Rating organization cybersecurity using active and passive external reconnaissance
A system for cybersecurity rating using active and passive external reconnaissance, that uses a web crawler that sends message prompts to external hosts and receives responses from external hosts, a time-series data store that produces time-series data from the message responses, and a directed computational graph module that analyzes the time-series data to produce a weighted score representing the overall cybersecurity state of an organization.
1. An advanced cyber decision platform for external network reconnaissance and cybersecurity rating, the platform comprising:
a computing device comprising a hardware memory and a hardware processor;
a time-series data module comprising a first plurality of programming instructions stored in the memory and operating on the processor, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:
receive cybersecurity reconnaissance data about a company from a web crawler;
produce time-series data based on at least a portion of the cybersecurity reconnaissance data;
a directed computational graph module comprising a second plurality of programming instructions stored in the memory and operating on the processor, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
retrieve at least a portion of the time-series data;
receive a directed computational graph representing a workflow for performing a plurality of transformation operations on at least a portion of the time-series data, wherein the directed computational graph comprises nodes and edges, the nodes representing the transformation operations and the edges representing message outputs between the nodes; and
produce a weighted cybersecurity score based on at least a portion of the transformation operations, wherein the weighted cybersecurity score represents a risk of external cyber-security threats to the company based on the collected cybersecurity reconnaissance data; and
a web crawler comprising a third plurality of programming instructions stored in the memory and operating on the processor, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:
collect cybersecurity reconnaissance data from websites and web applications relevant to the company, the collection of cybersecurity reconnaissance data comprising:
identifying portions of each website or web application that web crawlers are requested to ignore;
fingerprinting each website or web application to identify characteristic patterns or markers that may be used to identify host or application details; and
checking each web application and website's administrative pages to determine if any administrative portals are vulnerable to cyber-attacks; and
provide the cybersecurity reconnaissance data to the time-series data module.
2. A method for external network reconnaissance and cybersecurity rating, comprising the steps of:
using a web crawler to:
collect cybersecurity reconnaissance data for websites and web applications relevant to a company, the collection of cybersecurity reconnaissance data comprising:
identifying portions of each website or web application that web crawlers are requested to ignore;
fingerprinting each website or web application to identify characteristic patterns or markers that may be used to identify host or application details;
checking each web application and each website's administrative pages to determine if any administrative portals are vulnerable to cyber-attacks; and
provide the cybersecurity reconnaissance data to a time-series data module;
producing, using the time-series data module, time-series data based on at least a portion of the collected cybersecurity reconnaissance data;
receiving, at a directed computational graph module, a directed computational graph representing a workflow for performing a plurality of transformation operations on at least a portion of the time-series data, wherein the directed computational graph comprises nodes and edges, the nodes representing the transformation operations and the edges representing message outputs between the nodes; and
producing, using the directed computational graph module, a weighted score based on at least a portion of the transformation operations, wherein the weighted score represents a risk of external cyber-security threats to the company based on the collected cybersecurity reconnaissance data.