Comprehensive risk assessment
Systems, methods, and related technologies for determining a comprehensive risk score or value are described. The risk score determination may include selecting an entity communicatively coupled to a network and determining a cyber-attack likelihood value and a cyber-attack impact value associated with the entity. A cyber-attack risk may then be determined based on the cyber-attack likelihood value and a cyber-attack impact value associated with the entity. An operational failure likelihood value and an operational failure impact value associated with the entity can be determined. An operational failure risk based on the operational failure likelihood value and the operational failure impact value associated with the entity can be determined. A risk value may then be determined for the entity based on the cyber-attack risk and the operational failure risk and the risk value for the entity can be stored.
1. A method comprising:
performing, for each of a plurality of entities, a following comprising:
selecting an entity of the plurality of entities communicatively coupled to a network;
determining a cyber-attack likelihood value and a cyber-attack impact value associated with the entity;
determining a cyber-attack risk based on the cyber-attack likelihood value and a cyber-attack impact value associated with the entity;
determining an operational failure likelihood value and an operational failure impact value associated with the entity;
determining an operational failure risk based on the operational failure likelihood value and the operational failure impact value associated with the entity;
determining a risk value for the entity based on the cyber-attack risk and the operational failure risk;
storing the risk value for the entity;
determining a risk value for a location based on the plurality of risk values associated with the plurality of entities; and
performing a remediation action based on the risk value for the location, wherein the remediation action comprises at least one of changing network access of the entity, initiating a patch for the entity, or updating the entity.
2. The method of claim 1 , wherein the cyber-attack likelihood value is based on at least one of an alert, a vulnerability, a direct connection with a public entity, or a proximity to an infected or vulnerable entity.
3. The method of claim 1 , wherein the cyber-attack impact value is based on at least one of entity criticality, network criticality, or proximity to a critical entity.
4. The method of claim 1 , wherein the operational failure likelihood value is based on an alert.
5. The method of claim 1 , wherein the operational failure impact value is based on at least one of an entity criticality, a network criticality, or proximity to a critical entity.
6. The method of claim 1 , wherein the risk value for the entity is a maximum of the cyber-attack risk and the operational failure risk.
7. The method of claim 1 further comprising:
determining a risk value for a location based on a plurality of risk values associated with a plurality of entities associated with the location.
8. The method of claim 7 , wherein the location is at least one of a geographic region, a plant, a network, or a network segment.
9. A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
perform for each of a plurality of entities:
select an entity of the plurality of entities communicatively coupled to a network;
determine a cyber-attack likelihood value and a cyber-attack impact value associated with the entity;
determine a cyber-attack risk based on the cyber-attack likelihood value and a cyber-attack impact value associated with the entity;
determine an operational failure likelihood value and an operational failure impact value associated with the entity;
determine an operational failure risk based on the operational failure likelihood value and the operational failure impact value associated with the entity;
determine a risk value for the entity based on the cyber-attack risk and the operational failure risk;
store the risk value for the entity;
determine a risk value for a location based on the plurality of risk values associated with the plurality of entities; and
perform a remediation action based on the risk value for the location, wherein the remediation action comprises at least one of changing network access of the entity, initiating a patch for the entity, or updating the entity.
10. The system of claim 9 , wherein the cyber-attack likelihood value is based on at least one of an alert, a vulnerability, a direct connection with a public entity, or a proximity to an infected or vulnerable entity.
11. The system of claim 9 , wherein the cyber-attack impact value is based on at least one of entity criticality, network criticality, or proximity to a critical entity.
12. The system of claim 9 , wherein the operational failure likelihood value is based on an alert.
13. The system of claim 9 , wherein the operational failure impact value is based on at least one of an entity criticality, a network criticality, or proximity to a critical entity.
14. The system of claim 9 , wherein the risk value for the entity is a maximum of the cyber-attack risk and the operational failure risk.
15. The system of claim 9 , wherein the processing device further to:
determine a risk value for a location based on a plurality of risk values associated with a plurality of entities associated with the location.
16. The system of claim 15 , wherein the risk value for the entity is a maximum of the cyber-attack risk and the operational failure risk.
17. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
perform for each of a plurality of entities:
select an entity communicatively coupled to a network;
determine a cyber-attack likelihood value and a cyber-attack impact value associated with the entity;
determine a cyber-attack risk based on the cyber-attack likelihood value and a cyber-attack impact value associated with the entity;
determine an operational failure likelihood value and an operational failure impact value associated with the entity;
determine an operational failure risk based on the operational failure likelihood value and the operational failure impact value associated with the entity;
determine a risk value for the entity based on the cyber-attack risk and the operational failure risk;
store the risk value for the entity; and
determine a risk value for a location based on the plurality of risk values associated with the plurality of entities; and
perform a remediation action based on the risk value for the location, wherein the remediation action comprises at least one of changing network access of the entity, initiating a patch for the entity, or updating the entity.
18. The non-transitory computer readable medium of claim 17 , wherein the cyber-attack likelihood value is based on at least one of an alert, a vulnerability, a direct connection with a public entity, or a proximity to an infected or vulnerable entity.
19. The non-transitory computer readable medium of claim 17 , wherein the cyber-attack impact value is based on at least one of entity criticality, network criticality, or proximity to a critical entity.
20. The non-transitory computer readable medium of claim 17 , wherein the operational failure likelihood value is based on an alert.
21. The non-transitory computer readable medium of claim 17 , wherein the operational failure impact value is based on at least one of an entity criticality, a network criticality, or proximity to a critical entity.