Threat mitigation system and method
A computer-implemented method, computer program product and computing system for: obtaining consolidated platform information to identify current security-relevant capabilities for a computing platform; identifying coverage gaps in the current security-relevant capabilities; and providing one or more recommendations concerning how to mitigate the coverage gaps.
1. A computer-implemented method, executed on a computing device, comprising:
obtaining consolidated platform information to identify current security-relevant capabilities for a computing platform;
identifying coverage gaps in the current security-relevant capabilities; and
providing one or more recommendations concerning how to mitigate the coverage gaps including
identifying a plurality of undeployed rules that are deployable in the computing platform; and
ranking the plurality of undeployed rules that are deployable in the computing platform to enable a user to make an informed decision concerning how to address the undeployed rules.
2. The computer-implemented method of claim 1 wherein providing one or more recommendations concerning how to mitigate the coverage gaps includes:
identifying a plurality of inefficiencies in the computing platform; and
ranking the plurality of inefficiencies of the computing platform to enable a user to make an informed decision concerning how to address the inefficiencies.
3. The computer-implemented method of claim 2 wherein identifying a plurality of inefficiencies in the computing platform includes:
identifying an underutilization for a plurality of portions of the computing platform, thus resulting in a plurality of underutilizations; and
estimating an efficiency increase for each of the plurality of portions of the computing platform that would be realized if each of the plurality of underutilizations were mitigated.
4. The computer-implemented method of claim 1 wherein each of the plurality of undeployed rules is associated with a kill chain phase.
5. The computer-implemented method of claim 1 wherein each of the plurality of undeployed rules is assigned a severity level.
6. The computer-implemented method of claim 1 wherein each of the plurality of undeployed rules is assigned a performance score that is based, at least in part, on the possible of false positives.
7. The computer-implemented method of claim 1 wherein the consolidated platform information is obtained from an independent information source.
8. The computer-implemented method of claim 1 wherein the consolidated platform information is obtained from a client information source.
9. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
obtaining consolidated platform information to identify current security-relevant capabilities for a computing platform;
identifying coverage gaps in the current security-relevant capabilities; and
providing one or more recommendations concerning how to mitigate the coverage gaps including
identifying a plurality of undeployed rules that are deployable in the computing platform; and
ranking the plurality of undeployed rules that are deployable in the computing platform to enable a user to make an informed decision concerning how to address the undeployed rules.
10. The computer program product of claim 9 wherein providing one or more recommendations concerning how to mitigate the coverage gaps includes:
identifying a plurality of inefficiencies in the computing platform; and
ranking the plurality of inefficiencies of the computing platform to enable a user to make an informed decision concerning how to address the inefficiencies.
11. The computer program product of claim 10 wherein identifying a plurality of inefficiencies in the computing platform includes:
identifying an underutilization for a plurality of portions of the computing platform, thus resulting in a plurality of underutilizations; and
estimating an efficiency increase for each of the plurality of portions of the computing platform that would be realized if each of the plurality of underutilizations were mitigated.
12. The computer program product of claim 9 wherein each of the plurality of undeployed rules is associated with a kill chain phase.
13. The computer program product of claim 9 wherein each of the plurality of undeployed rules is assigned a severity level.
14. The computer program product of claim 9 wherein each of the plurality of undeployed rules is assigned a performance score that is based, at least in part, on the possible of false positives.
15. The computer program product of claim 9 wherein the consolidated platform information is obtained from an independent information source.
16. The computer program product of claim 1 wherein the consolidated platform information is obtained from a client information source.
17. A computing system including a processor and memory configured to perform operations comprising:
obtaining consolidated platform information to identify current security-relevant capabilities for a computing platform;
identifying coverage gaps in the current security-relevant capabilities; and
providing one or more recommendations concerning how to mitigate the coverage gaps including
identifying a plurality of undeployed rules that are deployable in the computing platform; and
ranking the plurality of undeployed rules that are deployable in the computing platform to enable a user to make an informed decision concerning how to address the undeployed rules.
18. The computing system of claim 17 wherein providing one or more recommendations concerning how to mitigate the coverage gaps includes:
identifying a plurality of inefficiencies in the computing platform; and
ranking the plurality of inefficiencies of the computing platform to enable a user to make an informed decision concerning how to address the inefficiencies.
19. The computing system of claim 18 wherein identifying a plurality of inefficiencies in the computing platform includes:
identifying an underutilization for a plurality of portions of the computing platform, thus resulting in a plurality of underutilizations; and
estimating an efficiency increase for each of the plurality of portions of the computing platform that would be realized if each of the plurality of underutilizations were mitigated.
20. The computing system of claim 17 wherein each of the plurality of undeployed rules is associated with a kill chain phase.
21. The computing system of claim 17 wherein each of the plurality of undeployed rules is assigned a severity level.
22. The computing system of claim 17 wherein each of the plurality of undeployed rules is assigned a performance score that is based, at least in part, on the possible of false positives.
23. The computing system of claim 17 wherein the consolidated platform information is obtained from an independent information source.
24. The computing system of claim 17 wherein the consolidated platform information is obtained from a client information source.