System and method for security analysis

1. A computer-implemented security analysis method, comprising:

determining a data risk value for data of an endpoint based on a number of classified files within the data and a type of classified files within the data;

scanning software and firmware on the endpoint to determine a cyber security risk value based on a number of vulnerabilities of the endpoint;

determining an endpoint risk value for the endpoint based on a user risk value and the cyber security risk value;

determining a channel risk value for a set of channels through which the data is conveyable by the endpoint based on a number of channels within the set of channels and a type of channels within the set of channels;

determining an overall security risk level of the endpoint based on the data risk value, the endpoint risk value, and the channel risk value of the endpoint;

in response to the overall security risk level being greater than a threshold, displaying the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint;

determining a high risk area based on the data risk value, the endpoint risk value, and the channel risk value; and

determining actions to reduce risk in the high risk area, wherein different actions correspond to different risk areas, and

wherein the actions comprise:

in response to the high risk area corresponding to the channel risk value, blocking Internet access of the endpoint via a router or a firewall;

in response to the high risk area corresponding to the data risk value, limiting data of the endpoint to non-classified files or files with low sensitivity; and

in response to the high risk area corresponding to the user risk value in the endpoint risk value, notifying users of the endpoint to attend training on computing behavior.

2. The computer-implemented security analysis method of claim 1 , wherein displaying the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint comprises:

displaying the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint using different fonts or colors.

3. The computer-implemented security analysis method of claim 1 , wherein:

the endpoint comprises a computing device; and

displaying the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint comprises: rendering a map showing the endpoint and its connection with one or more other endpoints in a network and showing one or more risk levels of the one or more other endpoints.

4. The computer-implemented security analysis method of claim 1 , wherein:

the overall security risk level is represented by an icon with at least one of an associated color, size, or shape.

5. The computer-implemented security analysis method of claim 1 , wherein:

the user risk value is determined based on a user behavior associated with the data or the endpoint.

6. The computer-implemented security analysis method of claim 1 , wherein:

the cyber security risk value is determined based a number of malware running on the endpoint or a number of security updates to be applied to the endpoint.

7. A security analysis system, comprising one or more processors and one or more non-transitory computer-readable memories coupled to the one or more processors and configured with instructions executable by the one or more processors to cause the system to perform operations comprising:

determining a data risk value for data of an endpoint based on a number of classified files within the data and a type of classified files within the data;

scanning software and firmware on the endpoint to determine a cyber security risk value based on a number of vulnerabilities of the endpoint;

determining an endpoint risk value for the endpoint based on a user risk value and the cyber security risk value;

determining a channel risk value for a set of channels through which the data is conveyable by the endpoint based on a number of channels within the set of channels and a type of channels within the set of channels;

determining an overall security risk level of the endpoint based on the data risk value, the endpoint risk value, and the channel risk value of the endpoint;

in response to the overall security risk level being greater than a threshold, displaying the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint;

determining a high risk area based on the data risk value, the endpoint risk value, and the channel risk value; and

determining actions to reduce risk in the high risk area, wherein different actions correspond to different risk areas, and

wherein the actions comprise:

in response to the high risk area corresponding to the channel risk value, blocking Internet access of the endpoint via a router or a firewall;

in response to the high risk area corresponding to the data risk value, limiting data of the endpoint to non-classified files or files with low sensitivity; and

in response to the high risk area corresponding to the user risk value in the endpoint risk value, notifying users of the endpoint to attend training on computing behavior.

8. The security analysis system of claim 7 , wherein displaying the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint comprises:

displaying the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint using different fonts or colors.

9. The security analysis system of claim 7 , wherein:

the endpoint comprises a computing device; and

displaying the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint comprises: rendering a map showing the endpoint and its connection with one or more other endpoints in a network and showing one or more risk levels of the one or more other endpoints.

10. The security analysis system of claim 7 , wherein:

the overall security risk level is represented by an icon with at least one of an associated color, size, or shape.

11. The security analysis system of claim 7 , wherein:

the user risk value is determined based on a user behavior associated with the data or the endpoint.

12. The security analysis system of claim 7 , wherein:

the cyber security risk value is determined based on a number of malware running on the endpoint or a number of security updates to be applied to the endpoint.

13. A non-transitory computer-readable storage medium for security analysis, configured with instructions executable by one or more processors to cause the one or more processors to perform operations comprising:

determining a data risk value for data of an endpoint based on a number of classified files within the data and a type of classified files within the data;

scanning software and firmware on the endpoint to determine a cyber security risk value based on a number of vulnerabilities of the endpoint;

determining an endpoint risk value for the endpoint based on a user risk value and the cyber security risk value;

determining a channel risk value for a set of channels through which the data is conveyable by the endpoint based on a number of channels within the set of channels and a type of channels within the set of channels;

determining an overall security risk level of the endpoint based on the data risk value, the endpoint risk value, and the channel risk value of the endpoint;

in response to the overall security risk level being greater than a threshold, displaying the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint;

determining a high risk area based on the data risk value, the endpoint risk value, and the channel risk value; and

determining actions to reduce risk in the high risk area, wherein different actions correspond to different risk areas, and

wherein the actions comprise:

in response to the high risk area corresponding to the channel risk value, blocking Internet access of the endpoint via a router or a firewall;

in response to the high risk area corresponding to the data risk value, limiting data of the endpoint to non-classified files or files with low sensitivity; and

in response to the high risk area corresponding to the user risk value in the endpoint risk value, notifying users of the endpoint to attend training on computing behavior.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint comprises:

displaying the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint using different fonts or colors.

15. The non-transitory computer-readable storage medium of claim 13 , wherein:

the endpoint comprises a computing device; and

displaying the data risk value, the endpoint risk value, and the channel risk value underlying the overall security risk level of the endpoint comprises: rendering a map showing the endpoint and its connection with one or more other endpoints in a network and showing one or more risk levels of the one or more other endpoints.

16. The non-transitory computer-readable storage medium of claim 13 , wherein:

the overall security risk level is represented by an icon with at least one of an associated color, size, or shape.

17. The non-transitory computer-readable storage medium of claim 13 , wherein:

the user risk value is determined based on a user behavior associated with the data or the endpoint.

18. The non-transitory computer-readable storage medium of claim 13 , wherein:

the cyber security risk value is determined based on a number of malware running on the endpoint or a number of security updates to be applied to the endpoint.