System and method for automatic calculation of cyber-risk in business-critical applications

1. A system for calculating cyber-risk in a software application, comprising:

a cyber-risk calculator comprising a processor configured to execute non-transitory instructions stored in a memory, which when executed perform the steps of:

receiving from a penetration testing tool a security assessment result sample comprising a list of security modules, each security module listing including a respective result of a security assessment of the application identifying a vulnerability and/or misconfiguration capable of being exploited and/or abused; and

running the cyber-risk calculator in a risk calculation mode further comprising the steps of:

referencing a set of parameters from a parametrization database according to a world partition corresponding to the application;

determining a cyber-risk exposure level for the application based upon the security assessment result sample and the set of parameters;

sorting a plurality of risk exposure levels according to an expected loss and a probability of the application being compromised:

adjusting the risk exposure levels to account for interconnections and trust relationships between business critical applications, wherein determining the cyber-risk exposure level further comprises the probability of the application being compromised and the expected loss when the application has been compromised: and

reporting results of the cyber-risk calculation,

wherein the software application comprises a business critical application.

2. The system of claim 1 , wherein reporting the cyber-risk calculation further comprises the steps of:

a first numeric value indicating an overall cyber-risk exposure level of the application;

a list of the names of the security modules in the security assessment result sample, each security module name associated with a second numeric value indicating its associated cyber-risk exposure level;

a third numeric value indicating the overall cyber-risk exposure level of the application considering the interconnections and trust relationships with other applications; and

an expected loss calculated based on the parameters and the numeric values indicating the overall risk.

3. The system of claim 1 , wherein running the cyber-risk calculator in a risk calculation mode further comprises the step of determining the world partition of the application that the security assessment result sample belongs to.

4. The system of claim 2 , wherein the set of parameters further comprise one or more of the group consisting of a cost per-record in a business-critical application, the number of records taken into account for cyber risk calculation and, for each security module present in the security assessment result sample, a probability of success based on the security module features and the world partition to which the application belongs.

5. The system of claim 1 , wherein the world partition is divided into one or more of the group consisting of SAP ABAP, SAP JAVA, SAP HANA, SAP Business Objects, Oracle JD Edwards, and Oracle E Business Suite.

6. The system of claim 4 , further comprising the step of automatically configuring a number of records taken into account while calculating the risk exposure level.

7. The system of claim 6 wherein automatically configuring the number of records taken into account while calculating the risk exposure level comprises the steps of:

determining the database tables in the application that must be queried according to the world partition the software application belongs to and the components installed in the application; and

counting the number of records in the determined database tables.

8. The system of claim 1 , wherein determining a cyber-risk exposure level further comprises the probability of the application being compromised and the expected loss when the application has been compromised.

9. The system of claim 8 , further comprising the step of sorting a plurality of risk exposure levels according to the expected loss and the probability of the application being compromised.

10. The system of claim 9 , further comprising the step of adjusting the risk exposure levels to account for statistical inter-dependency of multiple vulnerabilities.

11. The system of claim 1 , wherein the processor is part of a cloud based server.

12. The system of claim 11 , wherein any information in the security assessment result sample that may distinguish a first application from a second application is removed.

13. The system of claim 1 , further comprising the step of:

running the cyber-risk calculator in a parameterization mode further comprising the steps of:

calculating a set of parameters based upon the security assessment result sample and the values already stored in the parametrization database; and

populating the parametrization database with the new parameters.

14. The system of claim 1 , wherein the set of parameters in the parameterization database is set to a default set of values.

15. The system of claim 1 , wherein the parameterization database comprises dynamic coefficients representing security module features selected from the group consisting of a Common Vulnerability Scoring System (CVSS) vector, a CVSS value, a coefficient representing whether the vulnerability could be used to take control of the application, and a coefficient representing whether the vulnerability may be used by auditors and/or attackers in to compromise the application.

16. The system of claim 15 , wherein the parameterization database further comprises one or more of a list of security frameworks in which the security module is implemented, a list of dates of the implementation of the security module on each security framework, and a date when the security module was published.

17. The system of claim 1 , wherein the parameterization database includes a cost per record comprising an adjustable initial parameter.

18. The system of claim 17 , wherein determining the cyber-risk exposure level further comprises the step of tuning the cost per record.

19. The system of claim 1 , wherein running the cyber-risk calculator further comprises the step of receiving information from a security monitoring suite comprising an alarm triggered when the security monitoring suite detects a security module being actively exploited/abused in the application monitored by the security monitoring suite.

20. The system of claim 19 , wherein the alarm comprises an identification of the security module being actively exploited/abused.

21. The system of claim 20 , wherein the alarm further comprises data specific to a security module.