Systems and methods for cybersecurity risk assessment
In an illustrative embodiment, methods and systems for cybersecurity assessment of an organization's technology infrastructure include identifying features of the technology infrastructure and automatically generating a threat profile relevant to both the technology infrastructure and the organization's business (and/or business objectives), where the threat profile includes potential threat actors and threat scenarios applicable to the technology infrastructure. The methods and systems may include evaluating cybersecurity controls of the organization's technology infrastructure in light of the threat profile to identify and rate vulnerabilities within the technology infrastructure.
1. A system for assessing cybersecurity risk for an organization, the system comprising:
at least one non-transitory computer readable medium configured to store a respective plurality of control ratings corresponding to each respective entity of a plurality of entities, wherein
each control rating of the respective plurality of control ratings was calculated based on evaluating a respective entity infrastructure profile of the respective entity; and
one or more processors configured to perform operations comprising
receiving an infrastructure profile comprising identification of a plurality of cybersecurity controls of the organization and a plurality of technology assets of the organization, wherein receiving the infrastructure profile comprises
collecting, through a set of survey questions presented to one or more representatives of the organization via a graphical user interface, at least a portion of the infrastructure profile,
evaluating the infrastructure profile in view of at least three types of cybersecurity threats, wherein the evaluating comprises
for each respective cybersecurity control of the plurality of cybersecurity controls identified in the infrastructure profile, calculating a rating of the respective cybersecurity control in view of a control environment defined by a portion of the infrastructure profile,
accessing, from the at least one non-transitory computer readable medium, a plurality of peer ratings corresponding to a plurality of peer entity infrastructures of at least a portion of the plurality of entities, wherein the plurality of peer ratings comprises, for each peer entity infrastructure of the plurality of peer entity infrastructures, a rating corresponding to each respective cybersecurity control of the plurality of cybersecurity controls,
calculating, from the plurality of peer ratings, a plurality of benchmark ratings comprising a respective benchmark rating corresponding to each respective cybersecurity control of the plurality of cybersecurity controls,
generating, for presentation at a computing device, an infrastructure evaluation, wherein the infrastructure evaluation comprises a graphical comparison of a respective rating of each cybersecurity control of the plurality of cybersecurity control to a corresponding benchmark rating of the plurality of benchmark ratings, and
providing, via a network to the computing device, the infrastructure evaluation for review by at least one representative of the organization.
2. The system of claim 1 , wherein each cybersecurity control of the plurality of cybersecurity controls is defined using the National Institute of Standards and Technology cybersecurity framework.
3. The system of claim 1 , wherein calculating the plurality of benchmark ratings comprises, for each respective cybersecurity control of the plurality of cybersecurity controls, calculating a mean value of a respective peer rating across all entities of the portion of the plurality of entities.
4. The system of claim 1 , wherein the operations further comprise identifying the portion of the plurality of entities as a set of peer entities based on one or more of an industry or a size of the organization.
5. The system of claim 1 , wherein the operations further comprise identifying the portion of the plurality of entities as a set of peer entities based the plurality of technology assets of the infrastructure profile.
6. The system of claim 1 , wherein the operations further comprise using information of the infrastructure evaluation to request, on behalf of the organization, at least one quote for cybersecurity insurance, wherein
the at least one quote is requested from one or more cybersecurity insurance vendors.
7. The system of claim 1 , wherein the plurality of cybersecurity controls comprises one or more of an access protection, an encryption mechanism, or a firewall.
8. The system of claim 1 , wherein the plurality of cybersecurity controls comprises employee training related to protecting data resources within the organization.
9. The system of claim 1 , wherein the at least three types of cybersecurity threats comprise one or more of phishing, malware, or denial of service attack.
10. The system of claim 1 , wherein collecting the portion of the infrastructure profile through the set of survey questions comprises presenting survey information corresponding to the set of survey questions to a given member of the organization to accept the survey information, wherein
one or more additional members of the organization different than the given member submitted the survey information.
11. A method for assessing cybersecurity risk for an organization, the method comprising:
receiving an infrastructure profile comprising identification of a plurality of cybersecurity controls of the organization and a plurality of technology assets of the organization, wherein receiving the infrastructure profile comprises
collecting, through a set of survey questions presented to one or more representatives of the organization via a graphical user interface, at least a portion of the infrastructure profile;
evaluating, by one or more processors, the infrastructure profile in view of at least three types of cybersecurity threats, wherein the evaluating comprises
for each respective cybersecurity control of the plurality of cybersecurity controls identified in the infrastructure profile, calculating a rating of the respective cybersecurity control in view of a control environment defined by a portion of the infrastructure profile;
accessing, from at least one non-transitory computer readable medium, a plurality of peer ratings corresponding to a plurality of peer entity infrastructures of at least a portion of a plurality of entities, wherein
the plurality of peer ratings comprises, for each peer entity infrastructure of the plurality of peer entity infrastructures, a rating corresponding to each respective cybersecurity control of the plurality of cybersecurity controls;
by the one or more processors, calculating, from the plurality of peer ratings, a plurality of benchmark ratings comprising a respective benchmark rating corresponding to each respective cybersecurity control of the plurality of cybersecurity controls;
by the one or more processors, generating, for presentation at a computing device, an infrastructure evaluation, wherein the infrastructure evaluation comprises a graphical comparison of a respective rating of each cybersecurity control of the plurality of cybersecurity control to a corresponding benchmark rating of the plurality of benchmark ratings; and
providing, via a network to the computing device, the infrastructure evaluation for review by at least one representative of the organization.
12. The method of claim 11 , wherein each cybersecurity control of the plurality of cybersecurity controls is defined using the National Institute of Standards and Technology cybersecurity framework.
13. The method of claim 11 , wherein calculating the plurality of benchmark ratings comprises, for each respective cybersecurity control of the plurality of cybersecurity controls, calculating a mean value of a respective peer rating across all entities of the portion of the plurality of entities.
14. The method of claim 11 , further comprising identifying, by the one or more processors, the portion of the plurality of entities as a set of peer entities based on one or more of an industry or a size of the organization.
15. The method of claim 11 , further comprising identifying, by the one or more processors, the portion of the plurality of entities as a set of peer entities based the plurality of technology assets of the infrastructure profile.
16. The method of claim 11 , further comprising using information of the infrastructure evaluation to request, on behalf of the organization, at least one quote for cybersecurity insurance, wherein
the at least one quote is requested from one or more cybersecurity insurance vendors.
17. The method of claim 11 , wherein the plurality of cybersecurity controls comprises one or more of an access protection, an encryption mechanism, or a firewall.
18. The method of claim 11 , wherein the plurality of cybersecurity controls comprises employee training related to protecting data resources within the organization.
19. The method of claim 11 , wherein the at least three types of cybersecurity threats comprise one or more of phishing, malware, or denial of service attack.
20. The method of claim 11 , wherein collecting the portion of the infrastructure profile through the set of survey questions comprises presenting survey information corresponding to the set of survey questions to a given member of the organization to accept the survey information, wherein
one or more additional members of the organization different than the given member submitted the survey information.