Information technology security assessment system
A method and system for creating a composite security rating from security characterization data of a third party computer system. The security characterization data is derived from externally observable characteristics of the third party computer system. Advantageously, the composite security score has a relatively high likelihood of corresponding to an internal audit score despite use of externally observable security characteristics. Also, the method and system may include use of multiple security characterizations all solely derived from externally observable characteristics of the third party computer system.
1. A method comprising:
collecting information about two or more organizations that have computer systems, network resources, and employees, the organizations posing risks through business relationships of the organizations with other parties, the information collected about the organizations being indicative of compromises, vulnerabilities or configurations of technology systems of the organizations and indicative of resiliencies of the organizations to recover from such compromises, vulnerabilities or configurations, the information indicative of durations of events associated with compromises or vulnerabilities or configurations,
at least some of the information about each of the organizations being collected automatically by computer using sensors on the Internet,
the information about each of the organizations being collected from two or more sources, one or more of the sources not being controlled by the organization, the information from at least the one or more sources that are not controlled by the organization being collected without permission of the organization,
at least partly automatically gathering information about assets that each of the organizations owns, controls, uses, or is affiliated with, including IP addresses and IP network address ranges, computer services residing within address ranges, or domain names,
at least one of the sources for each of the organizations comprising a public source or a commercial source,
processing by computer the information from the two or more sources for each of the organizations to form a composite rating of the organization that is indicative of a degree of risk to the organization or to a party through a business relationship with the organization, the composite rating comprising a calculated composite of metrics and data derived or collected from the sources, the processing comprising applying transformations to the data and metrics, and the processing comprising applying weights to the data and the metrics,
the metrics including a measure of the extent of, the frequency of, or duration of compromise of the technology systems of the organization, or of a configuration or vulnerability of the organization, and a measure of the resilience of the organization to recover from such vulnerability, the measure of the resilience being inversely proportional to the duration of detected malicious activity, and
in connection with assessing a business risk to the organization or to a party through a business relationship with at least one of the organizations, delivering reports of the composite ratings of the organizations through a reporting facility to enable users of the reporting facility to monitor, assess, and mitigate the risks, based on the security vulnerabilities and resiliencies, in doing business with the organization and to compare the composite ratings of the organizations.
2. The method of claim 1 , wherein the collected information is represented by at least two data types.
3. The method of claim 2 , wherein the at least two data types include at least one of breach disclosures, block lists, configuration parameters, an identification of malware servers, an identification of a reputation, an identification of suspicious activity, an identification of spyware, white lists, an identification of compromised hosts, an identification of malicious activity, an identification of spam activity, an identification of vulnerable hosts, an identification of phishing activity, or an identification of e-mail viruses.
4. The method of claim 1 , wherein the collected information evidences internal security controls.
5. The method of claim 1 , wherein the collected information comprises outcomes of each of the organizations.
6. The method of claim 1 , wherein the collected information evidences operational execution of security measures of each of the organizations.
7. The method of claim 1 , wherein the collected information indicates whether a computer system of each of the organizations served malicious code to another system.
8. The method of claim 1 , wherein the collected information indicates whether a computer system of each of the organizations communicated with a known attacker controlled network or sensor outside the control or network of the organization.
9. The method of claim 1 , comprising: forming a series of the security ratings of each of the organizations.
10. The method of claim 9 , comprising: determining a trend from the series of ratings.
11. The method of claim 9 , comprising displaying the series of composite ratings.
12. The method of claim 11 , wherein displaying the series of composite ratings for each of the organizations comprises posting the series of composite ratings for the organization to a web portal.
13. The method of claim 1 , wherein the collected information represents externally observable outcome information.
14. The method of claim 1 , comprising: determining a badness score that corresponds to an intensity or duration of malicious activity determined from the collected information.
15. The method of claim 1 , wherein: the collected information comprises at least two security characterizations of a computer system of each of the organizations.
16. The method of claim 1 , wherein the collected information comprises a characterization of behavior of an employee of at least one of the organizations.
17. The method of claim 1 , wherein the collected information comprises characterizations other than characterizations about a computer system of at least one of the organizations.
18. The method of claim 1 , wherein the collected information comprises characterizations about policies of at least one of the organizations.
19. The method of claim 1 , wherein the collected information comprises characterizations about information technology assets that at least one of the organizations owns, controls, uses, or is affiliated with.
20. The method of claim 1 in which collected information represents: (a) physical states, (b) technical states, (c) organizational states, or (d) cultural states of at least one of the organizations which can be exploited to create a security breach; or (e) the organization's ability to recover from a security breach; or any combination of two or more of these.
21. The method of claim 1 in which processing the information to form a composite rating comprises correlating data across the sources of information.
22. The method of claim 1 in which processing the information to form a composite rating comprises statistically correlating the composite rating with actual outcomes.
23. The method of claim 1 in which the vulnerability comprises physical, technical, organizational, or cultural states that can be exploited to create a security breach.
24. A method comprising:
collecting, from at least two sources, information about two or more organizations, the collected information representing at least two data types, the collected information comprising outcomes of each of the organizations,
at least some of the information for each of the organizations being collected automatically by computer from at least two sources, one or more of the sources not controlled by the organization,
the information from at least the one or more sources that are not controlled by the organization being collected without permission of the organization, at least one of the sources including a commercial data source,
processing the information from both of the two sources for each of the organizations to form a composite rating of a security vulnerability of the organization and of a resilience of the organization to recover from a security breach, the resilience being inversely proportional to the duration of detected malicious activity, the processing including applying models that account for differences in the respective sources,
normalizing the composite rating of each of the organizations based on a size characteristic of the organization to enable comparisons of composite ratings between the two or more organizations,
forming a series of the security ratings of each of the organizations, determining a trend from the series of ratings, and displaying the series of composite ratings through a portal,
determining a badness score that corresponds to an intensity or duration of malicious activity determined from the collected information, and
reporting the composite ratings of the organizations through a portal to enable customers to monitor, assess, and mitigate risk in doing business with the organizations and to compare the composite ratings across the organizations.
25. The system of claim 24 , determining a confidence range of the composite rating, the size of the range varying inversely with the level of confidence in the composite rating.
26. The system of claim 25 , wherein the confidence range is based on redundancy of the security characterizations.
27. The system of claim 25 , wherein the confidence range is based on a size of the third party computer system.
28. The method of claim 1 comprising ranking the organization and other organizations within sectors or peer-groups or globally.
29. A method comprising:
collecting information about an organization that has computer systems, network resources, and employees, the organization posing risks to itself or to other parties through business relationships of the organization with the other parties,
the information collected about the organization including (a) information collected automatically by computer on the Internet without permission of the organization, and (b) information indicative of resiliencies of the organization to recover from a security breach associated with a compromise or a vulnerability, the resiliencies being inversely proportional to the duration of detected malicious activity,
processing the information by computer to form a composite rating of the organization that is indicative of a degree of risk based on a business relationship with the organization, the composite rating comprising a measure of the resiliencies of the organization to recover from a security breach, and
in connection with assessing the degree of risk, delivering a report of the composite rating of the organization through a reporting facility to enable a user of the reporting facility to assess the risks, based at least in part on the resiliencies.