result of the comparison to convey relative security reliance.
7. The method of claim 1 , wherein the plurality of aggregation functions comprises:
a weighted sum function;
a table lookup; and
a combination of the lookup table and the weighted sum.
8. The method of claim 1 , wherein the survey data comprises data collected over time to allow evaluation of how the data changes over time.
9. A machine-readable device having executable instructions encoded thereon, which, when executed by at least one processor of a machine, cause the machine to perform operations comprising:
identify a plurality of security properties relevant to cryptographic material of a cryptographic key certificate, each of the plurality of security properties having a plurality of attributes;
assign an initial attribute score to each of the attributes;
calculate a property score for each of the plurality of properties based on the initial attribute score for the corresponding plurality of attributes and an aggregation function selected from a plurality of aggregation functions;
aggregate the corresponding property score for each of the plurality of properties to produce a security reliance score for the cryptographic material;
calculate at least one parameter from survey data, obtained via a network from a plurality of systems, for a model that reflects changes of at least one security attribute over time;
calculate an update vector using the calculated at least one parameter and the survey data to identify a change in at least one security attribute over time;
update an attribute score for the at least one security attribute using the update vector and an existing score for the at least one security attribute, thereby adjusting the existing score for the at least one security attribute for the change in the at least one security attribute over time;
re-aggregate a corresponding property score based on the updated attribute score;
re-aggregate the corresponding property score for each of the plurality of properties to produce an updated security reliance score for the cryptographic material; and
present the updated security reliance score as part of a security evaluation.
10. The machine-readable medium of claim 9 , wherein the operations further comprise:
calculate an anomaly score for the cryptographic material based on statistical sampling of survey data comprising at least one context factor for a population of cryptographic material;
adjust the security reliance score based on the anomaly score based on a mapping function that takes as an input the security reliance score and the anomaly score.
11. The machine-readable medium of claim 9 wherein the operations further comprise:
calculate an anomaly score for the cryptographic material based on statistical sampling of survey data comprising at least one context factor for a population of cryptographic material;
adjust the updated security reliance score based on the anomaly score based on a mapping function that takes as an input the security reliance score and the anomaly score.
12. The machine-readable medium of claim 11 wherein the at least one context factor is a geo-location associated with the cryptographic material.
13. The machine-readable medium of claim 12 wherein the anomaly score is based upon a probability that certificates within the geo-location adhere to a given configuration.
14. The machine-readable medium of claim 9 wherein the operations further comprise:
aggregating updated security reliance scores across a system, a business line, enterprise or a business vertical to obtain an aggregated security reliance score;
comparing the aggregated security score to peer aggregated security scores and presenting a result of the comparison to convey relative security reliance.
15. The machine-readable medium of claim 9 , wherein the plurality of aggregation functions comprises:
a weighted sum function;
a table lookup; and
a combination of the lookup table and the weighted sum.
16. The machine-readable medium of claim 9 , wherein the survey data comprises data collected over time to allow evaluation of how the data changes over time.
17. A system comprising:
a hardware processor and executable instructions accessible on a machine-readable medium that, when executed, cause the processor to perform operations comprising:
identify a plurality of security properties relevant to cryptographic material of a cryptographic key certificate, each of the plurality of security properties having a plurality of attributes; assign an initial attribute score to each of the attributes;
calculate a property score for each of the plurality of properties based on the initial attribute score for the corresponding plurality of attributes and an aggregation function selected from a plurality of aggregation functions;
aggregate the corresponding property score for each of the plurality of properties to produce a security reliance score for the cryptographic material;
calculate an anomaly score for the cryptographic material based on statistical sampling of survey data, obtained via a network from a plurality of systems, comprising at least one context factor for a population of cryptographic material;
adjust the security reliance score based on the anomaly score based on a mapping function that takes as an input the security reliance score and the anomaly score; and
present the adjusted security reliance score as part of a security evaluation.
18. The system of claim 17 , wherein the operations further comprise:
calculate at least one parameter from the survey data for a model that captures changes of at least one security attribute over time;
calculate an update vector using the calculated parameters and the survey data to identify a change in at least one security attribute over time;
update a score for the at least one security attribute using the update vector and an existing score for the at least one security attribute, thereby adjusting the existing score for the at least one security attribute for the change in the at least one security attribute over time.
19. The system of claim 18 wherein the operations further comprise:
recalculate a property score based on the updated score for the at least one security attribute; and
re-aggregate the property scores for each of the plurality of properties to produce an updated security reliance score for the cryptographic material.
20. The system of claim 18 , wherein the survey data comprises data collected over time to allow evaluation of how the data changes over time.