Assisted improvement of security reliance scores
In representative embodiments, a system and method to recommend improvements to a security reliance score is illustrated. Individual cryptographic key material has an associated security reliance score that is calculated based on attributes of associated with the cryptographic key material. The system identifies an improvement goal and evaluates a selected cross-section of key material and their associated scores. Based on the evaluation, the system creates an exemplary model having attributes to use as the basis of improvement. This model is then used to calculate improvement potential for a selected cross-section of scores by calculating the improvement that would occur if changes were made in the selected cross-section to match the model. Based on the improvement potential, the system can then automatically initiate action(s) to improve scores or present options for action(s) to a user for selection and initiation.
1. A method for improving security reliance scores of cryptographic key material comprising:
obtaining a set of user cryptographic key material from a plurality of systems and a set of comparison cryptographic key material, each cryptographic key material in the respective sets having a plurality of attributes and an associated security reliance score based on the attributes of the cryptographic key material;
identifying an improvement goal comprising a primary improvement metric and a secondary improvement metric;
creating an exemplary model cryptographic key material by performing operations comprising:
based on the primary improvement metric, selecting a target comparison set of cryptographic key material to use as a basis for a model cryptographic key material;
based on the secondary improvement metric, selecting at least one cryptographic key material in the target comparison set of cryptographic key material as the exemplary model cryptographic key material such that attributes of the exemplary model cryptographic key material comprise attributes of the selected at least one cryptographic key material;
selecting a subset of user cryptographic key material for improvement;
calculating improvement potential by performing operations comprising:
calculating a first metric for the set of user cryptographic key material based on the primary improvement metric;
creating a hypothetical set of user cryptographic key material by replacing the selected subset of user cryptographic key material with cryptographic key material having attributes of the exemplary model cryptographic key material;
calculating a second metric for the hypothetical set of user cryptographic key material based on the primary improvement metric;
using as the improvement potential the difference between the second metric and the first metric; and
executing an improvement action resulting in changes to attributes of at least a portion of the set of user cryptographic material on the systems where they are utilized to realize at least a portion of the improvement potential.
2. The method of claim 1 , wherein the primary improvement metric comprises at least one of:
moving cryptographic key material into a percentile;
moving cryptographic key material out of a percentile; and
increasing or decreasing an identified metric.
3. The method of claim 2 wherein the identified metric comprises at least one of:
an average security reliance score for the set of user cryptographic key material;
a median security reliance score for the set of user cryptographic key material;
a maximum security reliance score for the set of user cryptographic key material;
a minimum security reliance score for the set of user cryptographic key material; and
a dispersion metric.
4. The method of claim 1 wherein the secondary improvement metric comprises at least one of:
lower cost;
increasing or decreasing a secondary metric; and
most common attributes.
5. The method of claim 1 further comprising:
calculating a comparison metric for the set of comparison cryptographic key material; and
presenting, as part of a user interface, the comparison metric along with a metric calculated for the set of user cryptographic key material.
6. The method of claim 1 , wherein the improvement goal comprises at least one of:
increasing a number of cryptographic key material in a designated percentile with lower cost;
increasing the number of cryptographic key material in the designated percentile with most common attributes;
increasing the number of cryptographic key material in the designated percentile while increasing a metric of the user set of cryptographic key material;
increasing the number of cryptographic key material in the designated percentile while decreasing a metric of the user set of cryptographic key material;
decreasing the number of cryptographic key material in a second designated percentile with lower cost;
decreasing the number of cryptographic key material in the second designated percentile with most common attributes;
decreasing the number of cryptographic key material in a designated percentile while increasing the metric of the user set of cryptographic key material;
decreasing the number of cryptographic key material in a designated percentile while decreasing the metric of the user set of cryptographic key material;
increasing the metric of the user set of cryptographic key material with lower cost;
decreasing the metric of the user set of cryptographic key material with lower cost;
increasing the metric of the user set of cryptographic key material with most common attributes; and
decreasing the metric of the user set of cryptographic key material with most common attributes.
7. The method of claim 1 , further comprising:
identifying occurrence of an event;
responsive to the occurrence of the event, performing the operations of claim 1 .
8. The method of claim 7 wherein the occurrence of the event comprises a time of a schedule.
9. The method of claim 4 , wherein the cost comprises at least one of: a monetary cost, a metric indicating complexity to implement, and a metric indicating time to implement.
10. The method of claim 1 further comprising:
presenting a user interface to a user, the user interface comprising at least one user interface control allowing a user to select the set of user cryptographic key material;
presenting to the user via the user interface, the calculated improvement potential along with at least one action, the at least one action including the improvement action; and
receiving via the user interface, user selection of the improvement action.
