Systems and methods for monitoring and correcting computer system security practices
Systems and methods for monitoring and correcting security measures taken for a computer system are disclosed. Exemplary implementations may: determine a set of risk parameters of the computing system; collect sets of values of the security parameters at various times and determine the efficacy adjustments based on a comparison of the sets of values and an elapsed time between collection of the sets of values.
1. A system configured for monitoring and correcting cyber security practices on a computing environment having computing assets, the system comprising:
one or more hardware processors configured by machine-readable instructions to:
(a) receive a cyber security policy defining changes to be applied to computing assets, the cyber security policy further defining procedures to be taken by an organization for effecting the changes, the cyber security policy further defining timing at which the procedures should be implemented;
(b) determine a set of risk management parameters which indicate a state of the computing environment at a time of collection of the risk management parameters, wherein the set of risk management parameters is determined based on at least one of the procedures;
(c) collect successive sets of values of the risk management parameters at predetermined times;
(d) determine, based on at least two of the sets of values of the risk management parameters, that at least one of the procedures has not resulted in the corresponding changes being applied to the computing assets based on the timing at which the procedures should be implemented defined by the cyber security policy such that expected changes associated with the defined procedures to be taken at the defined timing by the organization for effecting the changes have not been affected as it should be according to the received cyber security policy; and
(e) in response to (d) after determining what causes to the corresponding changes have not occurred based on the analysis of (d), adjust at least one of the procedures of the security policy to create an adjusted security policy and apply the adjusted security policy to the computing environment accordingly.
2. The system of claim 1 , wherein (e) indicates that at least one of the changes has not been effected on an intended computing asset at an intended time.
3. The system of claim 1 , wherein (e) indicates changes occurred to at least one computing asset that do not correspond to a change specified by the cyber security policy.
4. The system of claim 1 , wherein (e) comprises adjusting at least one of the procedures of the security policy based on a prioritization of the computing assets.
5. The system of claim 1 , wherein (e) comprises adjusting at least one of the procedures of the security policy based on a prioritization of detected threats to the computing assets.
6. The system of claim 1 , wherein an elapsed time between successive collections of sets of values of the risk management parameters varies.
7. The system of claim 1 , wherein the set of risk management parameters includes parameters related to asset existence, asset value, control conditions, network traffic volume, software status, and/or threat landscape.
8. A computer-implemented method for monitoring and correcting a cyber security policy on a computing environment having computing assets, the method comprising:
(a) receiving a cyber security policy defining changes to be applied to computing assets, the cyber security policy further defining procedures to be taken by an organization for effecting the changes, the cyber security policy further defining timing at which the procedures should be implemented;
(b) determining a set of risk management parameters which indicate a state of the computing environment at a time of collection of the risk management parameters, wherein the set of risk management parameters is determined based on at least one of the procedures;
(c) collecting successive sets of values of the risk management parameters at predetermined times;
(d) determine, based on at least two of the sets of values of the risk management parameters, that at least one of the procedures has not resulted in the corresponding changes being applied to the computing assets based on the timing at which the procedures should be implemented defined by the cyber security policy such that expected changes associated with the defined procedures to be taken at the defined timing by the organization for effecting the changes have not been affected as it should be according to the received cyber security policy; and
(e) in response to (d) after determining what causes to the corresponding changes have not occurred based on the analysis of (d), adjust at least one of the procedures of the security policy to create an adjusted security policy and apply the adjusted security policy to the computing environment accordingly.
9. The method of claim 8 , wherein (e) indicates that at least one of the changes has not been effected on an intended computing asset at an intended time.
10. The method of claim 8 , wherein (e) indicates changes occurred to at least one computing asset that do not correspond to a change specified by the cyber security policy.
11. The method of claim 8 , wherein (e) comprises adjusting at least one of the procedures of the security policy based on a prioritization of the computing assets.
12. The method of claim 8 , wherein (e) comprises adjusting at least one of the procedures of the security policy based on a prioritization of detected threats to the computing assets.
13. The method of claim 8 , wherein an elapsed time between successive collections of sets of values of the risk management parameters varies.
14. The method of claim 8 , wherein the set of risk management parameters includes parameters related to asset existence, asset value, control conditions, network traffic volume, software status, and/or threat landscape.