Systems and methods for accelerating cybersecurity assessments
The disclosure relates to a method of selecting a cybersecurity action plan; sending one or more questions; receiving a response to each of the one or more questions; for each question mapped to at least one risk vector rating: determining a risk score based on a weighted combination of the at least one risk vector rating and at least one weight; determining an indication of whether the question is indicative of a cybersecurity risk; and if the risk score is less than or equal to the threshold, assigning a flag to the question to indicate the question is indicative of a cybersecurity risk; and displaying an assessment report configured to show an assessment of cybersecurity risk of the affiliate.
1. A computer-implemented method comprising:
selecting, for an affiliate of a plurality of affiliates of an entity, a cybersecurity action plan, wherein the selection is based on a combination of a cybersecurity criticality tier, one or more risk vector ratings for one or more risk vectors, and a security rating for the affiliate, wherein the cybersecurity criticality tier is selected from a set of cybersecurity criticality tiers, and wherein the one or more risk vector ratings are derived from externally-observable information for IP address-based assets of the affiliate;
sending, to the affiliate, one or more questions, wherein at least one question of the one or more questions is mapped to at least one risk vector and at least one risk vector rating for the at least one risk vector;
receiving, from the affiliate, a response to each of the one or more questions;
for each question mapped to at least one risk vector rating:
determining a risk score for the question based on a weighted combination of the at least one risk vector rating and a weight for the at least one risk vector rating;
determining, based on a comparison of the risk score to a threshold, an indication of whether the question is indicative of a cybersecurity risk; and
when the risk score is less than or equal to the threshold, assigning a flag to the question to indicate the question is indicative of a cybersecurity risk; and
causing display of an assessment report configured to show an assessment of cybersecurity risk of the affiliate, wherein the assessment report comprises the one or more questions, the response to each of the one or more questions, the at least one risk vector rating for each question mapped to the at least one risk vector, and the flag displayed with each question that is assigned the flag.
2. The computer-implemented method of claim 1 , wherein each risk vector rating is indicative of a state of the respective risk vector of the affiliate.
3. The computer-implemented method of claim 1 , wherein each question is indicative of a cybersecurity risk of the affiliate.
4. The computer-implemented method of claim 1 , wherein the one or more risk vectors comprise at least one of:
an amount of capital investment by the affiliate;
a measure of employee training for the affiliate;
an amount of the affiliate's budget for security;
a number of lost records and/or sensitivity of information in the lost records in a data breach of a computer system associated with the affiliate;
a number and/or type of service of open ports of a computer network associated with the affiliate;
a number and/or severity of botnet infection instances of a computer system associated with the affiliate;
an evaluation of file sharing traffic originating from a computer network associated with the affiliate;
a number of spam propagation instances originating from a computer network associated with the affiliate;
a number of malware servers associated with the affiliate;
a number of potentially exploited devices associated with the affiliate; and
a number of hosts authorized to send emails on behalf of each domain associated with the affiliate.
5. The computer-implemented method of claim 1 , wherein the one or more risk vector ratings are numerical.
6. The computer-implemented method of claim 1 , wherein each of the risk vectors comprises a respective risk vector type of a plurality of risk vector types.
7. The computer-implemented method of claim 6 , wherein the plurality of risk vector types comprise at least one of a data breaches type, an open ports type, a botnet infections type, a potentially exploited device type, a file sharing type, and an other type.
8. The computer-implemented method of claim 7 , wherein each of the plurality of risk vector types corresponds to a respective one of a plurality of weights, the plurality of weights being numerical and further comprising the weight for the at least one risk vector rating.
9. The computer-implemented method of claim 1 , wherein the risk score for each question is calculated by dividing a sum of a multiplication of each of the risk vector ratings mapped to the question and the weights of each of the risk vector ratings by a sum of the weights of each of the risk vector ratings.
10. The computer-implemented method of claim 1 , wherein the cybersecurity criticality tier is a level of criticality of a relationship between the entity and the affiliate.
11. A system for accelerating cybersecurity assessments, the system comprising:
one or more processors; and
a memory coupled with the one or more processors wherein the one or more processors executes a plurality of modules stored in the memory and wherein the plurality of modules comprises:
a tier recommendation module that when executed selects, for an affiliate of a plurality of affiliates of an entity, a cybersecurity action plan, wherein the selection is based on a combination of a cybersecurity criticality tier, one or more risk vector ratings for one or more risk vectors, and a security rating for the affiliate, wherein the cybersecurity criticality tier is selected from a set of cybersecurity criticality tiers, and wherein the one or more risk vector ratings are derived from externally-observable information for IP address-based assets of the affiliate;
a questionnaire management module that when executed provides, to the affiliate, one or more questions, wherein at least one question of the one or more questions is mapped to at least one risk vector and at least one risk vector rating for the at least one risk vector;
a risk vector rating module that when executed for each question mapped to at least one risk vector rating:
determines a risk score for the question based on a weighted combination of the at least one risk vector rating a weight for the at least one risk vector rating;
determines, based on a comparison of the risk score to a threshold, an indication of whether the question is indicative of a cybersecurity risk; and
when the risk score is less than or equal to the threshold, assigns a flag to the question to indicate the question is indicative of a cybersecurity risk; and
an assessment report generation module that when executed generates and causes display of an assessment report including an assessment of cybersecurity risk of the affiliate, wherein the assessment report comprises the one or more questions, a response to each of the one or more questions, the at least one risk vector rating for each question mapped to the at least one risk vector, and the flag displayed with each question that is assigned the flag.
12. The system of claim 11 , wherein each risk vector rating is indicative of a state of the respective risk vector of the affiliate.
13. The system of claim 11 , wherein the cybersecurity criticality tier is a level of criticality of a relationship between the entity and the affiliate.
14. The system of claim 11 , wherein the one or more risk vectors comprise at least one of:
an amount of capital investment by the affiliate;
a measure of employee training for the affiliate;
an amount of the affiliate's budget for security;
a number of lost records and/or sensitivity of information in the lost records in a data breach of a computer system associated with the affiliate;
a number and/or type of service of open ports of a computer network associated with the affiliate;
a number and/or severity of botnet infection instances of a computer system associated with the affiliate;
an evaluation of file sharing traffic originating from a computer network associated with the affiliate;
a number of spam propagation instances originating from a computer network associated with the affiliate;
a number of malware servers associated with the affiliate;
a number of potentially exploited devices associated with the affiliate; and
a number of hosts authorized to send emails on behalf of each domain associated with the affiliate.
15. The system of claim 11 , wherein the one or more risk vector ratings are is a numerical-rating.
16. The system of claim 11 , wherein each of the risk vectors comprises a respective risk vector type of a plurality of risk vector types.
17. The system of claim 16 , wherein the plurality of risk vector types comprise at least one of a data breaches type, an open ports type, a botnet infections type, a potentially exploited device type, a file sharing type, and an other risk vector-type.
18. The system of claim 17 , wherein each of the plurality of risk vector types corresponds to a respective one of a plurality of weights, the plurality of weights being numerical and further comprising the weight for the at least one risk vector rating.
19. The system of claim 11 , wherein the risk score for each question is calculated by dividing a sum of a multiplication of each of the risk vector ratings mapped to the question and the weights of each of the risk vector ratings by a sum of the weights of each of the risk vector ratings.
20. The system of claim 11 , wherein each question is indicative of a cybersecurity risk of the affiliate.