Security assessment platform
A platform is described for collecting and providing intelligence regarding security and/or other aspect(s), and for providing an assessment of the security and/or other aspects of the organization based on the collected and analyzed intelligence. In some implementations, the platform may assess security according to a lean security paradigm, and the platform may be described as a lean security intelligence platform. The platform provides a set of integrated tools for measurement, analytics, and reporting of security aspects and/or other aspects of an organization. The platform provides master assessment scores that gauge the maturity levels of the organization's overall security and/or compliance readiness, in some instances in accordance with Lean Security practices and/or principles. The platform provides access to an organization's analysis with respect to various metrics that are monitored over time determine whether the organization's performance is improving (or degrading) with respect to the metrics.
1. A computer-implemented method performed by at least one processor, the method comprising:
receiving, by the at least one processor, input data that is provided through an assessment platform;
analyzing, by the at least one processor, the input data to generate one or more metrics that each provide a measurement of an operational aspect of an organization, wherein the one or more metrics include one or more metrics that provide an assessment of a software or system development lifecycle (SDLC);
generating, by the at least one processor, one or more tasks based on one or more of the input data and the one or more metrics; and
presenting, by the at least one processor, the one or more metrics and the one or more tasks through a user interface (UI) of the assessment platform; and
wherein the analyzing of the input data employs at least one machine learning technique, wherein the at least one machine learning technique comprises a trained machine learning classifier that predicts one or more of the one or more metrics based on the input data, wherein the trained machine learning classifier is trained using labeled training data that indicates a metric corresponding to one or more values within a set, subset, or element of the labeled training data.
2. The method of claim 1 , wherein the input data is generated by at least one data collection module that executes in the assessment platform to automatically generate the input data based on examination of one or more systems under assessment (SUAs) that are associated with the organization.
3. The method of claim 1 , wherein the input data is entered through the UI of the assessment platform.
4. The method of claim 3 , wherein the UI presents at least one question that is answered, through the UI, to generate at least a portion of the input data.
5. The method of claim 4 , wherein a particular answer to a question causes a satisfier, executing in the assessment platform, to automatically generate at least one of the one or more tasks.
6. The method of claim 1 , wherein the one or more SDLC assessment metrics include one or more of a core principle metric, a category metric, and a subcategory metric.
7. The method of claim 1 , wherein the one or more tasks are organized into one or more stories that each includes at least one task.
8. The method of claim 1 , further comprising:
receiving, by the at least one processor, through the UI, an indication of completion of at least one of the one or more tasks and, in response, updating at least one of the one or more metrics based on the completion of the at least one task.
9. A system comprising:
at least one processor; and
memory communicatively coupled to the at least one processor, the memory storing instructions which, when executed by the at least one processor, cause the at least one processor to perform operations comprising:
receiving input data that is provided through an assessment platform;
analyzing the input data to generate one or more metrics that each provide a measurement of an operational aspect of an organization, wherein the one or more metrics include one or more metrics that provide an assessment of a software or system development lifecycle (SDLC);
generating one or more tasks based on one or more of the input data and the one or more metrics; and
presenting the one or more metrics and the one or more tasks through a user interface (UI) of the assessment platform; and
wherein the analyzing of the input data employs at least one machine learning technique, wherein the at least one machine learning technique comprises a trained machine learning classifier that predicts one or more of the one or more metrics based on the input data, wherein the trained machine learning classifier is trained using labeled training data that indicates a metric corresponding to one or more values within a set, subset, or element of the labeled training data.
10. The system of claim 9 , wherein the input data is generated by at least one data collection module that executes in the assessment platform to automatically generate the input data based on examination of one or more systems under assessment (SUAs) that are associated with the organization.
11. The system of claim 9 , wherein the input data is entered through the UI of the assessment platform.
12. The system of claim 11 , wherein the UI presents at least one question that is answered, through the UI, to generate at least a portion of the input data.
13. The system of claim 12 , wherein a particular answer to a question causes a satisfier, executing in the assessment platform, to automatically generate at least one of the one or more tasks.
14. The system of claim 9 , wherein the one or more SDLC assessment metrics include one or more of a core principle metric, a category metric, and a subcategory metric.
15. The system of claim 9 , wherein the one or more tasks are organized into one or more stories that each includes at least one task.
16. The system of claim 9 , the operations further comprising:
receiving, through the UI, an indication of completion of at least one of the one or more tasks and, in response, updating at least one of the one or more metrics based on the completion of the at least one task.
17. One or more computer-readable storage media storing instructions which, when executed by at least one processor, cause the at least one processor to perform operations comprising:
receiving input data that is provided through an assessment platform;
analyzing the input data to generate one or more metrics that each provide a measurement of an operational aspect of an organization, wherein the one or more metrics include one or more metrics that provide an assessment of a software or system development lifecycle (SDLC);
generating one or more tasks based on one or more of the input data and the one or more metrics; and
presenting the one or more metrics and the one or more tasks through a user interface (UI) of the assessment platform; and
wherein the analyzing of the input data employs at least one machine learning technique, wherein the at least one machine learning technique comprises a trained machine learning classifier that predicts one or more of the one or more metrics based on the input data, wherein the trained machine learning classifier is trained using labeled training data that indicates a metric corresponding to one or more values within a set, subset, or element of the labeled training data.
18. The method of claim 1 , wherein the tasks are oriented for achieving one or more objectives of the organization, wherein the one or more objectives include a software delivery pipeline time-to-market objective.
19. The method of claim 1 , wherein the one or more SDLC assessment metrics comprise metrics for a plurality of categories, wherein the categories include a DevOps category.
20. The method of claim 19 , wherein the categories further include a security category, an agile category, and a compliance category.
21. The system of claim 9 , wherein the tasks are oriented for achieving one or more objectives of the organization, wherein the one or more objectives include a software delivery pipeline time-to-market objective.
22. The system of claim 9 , wherein the one or more SDLC assessment metrics comprise metrics for a plurality of categories, wherein the categories include a DevOps category.
23. The system of claim 22 , wherein the categories further include a security category, an agile category, and a compliance category.
24. The one or more computer-readable storage media of claim 17 , wherein the tasks are oriented for achieving one or more objectives of the organization, wherein the one or more objectives include a software delivery pipeline time-to-market objective.
25. The one or more computer-readable storage media of claim 17 , wherein the one or more SDLC assessment metrics comprise metrics for a plurality of categories, wherein the categories include a DevOps category.
26. The one or more computer-readable storage media of claim 25 , wherein the categories further include a security category, an agile category, and a compliance category.