Granted Patent B2

US 12,021,889 · App. 17/498,172 · Granted Jun 25, 2024

Inventor: Raymond Hicks (Chicago, IL)

Assignee: UncommonX Inc.

H04L63/1433H04L63/08

Abstract

Claims (73)

1. A method for a system security evaluation, the method comprises:

establishing, by a security evaluation device, a connection to a system associated with an entity;

obtaining, by the security evaluation device, first data regarding an inventory of system elements of the system, wherein the first data includes:

one or more identified plug-in modules associated with respective system elements;

plug-in module information associated with the one or more identified plug-in modules; and

respective system element login information associated with the inventory of system elements;

identifying, by the security evaluation device, one or more desired system elements from the inventory of system elements to perform the system security evaluation;

identifying, by the security evaluation device, one or more security elements from the one or more desired system elements;

communicating, by the security evaluation device, with the one or more security elements using the respective system element login information to gain access to the one or more security elements to produce system security data via the one or more identified plug-in modules; and

analyzing, by the security evaluation device, the system security data in light of minimum viable data metrics established by: one or more external data sources and the entity to produce one or more system security scores indicative of security proficiency of the one or more desired system elements; and

if the one or more system security scores are below a viable level:

generating, by the security evaluation device, a score indicative of the effort required to remediate security issues effecting the one or more system security scores.

2. The method of claim 1 , wherein the one or more system elements includes one or more of:

policies;

procedures;

services;

networks;

users;

devices;

servers;

software;

hardware;

tools;

files;

personnel;

departments; and

IP addresses.

3. The method of claim 1 , wherein the one or more security elements include one or more of:

security devices;

security software;

security services;

security tools;

security procedures;

security policies;

a third party security monitoring service;

user access lists; and

security personnel.

4. The method of claim 1 , wherein the system security data includes information related to at least one of:

discovered devices;

discovered software;

discovered users;

user access logs;

discovered network connections;

one or more security configurations;

one or more discovered security procedures;

one or more security risks;

one or more security deficiencies;

one or more network deficiencies;

one or more system anomalies; and

one or more security alerts.

5. The method of claim 1 , wherein the one or more external data sources includes one or more of:

another system associated with another entity;

a government body; and

a standards body.

6. The method of claim 1 , wherein the security evaluation device is configured for remote management.

7. The method of claim 1 , wherein the minimum viable data metrics include one or more of:

risk management effectiveness metrics;

compliance with one or more standards;

compliance with one or more laws;

security optimization metrics;

security completeness metrics; and

system awareness metrics.

8. The method of claim 1 further comprises:

providing, by the security evaluation device, one or more recommendations to improve the desired system element based on the one or more system security scores.

9. The method of claim 1 further comprises:

implementing, by the security evaluation device, an adjustment to the one or more security elements of the desired system element based on the one or more system security scores.

10. The method of claim 9 , wherein the adjustment includes one or more of:

adding a security element to the one or more desired system elements;

removing a security element of the one or more security elements;

updating a security element of the one or more security elements;

patching a security element of the one or more security elements;

modifying a security element of the one or more security elements; and

restricting a security element of the one or more security elements.

Assignments (9)

Continuity (3)