Monitoring information-security coverage to identify an exploitable weakness in the information-security coverage
Systems and methods are provided for monitoring information-security coverage to identify a vulnerability or risk in the information-security coverage. An information-security system can include computing systems, databases, a security server, etc. that can communicate data via a network. The server can be used to obtain data indicating a process for managing or monitoring information-security in the system and data indicating activity on the network, computing systems, server, or databases. The server then determines a metric based on the obtained data and the metric can indicate a risk or vulnerability in information-security coverage in the system. The server can then aggregate the data and transmit the aggregated data to a computing device. The computing device can generate an interface for outputting data for monitoring information-security coverage or identifying a vulnerability or risk in information-security coverage, which can improve the security of the information-security system.
1. A method comprising:
receiving, by a processing device, a data set associated with a framework for monitoring or managing information security, wherein the data set includes data about a plurality of controls indicating processes for monitoring a security level of an information-security system or identifying an exploitable weakness of the information-security system;
receiving, by the processing device, a selection of a control of the plurality of controls;
receiving, by the processing device, detected information-security data, the detected information-security data indicating activity on a computing device, a network, a server, or a database over a period of time;
determining, by the processing device, a plurality of information-security metrics based on the detected information-security data, wherein an information-security metric is usable for monitoring the security level of the information-security system or identifying the exploitable weakness of the information-security system over the period of time;
aggregating, by the processing device, the plurality of information-security metrics to form a plurality of information-security metric groups; and
generating, by the processing device, an interface for display that includes data associated with the detected information-security data, the plurality of controls, or the plurality of information-security metrics for determining one or more processes for improving the security level of the information-security system or mitigating the identified exploitable weakness of the information-security system.
2. The method of claim 1 , wherein aggregating the plurality of information-security metrics to form the plurality of information-security metric groups comprises:
comparing, by the processing device, a first information-security metric and a second information-security metric to determine a similarity between the first information-security metric and the second information-security metric, the similarity indicating that the first information-security metric and the second information-security metric are associated with a control of the plurality of controls; and
grouping, by the processing device, the first information-security metric and the second information-security metric to form a first information-security metric group based on the similarity.
3. The method of claim 2 , further comprising:
displaying, by the processing device, the control associated with the first information-security metric and the second information-security metric, wherein the interface comprises a user selectable portion associated with the control;
receiving, by the processing device, a selection of the user selectable portion; and
displaying, by the processing device, the first information-security metric or the second information-security metric in response to receiving the selection of the user selectable portion.
4. The method of claim 1 , wherein the detected information-security data comprises data indicating whether the computing device, the network, the server, or the database contains computational logic with an associated vulnerability.
5. The method of claim 1 , wherein determining the plurality of information-security metrics comprises:
receiving, by the processing device, detected information-security data comprising data indicating a number of computing devices in the information-security system associated with a vulnerability;
receiving, by the processing device, data indicating a tolerable number of computing devices in the information-security system associated with vulnerabilities; and
determining, by the processing device, an information-security metric by comparing the number of computing devices associated with a vulnerability and the tolerable number of computing devices in the information-security system associated with vulnerabilities, wherein the information-security metric indicates a percentage of the computing devices in compliance with the selected control.
6. The method of claim 1 , further comprising:
determining, by the processing device, a maturity level of an information-security metric of the plurality of information-security metrics by:
obtaining data indicating a quality of the detected information-security data; and
determining the maturity level of the information-security metric based on the quality of the detected information-security data, wherein the maturity level of the information-security metric indicates a reliability of the information-security metric for monitoring the security level of the information-security system or identifying the exploitable weakness of the information-security system.
7. The method of claim 6 , further comprising:
determining, by the processing device, the maturity level of the information-security metric based on at least one of the selected control of the plurality of controls, data indicating an availability of data for determining the information-security metric, or a method for delivering the data for determining the information-security metric.
8. The method of claim 1 , further comprising:
determining, by the processing device, an importance of the information-security metric for monitoring the security level of the information-security system or identifying the exploitable weakness of the information-security system by:
obtaining data indicating a weight value associated with the information-security metric; and
determining the importance of the information-security metric for monitoring the security level of the information-security system or identifying the exploitable weakness of the information-security system based on the weight value.
9. The method of claim 1 , further comprising:
receiving, by the processing device, the detected information-security data from the computing device;
determining, by the processing device, a maturity level of the computing device for providing the detected information-security data by:
obtaining data indicating a quality of the computing device for providing the detected information-security data; and
determining the maturity level of the of the computing device based on the quality of the computing device for providing the detected information-security data, wherein the maturity level of the computing device indicates a reliability of the computing device for detecting information-security data for monitoring the security level of the information-security system or identifying the exploitable weakness of the information-security system.
