Systems and methods for cybersecurity risk assessment
In an illustrative embodiment, methods and systems for cybersecurity assessment of an organization's technology infrastructure include identifying features of the technology infrastructure and automatically generating a threat profile relevant to both the technology infrastructure and the organization's business (and/or business objectives), where the threat profile includes potential threat actors and threat scenarios applicable to the technology infrastructure. The methods and systems may include evaluating cybersecurity controls of the organization's technology infrastructure in light of the threat profile to identify and rate vulnerabilities within the technology infrastructure.
1 . A system for automatically evaluating cybersecurity controls deployed by an entity to protect assets of a technological infrastructure, the system comprising:
a non-transitory computer readable data store comprising a plurality of defined cybersecurity threats; and
one or more processors configured to perform operations comprising
obtaining at least one industry of a plurality of industries associated with the entity,
obtaining entity information via analyzing resources connected to a network infrastructure of the entity, the entity information comprising
a plurality of technology infrastructure items of a technology infrastructure of a subject entity, and
a plurality of digital information controls applied by the subject entity to protect data within the technology infrastructure,
analyzing the entity information to identify a set of cybersecurity threats of the plurality of defined cybersecurity threats as a function of criticality to the technology infrastructure, wherein
a portion of the plurality of technology infrastructure items are designated as a set of high priority technology infrastructure items, and
the set of cybersecurity threats is identified based in part on impact to the set of high priority technology infrastructure items,
for each respective threat of the set of cybersecurity threats, calculating a cyber risk score in view of i) a control environment defined by a portion of the technology infrastructure as captured in the entity information, and ii) one or more controls of the plurality of digital information controls relevant to the control environment,
accessing, from at least one non-transitory computer readable medium, a plurality of peer ratings corresponding to a set of peer technology infrastructures of at least a portion of a plurality of technology infrastructures of a plurality of entities, wherein the set of peer technology infrastructures is identified based at least in part on the at least one industry of the entity,
calculating, from the plurality of peer ratings, a plurality of benchmark ratings comprising a respective benchmark rating corresponding to each cybersecurity threat of the set of cybersecurity threats, and
generating, for presentation at a computing device, an infrastructure evaluation comprising, for each respective threat of the set of cybersecurity threats, a graphical comparison of the cyber risk score of the respective threat for the subject entity to a corresponding benchmark rating of the plurality of benchmark ratings.
2 . The system of claim 1 , wherein at least a portion of the entity information is obtained via an interactive graphical user interface.
3 . The system of claim 1 , wherein the entity information comprises at least one geography of a plurality of geographies.
4 . The system of claim 1 , wherein the operations further comprise determining a recommended level of insurance for insuring against cybersecurity loss related to each cybersecurity threat of at least a portion of the set of cybersecurity threats.
5 . The system of claim 4 , wherein the infrastructure evaluation comprises the recommended level of insurance.
6 . The system of claim 4 , wherein the operations further comprise requesting, from one or more computing systems of one or more cybersecurity insurance vendors, at least one quote for cybersecurity insurance.
7 . The system of claim 1 , wherein the set of cybersecurity threats comprises one or more of social engineering, malware, or denial of service attack.
8 . The system of claim 1 , wherein each threat of the set of cybersecurity threats comprises a given threat actor of a plurality of threat actors, a given threat vector of a plurality of threat vectors, and a given threat scenario of a plurality of threat scenarios.
9 . The system of claim 1 , wherein the operations further comprise designating a portion of the plurality of technology infrastructure items as the set of high priority technology infrastructure items.
10 . The system of claim 9 , wherein designating the portion of the plurality of technology infrastructure items as the set of high priority technology infrastructure items comprises assigning, to each item of the portion of the plurality of technology infrastructure items, at least one criticality factor of a set of criticality factors.
11 . The system of claim 10 , wherein the set of criticality factors comprises at least one of confidentiality, integrity, availability, or financial value.
12 . The system of claim 1 , wherein the operations further comprise:
accessing post loss data corresponding to at least one of claims, insurance subscriptions, digital forensics, or incidence responses associated with cyber attacks;
correlating the post loss data with a portion of the plurality of technology infrastructure items; and
automatically identifying one or more additional threats of the plurality of defined cybersecurity threats based upon the correlation of the post loss data with the portion of the plurality of technology infrastructure items.
13 . The system of claim 1 , wherein the operations further comprise:
automatically collecting information on resources connected to a network of the subject entity;
wherein at least a portion of the plurality of technology infrastructure items are added to the entity information via the automatic collection.
14 . The system of claim 1 , wherein the plurality of technology infrastructure items comprises one or more confidential data collections.
15 . The system of claim 1 , wherein each respective subset of one or more subsets of the plurality of technology infrastructure items is associated, in the entity information, with a respective business area of a plurality of business areas of the subject entity.
16 . The system of claim 15 , wherein the plurality of business areas comprises one or more of an intellectual property business area, a customer business area, a human resources business area, a communication business area, a financial business area, or a legal business area.
17 . The system of claim 1 , wherein a subset of the plurality of technology infrastructure items is associated, in the entity information, with delivery of a commercial service.
18 . A method for automatically evaluating cybersecurity controls deployed by an entity to protect assets of a technological infrastructure, the method comprising:
obtaining, by processing circuitry, at least one industry of a plurality of industries associated with the entity;
obtaining, by the processing circuitry, entity information via analyzing resources connected to a network infrastructure of the entity, the entity information comprising
a plurality of technology infrastructure items of a technology infrastructure of a subject entity, and
a plurality of digital information controls applied by the subject entity to protect data within the technology infrastructure;
analyzing, by the processing circuitry, the entity information to identify a set of cybersecurity threats of a plurality of defined cybersecurity threats as a function of criticality to the technology infrastructure, wherein
a portion of the plurality of technology infrastructure items are designated as a set of high priority technology infrastructure items, and
the set of cybersecurity threats is identified based in part on impact to the set of high priority technology infrastructure items;
for each respective threat of the set of cybersecurity threats, calculating, by the processing circuitry, a cyber risk score in view of i) a control environment defined by a portion of the technology infrastructure as captured in the entity information, and ii) one or more controls of the plurality of digital information controls relevant to the control environment;
accessing, from at least one non-transitory computer readable medium, a plurality of peer ratings corresponding to a set of peer technology infrastructures of at least a portion of a plurality of technology infrastructures of a plurality of entities, wherein the set of peer technology infrastructures is identified based at least in part on the at least one industry of the entity;
calculating, by the processing circuitry from the plurality of peer ratings, a plurality of benchmark ratings comprising a respective benchmark rating corresponding to each cybersecurity threat of the set of cybersecurity threats; and
generating, by the processing circuitry for presentation at a computing device, an infrastructure evaluation comprising, for each respective threat of the set of cybersecurity threats, a graphical comparison of the cyber risk score of the respective threat for the subject entity to a corresponding benchmark rating of the plurality of benchmark ratings.
19 . The method of claim 18 , further comprising determining, by the processing circuitry, a recommended level of insurance for insuring against cybersecurity loss related to each cybersecurity threat of at least a portion of the set of cybersecurity threats, wherein
the infrastructure evaluation comprises the recommended level of insurance.
20 . The method of claim 18 , further comprising designating, by the processing circuitry based on evaluating the entity information, a portion of the plurality of technology infrastructure items as the set of high priority technology infrastructure items.