Determining monetary loss due to security risks in a computer system
A method of determining a monetary loss due to security risks associated with a plurality of applications executing on a plurality of computers in a computer system is provided. The method assigns a set of loss levels from a plurality of loss levels to each application. Each loss level in the set of loss levels corresponds to a different type of risk associated to an application. The method define a presentation that identifies a total monetary residual risk of loss due to security risks for the plurality of applications by assigning a monetary value to the set of loss levels assigned to each application. The method receives an adjustment to a loss level for at least one application. The method defines a presentation that identifies a revised total monetary residual risk of loss based on the adjustment to said at least one loss level.
1. A method of determining a monetary loss due to security risks associated with a plurality of applications executing on a plurality of computers in a computer system, the method comprising:
assigning to each application a set of loss levels from a plurality of loss levels, each loss level in the set of loss levels corresponding to a different type of risk associated to an application;
defining a presentation that identifies a total monetary residual risk of loss due to security risks for the plurality of applications by assigning a monetary value to the set of loss levels assigned to each application;
receiving an adjustment to a loss level for at least one application; and
defining a presentation that identifies a revised total monetary residual risk of loss based on the adjustment to said at least one loss level.
2. The method of claim 1 further comprising:
receiving an adjustment to the monetary residual risk of loss for at least one loss level; and
defining a presentation that identifies a revised total monetary residual risk of loss based on the adjustment to the monetary residual risk of loss.
3. The method of claim 2 , wherein receiving an adjustment to a loss level for an application comprises:
displaying the plurality of loss levels associated with the application; and
receiving a selection of a loss level for a particular type of risk associated to the application that is different than a current loss level for the particular type of risk associated with the application.
4. The method of claim 1 further comprising:
directing a set of machine-executable processes to examine an operating environment of a set of applications executing on the plurality of computers to identify security risks in the computer system; and
defining a presentation that identifies a revised total monetary residual risk of loss based on the examining of the operating environment.
5. The method of claim 4 further comprising:
receiving an adjustment to the monetary residual risk of loss for at least one loss level based on the security risks identified in the examination of the operating environment; and
defining a presentation that identifies a revised total monetary residual risk of loss based on the adjustment to said at least one loss level.
6. The method of claim 1 , wherein the residual risk of loss for each application is determined as a function of a loss due to an exploit of the application and a probability of occurrence of the exploit.
7. The method of claim 1 , wherein the residual risk of loss for each application is determined by monitoring the application executing on one or more computers in the computer system.
8. The method of claim 1 , wherein the value of the monetary residual risk of loss is presented as a currency value.
9. The method of claim 1 , wherein the type of risk associated to an application comprises one or more of an inherent risk of loss, a potential effect of loss of confidentiality caused by a threat to the application, a potential effect of loss on integrity caused by a threat to the application, and a potential effect of a loss of availability caused by a threat to the application.
10. A non-transitory machine readable medium storing a program for determining a monetary loss due to security risks associated with a plurality of applications executing on a plurality of computers in a computer system, the program executable by at least one processing unit, the program comprising sets of instructions for:
assigning to each application a set of loss levels from a plurality of loss levels, each loss level in the set of loss levels corresponding to a different type of risk associated to an application;
defining a presentation that identifies a total monetary residual risk of loss due to security risks for the plurality of applications by assigning a monetary value to the set of loss levels assigned to each application;
receiving an adjustment to a loss level for at least one application; and
defining a presentation that identifies a revised total monetary residual risk of loss based on the adjustment to said at least one loss level.
11. The non-transitory machine readable medium of claim 10 , the program further comprising sets of instructions for:
receiving an adjustment to the monetary residual risk of loss for at least one loss level; and
defining a presentation that identifies a revised total monetary residual risk of loss based on the adjustment to the monetary residual risk of loss.
12. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for receiving an adjustment to a loss level for an application comprises sets of instructions for:
displaying the plurality of loss levels associated with the application; and
receiving a selection of a loss level for a particular type of risk associated to the application that is different than a current loss level for the particular type of risk associated with the application.
13. The non-transitory machine readable medium of claim 10 , the program further comprising sets of instructions for:
directing a set of machine-executable processes to examine an operating environment of a set of applications executing on the plurality of computers to identify security risks in the computer system; and
defining a presentation that identifies a revised total monetary residual risk of loss based on the examining of the operating environment.
14. The non-transitory machine readable medium of claim 13 , the program further comprising sets of instructions for:
receiving an adjustment to the monetary residual risk of loss for at least one loss level based on the security risks identified in the examination of the operating environment; and
defining a presentation that identifies a revised total monetary residual risk of loss based on the adjustment to said at least one loss level.
15. The non-transitory machine readable medium of claim 10 , wherein the residual risk of loss for each application is determined as a function of a loss due to an exploit of the application and a probability of occurrence of the exploit.
16. The non-transitory machine readable medium of claim 10 , wherein the residual risk of loss for each application is determined by monitoring the application executing on one or more computers in the computer system.
17. The non-transitory machine readable medium of claim 10 , wherein the value of the monetary residual risk of loss is presented as a currency value.
18. The non-transitory machine readable medium of claim 10 , wherein the type of risk associated to an application comprises one or more of an inherent risk of loss, a potential effect of loss of confidentiality caused by a threat to the application, a potential effect of loss on integrity caused by a threat to the application, and a potential effect of a loss of availability caused by a threat to the application.