SYSTEM AND METHOD FOR CYBER SECURITY THREAT ASSESSMENT
Embodiments of the disclosure provide a system and method for developing rich data for holistic metrics for gauging an enterprise cyber security posture to enable proactive and preventative measures in order to minimize the enterprise's exposure to a cyberattack. By taking an enterprise-wide holistic approach to cyber security, the enterprise will have information needed to identify areas of its network systems for remediation that will result in making the enterprise a less attractive target for cyber threat actors.
1 . A method for predicting cyber security risk performed by a cyber security risk prediction server, the method comprising:
collecting network parameters of a network associated with an enterprise at risk from cyber security threats;
collecting threat intelligence data from a plurality of data sources external to the enterprise at risk from cyber security threats;
performing an Extract, Transform and Load (ETL) from one or more databases based on the network parameters to obtain relevant threat intelligence data, wherein the one or more databases store the threat intelligence data from the plurality of data sources external to the enterprise at risk from cyber security threats, and the relevant threat intelligence data is data stored in the one or more databases that is relevant to the network parameters; and
analyzing the relevant threat intelligence data to obtain a predicted threat assessment for the enterprise at risk from cyber security threats.
2 . The method of claim 1 , wherein the network parameters comprise one or more of the following: types of technology deployed in the network associated with the enterprise, types of network equipment in the network associated with the enterprise, a network location of the types of network equipment, a geographic location of the types of network equipment, and exposure to third party networks in the network associated with the enterprise.
3 . The method of claim 2 , further comprising generating a threat assessment report providing the predicted threat assessment.
4 . The method of claim 3 , wherein the threat assessment report comprises one or more of: an individual threat rating score for each of the types of technology deployed in the network associated with the enterprise, a plurality of potential financial losses to the enterprise for each of the types of technology deployed in the network associated with the enterprise, a maximum probable financial loss to the enterprise, and a technology heat map providing a geographic representation of cyber threats based on the network parameters of the network associated with the enterprise.
5 . The method of claim 1 , wherein the predicted threat assessment comprises a prospective cyber security threat score that assigns a metric value measuring an overall threat level faced by the enterprise at risk from cyber security threats.
6 . The method of claim 5 , wherein the prospective cyber security threat score is normalized against a plurality of other enterprises at risk from cyber security threats.
7 . The method of claim 1 , wherein the threat intelligence data from the plurality of data sources external to the enterprise at risk from cyber security threats comprises one or more of the following: dark web data; technology vulnerabilities; deep web data; upstream, downstream and peer network threats; data from hacker discussion boards; changes to behavioral Tactics, Techniques and Procedures (TTP); global internet infrastructure vulnerabilities; and vulnerabilities in supply chain networks for the enterprise.
8 . A system for predicting cyber security risk, the system comprising:
a cyber security risk prediction server configured to:
collect network parameters of a network associated with an enterprise at risk from cyber security threats;
collect threat intelligence data from a plurality of data sources external to the enterprise at risk from cyber security threats;
perform an Extract, Transform and Load (ETL) from one or more databases based on the network parameters to obtain relevant threat intelligence data, wherein the one or more databases store the threat intelligence data from the plurality of data sources external to the enterprise at risk from cyber security threats, and the relevant threat intelligence data is data stored in the one or more databases that is relevant to the network parameters; and
analyze the relevant threat intelligence data to obtain a predicted threat assessment for the enterprise at risk from cyber security threats.
9 . The system of claim 8 , wherein the network parameters comprise one or more of the following: types of technology deployed in the network associated with the enterprise, types of network equipment in the network associated with the enterprise, a network location of the types of network equipment, a geographic location of the types of network equipment, and exposure to third party networks in the network associated with the enterprise.
10 . The system of claim 9 , wherein the cyber security risk prediction server is further configured to generate a threat assessment report providing the predicted threat assessment.
11 . The system of claim 10 , wherein the threat assessment report comprises one or more of: an individual threat rating score for each of the types of technology deployed in the network associated with the enterprise, a plurality of potential financial losses to the enterprise for each of the types of technology deployed in the network associated with the enterprise, a maximum probable financial loss to the enterprise, and a technology heat map providing a geographic representation of cyber threats based on the network parameters of the network associated with the enterprise.
12 . The system of claim 8 , wherein the predicted threat assessment comprises a prospective cyber security threat score that assigns a metric value measuring an overall threat level faced by the enterprise at risk from cyber security threats.
13 . The system of claim 12 , wherein the prospective cyber security threat score is normalized against a plurality of other enterprises at risk from cyber security threats.
14 . The system of claim 8 , wherein the threat intelligence data from the plurality of data sources external to the enterprise at risk from cyber security threats comprises one or more of the following: dark web data; technology vulnerabilities; deep web data; upstream, downstream and peer network threats; data from hacker discussion boards; changes to behavioral Tactics, Techniques and Procedures (TTP); global internet infrastructure vulnerabilities; and vulnerabilities in supply chain networks for the enterprise.
15 . A non-transitory computer-readable medium containing computer executable instructions for predicting cyber security risk, the computer readable instructions, when executed by a computer, cause the computer to perform steps comprising:
collecting network parameters of a network associated with an enterprise at risk from cyber security threats;
collecting threat intelligence data from a plurality of data sources external to the enterprise at risk from cyber security threats;
performing an Extract, Transform and Load (ETL) from one or more databases based on the network parameters to obtain relevant threat intelligence data, wherein the one or more databases store the threat intelligence data from the plurality of data sources external to the enterprise at risk from cyber security threats, and the relevant threat intelligence data is data stored in the one or more databases that is relevant to the network parameters; and
analyzing the relevant threat intelligence data to obtain a predicted threat assessment for the enterprise at risk from cyber security threats.
16 . The non-transitory computer-readable medium of claim 15 , wherein the network parameters comprise one or more of the following: types of technology deployed in the network associated with the enterprise, types of network equipment in the network associated with the enterprise, a network location of the types of network equipment, a geographic location of the types of network equipment, and exposure to third party networks in the network associated with the enterprise.
17 . The non-transitory computer-readable medium of claim 16 , further comprising generating a threat assessment report providing the predicted threat assessment.
18 . The non-transitory computer-readable medium of claim 17 , wherein the threat assessment report comprises one or more of: an individual threat rating score for each of the types of technology deployed in the network associated with the enterprise, a plurality of potential financial losses to the enterprise for each of the types of technology deployed in the network associated with the enterprise, a maximum probable financial loss to the enterprise, and a technology heat map providing a geographic representation of cyber threats based on the network parameters of the network associated with the enterprise.
19 . The non-transitory computer-readable medium of claim 15 , wherein the predicted threat assessment comprises a prospective cyber security threat score that assigns a metric value measuring an overall threat level faced by the enterprise at risk from cyber security threats.
20 . The non-transitory computer-readable medium of claim 19 , wherein the prospective cyber security threat score is normalized against a plurality of other enterprises at risk from cyber security threats.