Threat mitigation system and method
A computer-implemented method, computer program product and computing system for: defining a threat mitigation platform for a client, wherein the threat mitigation platform includes a plurality of threat detection capability modules; defining a rollout schedule for at least a portion of the plurality of threat detection capability modules; and presenting the rollout schedule to the client.
1. A computer-implemented method, executed on a computing device, comprising:
monitoring, by a plurality of security-relevant subsystems, the activity of each respective security-relevant subsystem with respect to a computing platform, wherein the plurality of security-relevant subsystems include one or more of CDN (Content Delivery Network) systems; DAM (Database Activity Monitoring) systems; UBA (User Behavior Analytics) systems; MDM (Mobile Device Management) systems; IAM (Identity and Access Management) systems; DNS (Domain Name Server) systems, antivirus systems, operating systems, data lakes; data logs; security-relevant software applications; security-relevant hardware systems; and resources external to the computing platform;
generating at least a first set of platform information based upon, at least in part, the monitored activity of at least a portion of the plurality of security-relevant subsystems;
defining a threat mitigation platform for a client based upon, at least in part, the first set of platform information, so as to define at least one threat detection capability module for future installation on the computing platform, including applying a probabilistic process including artificial intelligence/machine learning to the first set of platform information, so as to define at least one threat detection capability module for installation on the computing platform;
defining a rollout schedule for at least a portion of the plurality of threat detection capability modules;
determining a difference between current security-relevant capabilities of the computing platform and possible security-relevant capabilities of the computing platform, including:
determining possible security-relevant capabilities of the computing platform using currently-deployed security relevant subsystem; and
determining possible security-relevant capabilities of the computing platform using one or more supplemental security-relevant subsystems; and
presenting the rollout schedule to the client and an identification of one or more security-relevant deficiencies of the computing platform.
2. The computer-implemented method of claim 1 wherein the rollout schedule is a graphical rollout schedule.
3. The computer-implemented method of claim 1 wherein the rollout schedule is a text-based rollout schedule.
4. The computer-implemented method of claim 1 wherein presenting the rollout schedule to the client includes:
providing the rollout schedule to the client as a periodic platform status update.
5. The computer-implemented method of claim 1 wherein presenting the rollout schedule to the client includes:
providing the rollout schedule to the client as an ad hoc platform status update.
6. The computer-implemented method of claim 1 wherein presenting the rollout schedule to the client includes:
enabling the client to view the rollout schedule via a user interface.
7. The computer-implemented method of claim 1 wherein the rollout schedule defines a date for each of the plurality of threat detection capability modules.
8. The computer-implemented method of claim 1 wherein the rollout schedule defines a content for each of the plurality of threat detection capability modules.
9. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
monitoring, by a plurality of security-relevant subsystems, the activity of each respective security-relevant subsystem with respect to a computing platform, wherein the plurality of security-relevant subsystems include one or more of CDN (Content Delivery Network) systems; DAM (Database Activity Monitoring) systems; UBA (User Behavior Analytics) systems; MDM (Mobile Device Management) systems; IAM (Identity and Access Management) systems; DNS (Domain Name Server) systems, antivirus systems, operating systems, data lakes; data logs; security-relevant software applications; security-relevant hardware systems; and resources external to the computing platform;
generating at least a first set of platform information based upon, at least in part, the monitored activity of at least a portion of the plurality of security-relevant subsystems;
defining a threat mitigation platform for a client based upon, at least in part, the first set of platform information, so as to define at least one threat detection capability module for future installation on the computing platform, including applying a probabilistic process including artificial intelligence/machine learning to the first set of platform information, so as to define at least one threat detection capability module for installation on the computing platform;
defining a rollout schedule for at least a portion of the plurality of threat detection capability modules;
determining a difference between current security-relevant capabilities of the computing platform and possible security-relevant capabilities of the computing platform, including:
determining possible security-relevant capabilities of the computing platform using currently-deployed security relevant subsystem; and
determining possible security-relevant capabilities of the computing platform using one or more supplemental security-relevant subsystems; and
presenting the rollout schedule to the client and an identification of one or more security-relevant deficiencies of the computing platform.
10. The computer program product of claim 9 wherein the rollout schedule is a graphical rollout schedule.
11. The computer program product of claim 9 wherein the rollout schedule is a text-based rollout schedule.
12. The computer program product of claim 9 wherein presenting the rollout schedule to the client includes:
providing the rollout schedule to the client as a periodic platform status update.
13. The computer program product of claim 9 wherein presenting the rollout schedule to the client includes:
providing the rollout schedule to the client as an ad hoc platform status update.
14. The computer program product of claim 9 wherein presenting the rollout schedule to the client includes:
enabling the client to view the rollout schedule via a user interface.
15. The computer program product of claim 9 wherein the rollout schedule defines a date for each of the plurality of threat detection capability modules.
16. The computer program product of claim 9 wherein the rollout schedule defines a content for each of the plurality of threat detection capability modules.
17. A computing system including a processor and memory configured to perform operations comprising:
monitoring, by a plurality of security-relevant subsystems, the activity of each respective security-relevant subsystem with respect to a computing platform, wherein the plurality of security-relevant subsystems include one or more of CDN (Content Delivery Network) systems; DAM (Database Activity Monitoring) systems; UBA (User Behavior Analytics) systems; MDM (Mobile Device Management) systems; IAM (Identity and Access Management) systems; DNS (Domain Name Server) systems, antivirus systems, operating systems, data lakes; data logs; security-relevant software applications; security-relevant hardware systems; and resources external to the computing platform;
generating at least a first set of platform information based upon, at least in part, the monitored activity of at least a portion of the plurality of security-relevant subsystems;
defining a threat mitigation platform for a client based upon, at least in part, the first set of platform information, so as to define at least one threat detection capability module for future installation on the computing platform, including applying a probabilistic process including artificial intelligence/machine learning to the first set of platform information, so as to define at least one threat detection capability module for installation on the computing platform;
defining a rollout schedule for at least a portion of the plurality of threat detection capability modules;
determining a difference between current security-relevant capabilities of the computing platform and possible security-relevant capabilities of the computing platform, including:
determining possible security-relevant capabilities of the computing platform using currently-deployed security relevant subsystem; and
determining possible security-relevant capabilities of the computing platform using one or more supplemental security-relevant subsystems; and
presenting the rollout schedule to the client and an identification of one or more security-relevant deficiencies of the computing platform.
18. The computing system of claim 17 wherein the rollout schedule is a graphical rollout schedule.
19. The computing system of claim 17 wherein the rollout schedule is a text-based rollout schedule.
20. The computing system of claim 17 wherein presenting the rollout schedule to the client includes:
providing the rollout schedule to the client as a periodic platform status update.
21. The computing system of claim 17 wherein presenting the rollout schedule to the client includes:
providing the rollout schedule to the client as an ad hoc platform status update.
22. The computing system of claim 17 wherein presenting the rollout schedule to the client includes:
enabling the client to view the rollout schedule via a user interface.
23. The computing system of claim 17 wherein the rollout schedule defines a date for each of the plurality of threat detection capability modules.
24. The computing system of claim 17 wherein the rollout schedule defines a content for each of the plurality of threat detection capability modules.