Dynamic cybersecurity scoring and operational risk reduction assessment
A system and method for operational and cyber risk assessment that utilizes a data-driven approach to evaluate the current security posture and identify areas for improvement based on the user's desired target profile. This process involves estimating the costs and benefits associated with various security program enhancements, increased, hiring, and control uplifts. The system and method then quantify these benefits in terms of reduction in tail value at risk, expected losses, cyber insurance premiums, and the amount of risk capital set aside. The system simulates attack paths associated with various risk scenarios and uses a risk scenario model to compute losses associated with each attack path for each risk scenario. The results of the simulation may be used to determine one or more business outcomes associated with the costs and benefits of implementing security enhancements.
1 . A system for operational and cyber risk assessment, comprising:
a hardware processor of a first computing device configured to execute a first plurality of programming instructions stored in a hardware memory of the first computing device, wherein the first plurality of programming instructions, when executed on the hardware processor, cause the first computing device to:
receive a risk scenario of interest;
receive security control data, wherein the security control data is associated with the risk scenario of interest;
use a directed computational graph to retrieve network topology data of a network from at least a subset of a cyber-physical graph comprising nodes and edges, wherein:
the nodes represent hardware, software, and entities in the network, and
the edges represent relationships between the nodes, wherein the relationships are associated with:
business processes that rely on the hardware, software, or entities in the network, and
financial flows that rely on the business processes;
update the risk scenario of interest based on the retrieved network topology data and reconnaissance data obtained from external network scanning;
simulate a plurality of attack paths against the network based on the security control data, the updated risk scenario interest, and the network topology data to determine a key control;
compare predicted vulnerability scores from the simulated plurality of attack paths against actual vulnerability scores to generate a confidence score;
update the risk scenario of interest based on the confidence score; and
generate one or more predicted business outcomes based at least on the key control and the confidence score.
2 . The system of claim 1 , wherein the directed computational graph comprises a second plurality of programming instructions stored in the hardware memory of and operating on the hardware processor of the first computing device, wherein the second plurality of programming instructions, when executed on the hardware processor, cause the first computing device to:
produce a first weighted cybersecurity score based on at least a portion of transformation operations, wherein the first weighted cybersecurity score represents a predicted risk scenario of interest;
simulate a cybersecurity attack against the network based on the weighted cybersecurity score;
produce a second weighted cybersecurity score based on an outcome of the simulated cybersecurity attack, wherein the second weighted cybersecurity score represents an actual vulnerability to a cybersecurity attack of a type that was simulated;
compare the first weighted cybersecurity score against the second weighted cybersecurity score to produce a confidence score, wherein the confidence score represents an accuracy of the predicted risk scenario of interest based on the outcome of the simulated cybersecurity attack; and
update the risk scenario of interest based on the confidence score.
3 . The system of claim 1 , wherein the risk scenario of interest comprises a scenario name, a relative likelihood of occurrence, an expected loss derived based on a severity of a risk event associated with the scenario, and a cause linked to a set of entities, threat actor capabilities, and business systems.
4 . The system of claim 1 , wherein updating the risk scenario of interest comprises computing a total tail value at risk.
5 . The system of claim 1 , wherein the one or more predicted business outcomes is a return on investment.
6 . The system of claim 1 , wherein the one or more predicted business outcomes is an amount of capital that should be set aside to cover expected losses associated with the risk scenario of interest.
7 . The system of claim 1 , wherein the first plurality of programming instructions, when executed on the hardware processor, further cause the first computing device to:
receive a list of real or representative threat actors and associated tactics, techniques, and procedures that are consistent with operational capabilities associated with the threat actors;
update the risk scenario of interest based on the received list;
simulate a plurality of attack paths against the network based on the security control data, a threat actor of interest, the updated risk scenario of interest, and the network topology data to determine the key control; and
generate one or more predicted business outcomes based at least on the key control.
8 . The system of claim 1 , wherein the key control comprises a suggested modification or addition.
9 . The system of claim 1 , wherein the one or more business outcomes is associated with an insurance-linked security.
10 . A method for operational and cyber risk assessment, comprising the steps of:
receiving a risk scenario of interest;
receiving security control data, wherein the security control data is associated with the risk scenario of interest;
using a directed computational graph to retrieve network topology data of a network from at least a subset of a cyber-physical graph comprising nodes and edges, wherein:
the nodes represent hardware, software, and entities in the network, and
the edges represent relationships between the nodes, wherein the relationships are associated with:
business processes that rely on the hardware, software, or entities in the network, and
financial flows that rely on said business processes;
updating the risk scenario of interest based on the retrieved network topology data and reconnaissance data obtained from external network scanning;
simulating a plurality of attack paths against the network based on the security control data, the updated risk scenario of interest, and the network topology data to determine a key control;
comparing predicted vulnerability scores from the simulated plurality of attack paths against actual vulnerability scores to generate a confidence score; and
generating one or more predicted business outcomes based at least on the key control and the confidence score.
11 . The method of claim 10 , further comprising the steps of:
producing a first weighted cybersecurity score based on at least a portion of transformation operations, wherein the first weighted cybersecurity score represents a predicted risk scenario of interest;
simulating a cybersecurity attack against the network based on the weighted cybersecurity score;
producing a second weighted cybersecurity score based on an outcome of the simulated cybersecurity attack, wherein the second weighted cybersecurity score represents an actual vulnerability to a cybersecurity attack of a type that was simulated;
comparing the first weighted cybersecurity score against the second weighted cybersecurity score to produce a confidence score, wherein the confidence score represents an accuracy of the predicted risk scenario of interest based on the outcome of the simulated cybersecurity attack; and
updating the risk scenario of interest based on the confidence score.
12 . The method of claim 10 , wherein the risk scenario of interest comprises a scenario name, a relative likelihood of occurrence, an expected loss derived based on a severity of a risk event associated with the scenario, and a cause linked to a set of entities, threat actor capabilities, and business systems.
13 . The method of claim 10 , wherein updating the risk scenario of interest comprises computing a total tail value at risk.
14 . The method of claim 10 , wherein the one or more predicted business outcomes is a return on investment.
15 . The method of claim 10 , wherein the one or more predicted business outcomes is an amount of capital that should be set aside to cover expected losses associated with the risk scenario of interest.
16 . The method of claim 10 , further comprising the steps of:
receiving a list of real or representative threat actors and associated tactics, techniques, and procedures that are consistent with operational capabilities associated with the threat actors;
updating the risk scenario of interest based on the received list;
simulating a plurality of attack paths against the network based on the security control data, a threat actor of interest, the updated risk scenario of interest, and the network topology data to determine the key control; and
generating one or more predicted business outcomes based at least on the key control.
17 . The method of claim 10 , wherein the key control comprises a suggested modification or addition.
18 . The method of claim 10 , wherein the one or more business outcomes is associated with an insurance-linked security.