System and method for cybersecurity analysis and score generation for insurance purposes
A system for comprehensive cybersecurity analysis and rating based on heterogeneous data and reconnaissance is which uses a high volume web crawler directed by an automated planning service module to establish a scope of cybersecurity analysis for a target network, perform reconnaissance of the target network, and assign scores for several types of reconnaissance, and uses a cybersecurity scoring engine to generate an aggregated cybersecurity rating from the assigned scores.
1. A system for comprehensive cybersecurity analysis and rating based on heterogeneous data and reconnaissance, comprising:
a computing device comprising a memory, a processor, and a network interface; and
a high volume web crawler comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to obtain information from the Internet as directed by an automated planning service module;
an automated planning service module, comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
establish a scope of cybersecurity analysis by:
defining a target network by identifying internet protocol addresses and subdomains of the target network;
identify web applications used by the target network;
identify personnel within the target network;
gather version and update information for hardware and software systems within the boundary of the target network; and
identify content of interest contained within the target network; and
perform reconnaissance of the target network by:
verifying domain name system information for each internet protocol address and subdomain of the target network, and each external website and network, and assigning an Internet reconnaissance score;
collecting domain name system leak information by identifying improper network configurations in the internet protocol addresses and subdomains of the target network, and assigning a domain name system leak information score;
analyzing web applications used by the target network to identify vulnerabilities in the web applications that could allow unauthorized access to the target network, and assigning a web application security score;
searching social media networks for information of concern related to the personnel identified within the target network, and assigning a social network score;
checking version and update information for the hardware and software systems within the boundary of the target network, and assigning a patching frequency score; and
performing an Internet search to identify references to the content of interest, and assigning an open-source intelligence score; and
a cybersecurity scoring engine comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:
generate a weighted cybersecurity rating by:
assigning a weight to each of the Internet reconnaissance score, the domain name system leak information score, the web application security score, the social network score, the patching frequency score, and the open-source intelligence score;
aggregating the weighted scores into the weighted cybersecurity rating.
2. The system of claim 1 , further comprising a task scheduling engine comprising a fourth plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the fourth plurality of programming instructions, when operating on the processor, cause the computing device to schedule computer tasks and programs to run at certain intervals.
3. A method for comprehensive cybersecurity analysis and rating based on heterogeneous data and reconnaissance, comprising the following steps:
establishing a scope of cybersecurity analysis using a high volume web crawler directed by an automated planning service module, the establishment of the scope of cybersecurity analysis comprising the following steps:
defining a target network by identifying internet protocol addresses and subdomains of the target network;
identifying web applications used by the target network;
identifying personnel within the target network;
gathering version and update information for hardware and software systems within the boundary of the target network; and
identifying content of interest contained within the target network; and
performing reconnaissance of the target network using a high volume web crawler directed by an automated planning service module, the reconnaissance comprising the following steps:
verifying domain name system information for each internet protocol address and subdomain of the target network, and each external website and network, and assigning an Internet reconnaissance score;
collecting domain name system leak information by identifying improper network configurations in the internet protocol addresses and subdomains of the target network, and assigning a domain name system leak information score;
analyzing web applications used by the target network to identify vulnerabilities in the web applications that could allow unauthorized access to the target network, and assigning a web application security score;
searching social media networks for information of concern related to the personnel identified within the target network, and assigning a social network score;
checking version and update information for the hardware and software systems within the boundary of the target network, and assigning a patching frequency score; and
performing an Internet search to identify references to the content of interest, and assigning an open-source intelligence score; and
generating a weighted cybersecurity rating using a cybersecurity scoring engine, the generation of the weighted cybersecurity rating comprising the following steps:
assigning a weight to each of the Internet reconnaissance score, the domain name system leak information score, the web application security score, the social network score, the patching frequency score, and the open-source intelligence score;
aggregating the weighted scores into the weighted cybersecurity rating.
4. The method of claim 3 , further comprising the step of scheduling computer tasks and programs to run at certain intervals.