Cyber risk analysis and remediation using network monitored sensors and methods of use
Systems and methods for cyber risk analysis and remediation using network monitored sensors are provided herein. An example system includes one or more data collecting devices deployed within a network that collect entity information and monitor network traffic of the network that is related to security information. The network includes computing systems that are subject to a cyber risk policy having breach parameters defining one or more events that are indicative of a cyber security breach. A cyber security risk assessment and management system is used to automatically detect occurrence of one or more of the events that are indicative of a cyber security breach, automatically determine the breach parameters that apply for the one or more events that occurred, and generates a remediation of cyber security parameters for the network.
1. A system, comprising:
a processor configured to:
automatically detect occurrence of one or more of events that are indicative of a cyber security breach based on network traffic;
automatically determine one or more breach parameters that apply for the one or more events that occurred;
generate a remediation of cyber security parameters for a network based on the one or more determined breach parameters and an associated remediation provision, wherein the remediation of cyber security parameters at least includes modifying a password requirement associated with one or more computer systems;
cause the remediation to be performed, wherein the remediation causes one or more network changes that increase a sophistication score of an entity, wherein the remediation comprises a change to a hosting infrastructure, network or website topology, vulnerability scanning, content distribution networks, shared hosting, cloud services, patching, updating, default passwords, and any combinations thereof;
evaluate a plurality of networks to generate a plurality of sophistication scores and a plurality of motivation scores, the plurality of networks including a network associated with the system, wherein one motivation score of the plurality of motivation scores relates to a desire level of a malicious actor to cause a cyber security risk for the entity; and
plot the plurality of sophistication scores and the plurality of motivation scores graphically as a peer group; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system according to claim 1 , wherein the network traffic comprises data collected regarding employees using the one or more computing systems or a network associated with the system.
3. The system according to claim 1 , wherein the network traffic comprises data collected regarding websites visited by employees using a network associated with the system and the one or more computing systems.
4. The system according to claim 1 , wherein the processor is configured to evaluate the network traffic on one or more network layers.
5. The system according to claim 4 , wherein the network traffic is evaluated for any of dynamic host protocol (DHCP) information, classless inter-domain routing (CIDR) blocks, and domain name system (DNS) information included in the network traffic.
6. The system according to claim 5 , wherein the processor is further configured to:
create a fingerprint of the network traffic from the DHCP information; and
store the fingerprint in a database.
7. The system according to claim 1 , further comprising a first set of sensors that operate on a data link layer of a network associated with the system.
8. The system according to claim 7 , further comprising a second set of sensors that operate on an Internet Protocol Address layer of the network to evaluate address resolution (ARP) protocol information from the network traffic.
9. The system according to claim 8 , wherein the second set of sensors are configured to transmit the ARP protocol information to the first set of sensors for storage in a database along with DNS information.
10. The system according to claim 1 , wherein the remediation comprises recommendations for improvement for the entity based on a nature of the one or more events that occurred.
11. The system according to claim 1 , wherein the processor is further configured to perform at least one of query the entity or a network associated with the system for information; scrape available online sources; retrieve corporate filings; or query news sources and public record databases.
12. The system of claim 1 , wherein the sophistication score is indicative of a cyber security sophistication of the entity.
13. The system according to claim 1 , wherein information associated with the entity and the network traffic are evaluated for any of visibility, value, hacker sentiment, employee sentiment, company sentiment, customer sentiment, and combinations thereof.
14. The system according to claim 1 , wherein information associated with the entity and the network traffic are evaluated for any of traffic, usage, in-links, page views, duration, traffic volume, links, page rank, market value, stock trade volume, exporting/importing information, and combinations thereof.
15. A method, comprising:
automatically detecting occurrence of one or more of events that are indicative of a cyber security breach based on network traffic;
automatically determining one or more breach parameters that apply for the one or more events that occurred;
generating a remediation of cyber security parameters for a network based on the one or more determined breach parameters and an associated remediation provision, wherein the remediation at least includes modifying a password requirement associated with one or more computer systems;
causing the remediation to be performed, wherein the remediation causes one or more network changes that increase a sophistication score of an entity, wherein the remediation comprises a change to a hosting infrastructure, network or website topology, vulnerability scanning, content distribution networks, shared hosting, cloud services, patching, updating, default passwords, and any combinations thereof;
evaluating a plurality of networks to generate a plurality of sophistication scores and a plurality of motivation scores, the plurality of networks including a network associated with the system, wherein one motivation score of the plurality of motivation scores relates to a desire level of a malicious actor to cause a cyber security risk for the entity; and
plotting the plurality of sophistication scores and the plurality of motivation scores graphically as a peer group.
16. The method according to claim 15 , further comprising providing recommendations for improvement for the entity based on a nature of the one or more events that occurred.
17. The method according to claim 16 , further comprising tying at least one of sophistication scores and changes in sophistication scores to remediation adjustments.
18. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising instructions for:
automatically detecting occurrence of one or more events that are indicative of a cyber security breach based on network traffic;
automatically determining one or more breach parameters that apply for the one or more events that occurred;
generating a remediation of cyber security parameters for a network based on the one or more determined breach parameters and an associated remediation provision, wherein the remediation of the cyber security parameters at least includes modifying a password requirement associated with one or more computing systems;
causing the remediation to be performed, wherein the remediation causes one or more network changes that increase a sophistication score of an entity, wherein the remediation comprises a change to a hosting infrastructure, network or website topology, vulnerability scanning, content distribution networks, shared hosting, cloud services, patching, updating, default passwords, and any combinations thereof;
evaluating a plurality of networks to generate a plurality of sophistication scores and a plurality of motivation scores, the plurality of networks including a network associated with the system, wherein one motivation score of the plurality of motivation scores relates to a desire level of a malicious actor to cause a cyber security risk for the entity; and
plotting the plurality of sophistication scores and the plurality of motivation scores graphically as a peer group.