Non-intrusive techniques for discovering and using organizational relationships
The present disclosure provides techniques for calculating an entity's cybersecurity risk based on identified relationships between the entity and one or more vendors. Customer/vendor relationships may impact the cybersecurity risk for each of the parties involved because a security compromise of a downstream or upstream provider can lead to a compromise of multiple other companies. For example, if organization A uses B (e.g., a cloud service provider) to store files, and B is compromised, this may lead to organization A being compromised (e.g., the files organization A stored using B may have been compromised by the breach of B's cybersecurity). Embodiments of the present disclosure further provide a technique for calculating a cybersecurity risk score for an organization based on identified customer/vendor relationships.
1. A method for adjusting a cybersecurity risk score of a first company based on a cybersecurity posture of one or more vendors, the method comprising:
non-intrusively searching, by one or more processors, for information that is indicative of a relationship between the first company and the one or more vendors;
combining first information corresponding to a website attributable to a first vendor of the one or more vendors and second information corresponding to the first company to generate a candidate universal resource locator (URL), where the first vendor and the first company are different entities; and
determining if the candidate URL resolves to a website of the first vendor;
in response to the candidate URL resolving to a valid website of the first vendor:
determining a cybersecurity posture for the first vendor; and
adjusting, by the one or more processors, a cybersecurity risk score of the first company based, at least in part, on the determined cybersecurity posture for the first vendor; and
outputting, subsequent to the adjusting, the adjusted cybersecurity risk score of the first company to a graphical user interface.
2. The method of claim 1 , where the first information corresponds to a domain of the website attributable to the website of the first vendor and the second information is combined with the first information as a subdomain of the domain of the first vendor.
3. The method of claim 1 , where the first information corresponds to a domain of the website attributable to the first vendor and the second information is combined with the first information as a directory within the domain of the first vendor.
4. The method of claim 1 , where determining, by the one or more processors, if the candidate URL resolves to the website attributable to the first vendor comprises one or more of analyzing: source code of the website, image content included of the website, or text content of the website.
5. The method of claim 1 , further comprising:
identifying additional services used by the first company and that are offered by additional vendors that are different from the first vendor based on other information sources, where the other information sources comprise one or more of network footprints of one or more of the additional vendors, social network information, and press release information for one or more of the additional vendors.
6. The method of claim 1 , method further comprising:
determining a risk factor based on the use, by the first company, of a service offered by the first vendor, where the risk factor represents a risk that a breach of the first vendor's cybersecurity will expose sensitive data of the first company; and
determining a weighting factor associated with the risk factor, where the cybersecurity risk score of the first company is adjusted based, at least in part, on the risk factor and the weighting factor.
7. The method of claim 1 , further comprising:
identifying one or more additional vendors that are different from the first vendor and that offer additional services that are used by the first company;
determining cybersecurity postures for each of the one or more additional vendors; and
adjusting the cybersecurity risk score of the first company based, at least in part, on the cybersecurity postures determined for each of the one or more additional vendors.
8. The method of claim 1 , further comprising:
generating a graph that depicts relationships between the first company and the first vendor and between the first company and each of one or more additional vendors, where a relationship between the first company and a particular vendor, as depicted by the graph, indicates that the first company uses a service of the particular vendor.
9. The method of claim 1 , further comprising:
in response to the determination that the candidate URL resolves to the website of the first vendor, generating, by the one or more processors, a plurality of additional candidate URLs, where each of the plurality of additional candidate URLs comprises the first information and different second information, and where the different second information corresponds to a particular company that is different from the first company;
determining:
if one or more candidate URLs of the plurality of additional candidate URLs resolves to the website attributable to the first vendor; and
if at least one validated candidate URLs of the plurality of additional candidate URLs resolves to the website attributable to the first vendor, adjusting, by the one or more processors, cybersecurity risk scores for each of one or more additional companies associated with validated candidate URLs of the plurality of additional candidate URLs based on the cybersecurity posture of the first vendor to produce an adjusted cybersecurity risk score for each of the one or more additional companies.
10. The method of claim 1 , further comprising:
in response to the determination that the at least one candidate URL resolves to the website the website attributable to the first vendor, generating by the one or more processors, a plurality of additional candidate URLs, where each of the plurality of additional candidate URLs comprises different first information and the second information, and where, for each of the plurality of additional candidate URLs, the different first information corresponds to a vendor other than the first vendor;
determining if one or more candidate URLs of the plurality of additional candidate URLs resolves to a website of a particular vendor other than the first vendor, and
when at least one candidate URL of the plurality of additional candidate URLs resolves to a website of a particular vendor:
determining, by the one or more processors, a cybersecurity posture for each particular vendor associated with one of at least one validated candidate URLs of the plurality of additional candidate URLs; and
adjusting, by the one or more processors, the cybersecurity risk score of the first company based, at least in part, on the cybersecurity posture for each particular vendor.