11. A machine-readable medium having executable instructions encoded thereon, which, when executed by at least one processor of a machine, cause the machine to perform operations comprising:
obtain a set of user cryptographic key material from a plurality of physical systems and a set of comparison cryptographic key material, each cryptographic key material in the respective sets having an associated security reliance score based on attributes of the cryptographic key material;
identify an improvement goal comprising a primary improvement metric and an optional secondary improvement metric;
create an exemplary model cryptographic key material by performing operations comprising:
based on the primary improvement metric, select a target comparison set of cryptographic key material to use as a basis for a model cryptographic key material;
when the improvement goal includes the optional secondary improvement metric, based on the optional secondary improvement metric select at least one cryptographic key material in the target comparison set of cryptographic key material as the exemplary model cryptographic key material;
when the improvement goal does not include the optional secondary improvement metric, selecting a default secondary improvement metric and based on the default secondary improvement metric select at least one cryptographic key material in the target comparison set of cryptographic key material as the exemplary model cryptographic key material;
selecting a subset of user cryptographic key material for improvement;
calculating improvement potential by performing operations comprising:
calculating a first metric for the set of user cryptographic key material based on the primary improvement metric;
creating a hypothetical set of user cryptographic key material by replacing the selected subset of user cryptographic key material with cryptographic key material having attributes of the exemplary model cryptographic key material;
calculating a second metric for the hypothetical set of user cryptographic key material based on the primary improvement metric;
using as the improvement potential the difference between the second metric and the first metric; and
executing an improvement action resulting in changes to attributes of at least a portion of the set of user cryptographic material on the systems where they reside to realize at least a portion of the improvement potential.
12. The machine-readable medium of claim 11 , wherein the operations further comprise:
identify a set of improvement actions by:
compare an attribute of the exemplary model to a corresponding attribute in an entry in the subset of user cryptographic key material selected for improvement;
add to the set of improvement actions an action that changes the attribute of the entry to have a value equivalent to a value of the attribute of the at least one exemplary model.
13. The machine-readable medium of claim 11 wherein the primary improvement metric comprises at least one of:
moving cryptographic key material into a percentile;
moving cryptographic key material out of a percentile; and
increasing or decreasing an identified metric.
14. The machine-readable medium of claim 13 wherein the identified metric comprises at least one of:
an average security reliance score for the set of user cryptographic key material;
a median security reliance score for the set of user cryptographic key material;
a maximum security reliance score for the set of user cryptographic key material;
a minimum security reliance score for the set of user cryptographic key material; and
a dispersion metric.
15. The machine-readable medium of claim 11 wherein the optional secondary improvement metric comprises at least one of:
lower cost;
increasing or decreasing a secondary metric; and
most common attributes.
16. The machine-readable medium of claim 11 wherein the default secondary improvement metric comprises increasing an average security reliance score.
17. A system comprising:
a processor and executable instructions accessible on a machine-readable medium that, when executed, cause the system to perform operations comprising:
obtain a set of user cryptographic key material from a plurality of systems and a set of comparison cryptographic key material, each cryptographic key material in the respective sets being utilized on at least one physical system and having an associated security reliance score based on attributes of the cryptographic key material;
identify an improvement goal comprising a primary improvement metric and an optional secondary improvement metric;
create an exemplary model cryptographic key material by performing operations comprising:
based on the primary improvement metric, select a target comparison set of cryptographic key material to use as a basis for a model cryptographic key material;
when the improvement goal includes the optional secondary improvement metric, based on the optional secondary improvement metric select at least one cryptographic key material in the target comparison set of cryptographic key material as the exemplary model cryptographic key material;
when the improvement goal does not include the optional secondary improvement metric, selecting a default secondary improvement metric and based on the default secondary improvement metric select at least one cryptographic key material in the target comparison set of cryptographic key material as the exemplary model cryptographic key material;
selecting a subset of user cryptographic key material for improvement;
calculating improvement potential by performing operations comprising:
calculating a first metric for the set of user cryptographic key material based on the primary improvement metric;
creating a hypothetical set of user cryptographic key material by replacing the selected subset of user cryptographic key material with cryptographic key material having attributes of the exemplary model cryptographic key material;
calculating a second metric for the hypothetical set of user cryptographic material based on the primary improvement metric;
using as the improvement potential the difference between the second metric and the first metric; and
initiate an improvement action that results in modification of cryptographic key material on the systems where they reside to realize at least a portion of the improvement potential.
18. The system of claim 17 , wherein the operations further comprise:
present a user interface to a user, the user interface comprising at least one user interface control allowing a user to select the set of user cryptographic key material;
present to the user via the user interface, the calculated improvement potential along with at least one action, the at least one action including the improvement action; and
receive via the user interface, user selection of the improvement action.
19. The system of claim 17 wherein the operations are performed responsive to occurrence of an event.
20. The system of claim 19 , wherein the occurrence of the event comprises a time of a schedule.