Systems and methods for cybersecurity risk assessment
In an illustrative embodiment, methods and systems for cybersecurity assessment of an organization's technology infrastructure include identifying features of the technology infrastructure and automatically generating a threat profile relevant to both the technology infrastructure and the organization's business (and/or business objectives), where the threat profile includes potential threat actors and threat scenarios applicable to the technology infrastructure. The methods and systems may include evaluating cybersecurity controls of the organization's technology infrastructure in light of the threat profile to identify and rate vulnerabilities within the technology infrastructure.
1. A system for automatically evaluating cybersecurity controls deployed by an entity to protect assets of a technological infrastructure, the system comprising:
a non-transitory computer readable data store comprising a plurality of defined cybersecurity threats, each threat of the plurality of defined cybersecurity threats linking a given threat actor of a plurality of threat actors, a given threat vector of a plurality of threat vectors, and a given threat scenario of a plurality of threat scenarios; and
processing circuitry configured to perform operations comprising
obtaining infrastructure data regarding the entity, the infrastructure data identifying a plurality of technology elements and a plurality of digital information controls applied by the entity to protect data stored on and/or relayed by the plurality of technology elements, wherein a portion of the plurality of technology elements are designated as critical technology elements,
segmenting the portion of the plurality of technology elements into a set of technology assets, each technology asset comprising one or more technology elements of the portion of the plurality of technology elements,
developing a threat profile comprising a plurality of potential threats to the set of technology assets, wherein developing the threat profile comprises for each respective technology asset of the set of technology assets,
i) identifying, for the respective technology asset, one or more threat actors of the plurality of threat actors relevant to the respective technology asset, and
ii) for each threat actor of the one or more threat actors, identifying one or more threat vectors of the plurality of threat vectors relevant to the respective technology asset, wherein each threat vector, if activated, is capable of producing a corresponding threat scenario of the plurality of threat scenarios, and
adding a set of threats of the plurality of defined cybersecurity threats to the threat profile, each added threat comprising a given actor of the one or more identified threat actors, a given vector of the one or more identified threat vectors for the given actor, and the corresponding threat scenario for the given vector,
automatically evaluating a performance level of a control environment associated with each asset of the set of technology assets, wherein evaluating the performance level comprises
mapping each digital information control of at least a portion of the plurality of digital information controls to one or more assets of the set of technology assets,
determining a set of levels of preparedness in responding to the set of threats of the threat profile by estimating, for each respective asset of the set of technology assets, a respective level of preparedness of the set of levels of preparedness of one or more mapped digital information controls in responding to a given threat of the set of threats of the threat profile relevant to the respective technology asset and to the respective digital information control, and
calculating, from the set of levels of preparedness, the performance level, and comparing the performance level of the control environment to a target level.
2. The system of claim 1 , wherein the operations further comprise:
evaluating the infrastructure data to identify the portion of the plurality of technology elements as the critical technology elements, the critical technology elements being designated important to cybersecurity based on at least one business objective, wherein
the at least one business objective comprises, for each technology element of the portion of the plurality of technology elements, one or more of confidentiality, integrity, availability, or financial value of data.
3. The system of claim 1 , wherein:
designating the portion of the plurality of technology elements as the critical technology elements comprises assigning, to each element of the portion of the plurality of technology elements, at least one criticality factor of a set of criticality factors.
4. The system of claim 3 , wherein the set of criticality factors comprises at least one of confidentiality, integrity, availability, and financial value.
5. The system of claim 1 , wherein the operations further comprise analyzing the threat profile to identify, for each respective threat in the threat profile, a corresponding threat rating, wherein
the corresponding threat rating is based on a capability of a threat actor associated with the respective threat, and an asset criticality of a corresponding technology asset of the set of technology assets.
6. The system of claim 5 , wherein the operations further comprise calculating, for each asset of the set of technology assets using a set of business objectives, an asset criticality score, wherein the corresponding threat rating is based on the capability of the associated threat actor and the asset criticality score.
7. The system of claim 5 , wherein:
the target level is based on the corresponding threat rating; and
the target level is one of a plurality of predetermined target levels, each target level of the plurality of predetermined target levels corresponding to a threat rating level.
