Cybersecurity risk analysis and anomaly detection using active and passive external reconnaissance

1. A system for cybersecurity profiling and rating using internal and external reconnaissance, comprising:

a cyber-physical graph module comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to create a cyber-physical graph of an organization using information about the organization, the cyber-physical graph comprising nodes representing entities associated with the organization and edges representing relationships between entities associated with the organization;

a reconnaissance engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:

perform a reconnaissance search using the cyber-physical graph; and

apply a plurality of results of the reconnaissance search to the cyber-physical graph to create a cybersecurity profile of the organization; and

a scoring engine comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:

receive the cybersecurity profile and the reconnaissance search results;

using the cyber-physical graph and the reconnaissance search results:

assign a criticality score to each of a plurality of nodes within the cyber-physical graph, the criticality score indicating a measure of importance of the respective entity represented by a node;

identify a plurality of cybersecurity risks associated with each of the nodes to which a relative value was assigned;

identify an anomalous event based on analysis of cyber-physical graph and the reconnaissance search results;

assign a risk value to the identified anomalous event, the risk value being determined based on the assigned criticality score for a node associated with the anomalous event; and

determine an effectiveness score for the network based on the cyber-physical graph and the risk value.

2. The system of claim 1 , wherein the information about the organization further comprises information about business processes within the organization.

3. The system of claim 1 , wherein the information about the organization further comprises prior loss information for the organization.

4. A method for cybersecurity profiling and rating using internal and external reconnaissance, comprising the steps of:

creating a cyber-physical graph of an organization using entities associated with the organization and relationships between the entities associated with the organization, the cyber-physical graph comprising nodes representing the entities associated with the organization and edges representing the relationships between entities associated with the organization;

performing a reconnaissance search using the cyber-physical graph;

applying some or all of the results of the reconnaissance search to the cyber-physical graph to create a cybersecurity profile of the organization; and

using the cyber-physical graph and the reconnaissance search results:

assigning a criticality score to each of a plurality of nodes within the cyber-physical graph, the criticality score indicating a measure of importance of the respective entity represented by a node;

identifying a plurality of cybersecurity risks associated with each of the nodes to which a relative value was assigned;

identifying an anomalous event based on analysis of cyber-physical graph and the reconnaissance search results;

assigning a risk value to the identified anomalous event, the risk value being determined based on the assigned criticality score for a node associated with the anomalous event; and

determining an effectiveness score for the network based on the cyber-physical graph and the risk value.

5. The method of claim 4 wherein the information about the organization further comprises information about business processes within the organization.

6. The method of claim 4 wherein the information about the organization further comprises prior loss information for the organization.