Cybersecurity profiling and rating using active and passive external reconnaissance
A system and method for generating comprehensive security profiles and ratings for organizations that takes into account the organization's infrastructure and operations in generating the profile, and the context and purpose of the rating to be generated related to the profile. The system and method may further comprise gathering data about the totality of the organization's infrastructure and operations, generating a cybersecurity profile using active and passive internal and external reconnaissance of the organization to determine cybersecurity vulnerabilities and potential impacts to the business in light of the information gathered about the organization's infrastructure and operations, and generating cybersecurity scores and ratings that take into account all of the above information, plus the context and purpose of the score or rating to be generated based on the cybersecurity profile.
1. A system for cybersecurity profiling and rating using internal and external reconnaissance, comprising:
a cyber-physical graph module comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to create a cyber-physical graph of an organization, the cyber-physical graph comprising nodes representing entities associated with the organization and edges representing relationships between entities associated with the organization;
a reconnaissance engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
perform a reconnaissance search using the cyber-physical graph; and
apply some or all of the results of the reconnaissance search to the cyber-physical graph to create a cybersecurity profile of the organization; and
a scoring engine comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:
receive the cybersecurity profile and the results of the reconnaissance search;
using the cyber-physical graph and the reconnaissance search results:
estimate a frequency and severity of cyber-attacks on the organization;
identify a plurality of cybersecurity risks associated with the organization;
determine a business impact for each cybersecurity risk identified;
assign a network resilience rating to the organization; and
determine a functional cybersecurity score for the organization based at least on the network resilience rating.
2. The system of claim 1 , further comprising a data to rule mapper comprising a fourth plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the fourth plurality of programming instructions, when operating on the processor, cause the computing device to:
receive a plurality of rules;
retrieve the reconnaissance search results;
map a rule to each data point in the reconnaissance search results;
assign a possible consequence for each data point based on the rule mapped to the data point; and
send the possible consequence for each data point to the scoring engine as additional data for consideration in scoring.
3. A method for cybersecurity profiling and rating using internal and external reconnaissance, comprising the steps of:
creating a cyber-physical graph of an organization using entities associated with the organization and relationships between a plurality of entities associated with the organization, the cyber-physical graph comprising nodes representing the entities associated with the organization and edges representing the relationships between entities associated with the organization;
performing a reconnaissance search using the cyber-physical graph;
applying some or all of the results of the reconnaissance search to the cyber-physical graph to create a cybersecurity profile of the organization; and
using the cyber-physical graph and the results of the reconnaissance search results:
estimating a frequency and severity of cyber-attacks on the organization;
identifying a plurality of cybersecurity risks associated with the organization;
determining a business impact for each cybersecurity risk identified;
assigning a network resilience rating to the organization; and
determining a functional cybersecurity score for the organization based at least on the network resilience rating.
4. The method of claim 3 further comprising the steps of:
receiving a plurality of rules;
retrieving the reconnaissance search results;
mapping a rule to each data point in the reconnaissance search results;
assigning a possible consequence for each data point based on the rule mapped to the data point; and
using the possible consequence for each data point as additional data for consideration in scoring.