8. The system of claim 1 , wherein each control of the plurality of digital information controls corresponds to a respective at least one security domain of a set of predetermined security domains.
9. The system of claim 8 , wherein the set of predetermined security domains comprises a plurality of security domains defined by a national or international cybersecurity standard.
10. The system of claim 8 , wherein determining the set of levels of preparedness comprises determining a respective level of preparedness of the set of levels of preparedness for each security domain of the set of predetermined security domains.
11. A method for automatically evaluating cybersecurity controls deployed by an entity to protect assets of a technological infrastructure, the method comprising:
obtaining infrastructure data regarding the entity, the infrastructure data identifying a plurality of technology elements and a plurality of digital information controls applied by the entity to protect data stored on and/or relayed by the plurality of technology elements, wherein a portion of the plurality of technology elements are designated as critical technology elements;
segmenting, by processing circuitry, the portion of the plurality of technology elements into a set of technology assets, each technology asset comprising one or more technology elements of the portion of the plurality of technology elements;
developing, by the processing circuitry, a threat profile comprising a plurality of potential threats to the set of technology assets, wherein developing the threat profile comprises for each respective technology asset of the set of technology assets,
i) identifying, for the respective technology asset, one or more threat actors relevant to the respective technology asset, and
ii) for each threat actor of the one or more threat actors, identifying one or more threat vectors relevant to the respective technology asset, wherein each threat vector, if activated, is capable of producing a corresponding threat scenario, and
adding a set of threats of a plurality of defined cybersecurity threats to the threat profile, each added threat comprising a given actor of the one or more threat actors, a given vector of the one or more identified threat vectors for the given actor, and the corresponding threat scenario for the given vector;
automatically evaluating, by the processing circuitry, a performance level of a control environment associated with each asset of the set of technology assets, wherein evaluating the performance level comprises
mapping each digital information control of at least a portion of the plurality of digital information controls to one or more assets of the set of technology assets,
determining a set of levels of preparedness in responding to the set of threats of the threat profile by estimating, for each respective asset of the set of technology assets, a respective level of preparedness of the set of levels of preparedness of one or more mapped digital information controls in responding to a given threat of the set of threats of the threat profile relevant to the respective technology asset and to the respective digital information control, and
calculating, from the set of levels of preparedness, the performance level; and
comparing, by the processing circuitry, the performance level of the control environment to a target level.
12. The method of claim 11 , further comprising:
evaluating, by the processing circuitry, the infrastructure data to identify the portion of the plurality of technology elements as the critical technology elements, the critical technology elements being designated important to cybersecurity based on at least one business objective, wherein
the at least one business objective comprises, for each technology element of the portion of the plurality of technology elements, one or more of confidentiality, integrity, availability, or financial value of data.
13. The method of claim 11 , wherein:
Designating the portion of the plurality of technology elements as the critical technology elements comprises assigning, to each element of the portion of the plurality of technology elements, at least one criticality factor of a set of criticality factors.
14. The method of claim 13 , wherein the set of criticality factors comprises at least one of confidentiality, integrity, availability, and financial value.
15. The method of claim 11 , further comprising analyzing, by the processing circuitry, the threat profile to identify, for each respective threat in the threat profile, a corresponding threat rating, wherein
the corresponding threat rating is based on a capability of a threat actor associated with the respective threat, and an asset criticality of a corresponding technology asset of the set of technology assets.
16. The method of claim 15 , further comprising calculating, by the processing circuitry for each asset of the set of technology assets using a set of business objectives, an asset criticality score, wherein the corresponding threat rating is based on the capability of the associated threat actor and the asset criticality score.
17. The method of claim 15 , wherein:
the target level is based on the corresponding threat rating; and
the target level is one of a plurality of predetermined target levels, each target level of the plurality of predetermined target levels corresponding to a threat rating level.
18. The method of claim 11 , wherein each control of the plurality of digital information controls corresponds to a respective at least one security domain of a set of predetermined security domains.
19. The method of claim 18 , wherein the set of predetermined security domains comprises a plurality of security domains defined by a national or international cybersecurity standard.
20. The method of claim 18 , wherein determining the set of levels of preparedness comprises determining a respective level of preparedness of the set of levels of preparedness for each security domain of the set of predetermined security domains.