11. A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
non-intrusively searching for information that is indicative of a relationship between a first company and one or more vendors;
combining first information corresponding to a website attributable to a first vendor of the one or more vendors and second information corresponding to the first company to generate a candidate universal resource locator (URL), where the first vendor and the first company are different entities; and
in response to the candidate URL resolving to a valid website of the first vendor:
determining a cybersecurity posture for the first vendor; and
adjusting a cybersecurity risk score of the first company based, at least in part, on the cybersecurity posture for the first vendor; and
outputting, subsequent to the adjusting, the adjusted cybersecurity risk score of the first company to a graphical user interface.
12. The non-transitory computer-readable storage medium of claim 11 , where the first information corresponds to a domain of the website attributable to the first vendor and the second information is combined with the first information as a subdomain of the domain of the website attributable to the first vendor.
13. The non-transitory computer-readable storage medium of claim 11 , where the first information corresponds to a domain of the website attributable to the first vendor and the second information is combined with the first information as a directory within the domain of the first vendor.
14. The non-transitory computer-readable storage medium of claim 11 , the operations further comprising:
identifying additional services used by the first company and that are offered by additional vendors that are different from the first vendor based on other information sources where the other information sources comprise one or more of network footprints of one or more of the additional vendors, social network information, and press release information for one or more of the additional vendors.
15. The non-transitory computer-readable storage medium of claim 11 , the operations further comprising:
determining a risk factor based on the use, by the first company, of a service offered by the first vendor, where the risk factor represents a risk that a breach of the first vendor's cybersecurity will expose sensitive data of the first company; and
determining a weighting factor associated with the risk factor, where the cybersecurity risk score of the first company is adjusted based, at least in part, on the risk factor and the weighting factor.
16. A system for adjusting a cybersecurity risk score of a first company based on a cybersecurity posture of one or more vendors that have a relationship with the first company through non-intrusive analysis of content of one or more vendor websites containing information that relates to the first company, the system comprising:
a memory; and
one or more processors coupled to the memory, the one or more processors configured to:
non-intrusively search for information that is indicative of a relationship between the first company and the one or more vendors;
combine first information corresponding to a website attributable to a first vendor of the one or more vendors and second information corresponding to the first company to generate a candidate universal resource locator (URL), where the first vendor and the first company are different entities;
determine if the at least one candidate URL resolves to the website of the first vendor; and
in response to the at least one candidate URL resolving to the website of the first vendor:
obtain information indicative of a cybersecurity posture for the first vendor; and
adjust a cybersecurity risk score of the first company based, at least in part, on the information indicative of the cybersecurity posture for the first vendor; and
output, subsequent to the adjusting, the adjusted cybersecurity risk score of the first company to a graphical user interface.
17. The system of claim 16 , where the first information corresponds to a domain of the website attributable to the website of the first vendor and the second information corresponds is combined with the first information as a subdomain within the domain of the first vendor.
18. The system of claim 16 , where the first information corresponds to a domain of the website attributable to the first vendor and the second information is combined with the first information as a directory that is associated with the first company and is within the domain of the first vendor.
19. The system of claim 16 , where the one or more processors are configured to determine if the at least one candidate URL resolves to the website attributable to the first vendor by analyzing if the at least one candidate URL resolves to a website of the first vendor via analysis of source code of the website, image content included of the website, text content of the website, or a combination thereof.
20. The system of claim 16 , where the one or more processors are further configured to:
identify additional services used by the first company and that are offered by additional vendors that are different from the first vendor based on other information sources, where the other information sources comprise one or more of network footprints of one or more of the additional vendors, social network information, and press release information for one or more of the additional vendors.
21. The system of claim 16 , where the one or more processors are further configured to:
determine a risk factor based on the use, by the first company, of a service offered by the first vendor, where the risk factor represents a risk that a breach of the first vendor's cybersecurity will expose sensitive data of the first company; and
determining a weighting factor associated with the risk factor, where the cybersecurity risk score of the first company is adjusted based, at least in part, on the risk factor and the weighting factor.