10. The method of claim 1 , further comprising:
aggregating, by the processing device, the detected information-security data over the period of time; and
generating, by the processing device, the interface for display that includes data associated with the aggregated detected information-security data for monitoring the security level of the information-security system or identifying the exploitable weakness of the information-security system.
11. A system comprising:
a processing device; and
a non-transitory computer-readable medium communicatively coupled to the processing device, wherein the processing device is configured to perform operations comprising:
receiving a data set associated with a framework for monitoring or managing information security, wherein the data set indicates a plurality of controls that are available for monitoring a security level of an information-security system or identifying an exploitable weakness of the information-security system;
receiving a selection of a control of the plurality of controls;
receiving detected information-security data corresponding to the selected control, the detected information-security data indicating activity on a computing device, a network, a server, or a database over a period of time;
determining a plurality of information-security metrics based on the detected information-security data, wherein an information-security metric is usable for monitoring the security level of the information-security system or identifying the exploitable weakness of the information-security system over the period of time;
aggregating the plurality of information-security metrics to form a plurality of information-security metric groups; and
generating an interface for display that includes the detected information-security data, the plurality of controls, or the plurality of information-security metrics.
12. The system of claim 11 , wherein the processing device is further configured to aggregate the plurality of information-security metrics to form the plurality of information-security metric groups by:
comparing a first information-security metric and a second information-security metric to determine a similarity between the first information-security metric and the second information-security metric, the similarity indicating that the first information-security metric and the second information-security metric are associated with a control of the plurality of controls; and
grouping the first information-security metric and the second information-security metric to form a first information-security metric group based on the similarity.
13. The system of claim 12 , wherein the processing device is further configured to:
display the control associated with the first information-security metric and the second information-security metric, wherein the interface comprises a user selectable portion associated with the control;
receive a selection of the user selectable portion; and
display the first information-security metric or the second information-security metric in response to receiving the selection of the user selectable portion.
14. The system of claim 11 , wherein the detected information-security data comprises data indicating whether the computing device, the network, the server, or the database contains computational logic with an associated vulnerability.
15. The system of claim 11 , wherein the processing device is further configured to determine the plurality of information-security metrics by:
receiving detected information-security data comprising data indicating a number of computing devices in the information-security system associated with a vulnerability;
receiving data indicating a tolerable number of computing devices in the information-security system associated with vulnerabilities; and
determining an information-security metric by comparing the number of computing devices associated with a vulnerability and the tolerable number of computing devices in the information-security system associated with vulnerabilities, wherein the information-security metric indicates a percentage of the computing devices in compliance with the selected control.
16. The system of claim 11 , wherein the processing device is further configured to:
determine a maturity level of an information-security metric of the plurality of information-security metrics by:
obtaining data indicating a quality of the detected information-security data; and
determining the maturity level of the information-security metric based on the quality of the detected information-security data, wherein the maturity level of the information-security metric indicates a reliability of the information-security metric for monitoring the security level of the information-security system or identifying the exploitable weakness of the information-security system.
17. The system of claim 16 , wherein the processing device is further configured to:
determine the maturity level of the information-security metric based on at least one of the selected control of the plurality of controls, data indicating an availability of data for determining the information-security metric, or a method for delivering the data for determining the information-security metric.
18. The system of claim 11 , wherein the processing device is further configured to:
determine an importance of the information-security metric for monitoring the security level of the information-security system or identifying the exploitable weakness of the information-security system by:
obtaining data indicating a weight value associated with the information-security metric; and
determining the importance of the information-security metric for monitoring the security level of the information-security system or identifying the exploitable weakness of the information-security system based on the weight value.
19. The system of claim 11 , wherein the processing device is further configured to:
receive the detected information-security data from the computing device;
determine a maturity level of the computing device for providing the detected information-security data by:
obtaining data indicating a quality of the computing device for providing the detected information-security data; and
determining the maturity level of the of the computing device based on the quality of the computing device for providing the detected information-security data, wherein the maturity level of the computing device indicates a reliability of the computing device for detecting information-security data for monitoring the security level of the information-security system or identifying the exploitable weakness of the information-security system.
20. A non-transitory computer-readable medium comprising program code that is executable by a processing device for causing the processing device to perform operations including:
receiving information-security data indicating information-security activity detected in a computing environment over a timespan by a plurality of information-security measurement modules;
determining a plurality of information-security metrics based on the detected information-security data, wherein at least one information-security metric of the plurality of information-security metrics is configured to indicate a security risk or an exploitable weakness in the computing environment; and
generating an interactive user interface for display that includes the plurality of information-security metrics categorized into a plurality of groups, the interactive user interface being usable by a user for improving a security level of the computing environment.