A non-transitory computer-readable medium storing instructions that, when executed by the one or more computers, cause the one or more computers to perform operations comprising:
- receiving and accessing, by the one or more computers, data specifying relationships between:
- (i) IT system infrastructures representing computing devices of an organization and a network connecting the computing devices and their physical and logical location, defined by information such as identity, name and category identity;
- (ii) system categories indicating characteristics of assets of the organization;
- (iii) operational processes of an organization, defined by identity, a name and a value in terms of a monetary value for a given time window having a beginning and end;
- (iv) a list of observed computer-based threats including at least one selected from the group consisting of a virus, malware, a network intrusion, and a denial of service attack, with data for each threat identifying frequency of occurrence, which may include at least one period of time and corresponding frequency of occurrence for a given time window having a beginning and end;
- (iv) mitigating actions representing the threat mitigation measures of the organization;
- the one or more computers performing a plurality of simulations using a Monte Carlo method, each simulation involving propagating data through stochastic modeling for a given time window having a beginning and end;
- sampling by the one or more computers using the accessed data specifying relationships, outcomes of the plurality of simulations for a given time window having a beginning and end;
- sampling by the one or more computers using the accessed data specifying relationships, outcomes of the plurality of simulations that include mitigating actions representing the threat mitigation measures of the organization for a given time window having a beginning and end;
- based on the sampled outcomes of the simulations, determining, by the one or more computers, measures of impact of the computer-related threats to the organization for a given time window having a beginning and end and providing, by the one or more computers and for output to a user, graphical representations of the determined measures of impact of the computer-based threats to the organization, for a given time window having a beginning and end, in a graphical user interface;
- the one or more computers further configured to;
- receive observed computer-based threat data;
- receive input data of the number of viruses contracted by period and the number of new viruses worldwide;
- extrapolating from the input data, using a Monte Carlo method, to predict future computer-based threat activity rates and types and;
- outputting said predicted future computer-based threat activity to one or more firewalls, to improve accuracy in identifying computer based threats on the one or more computer networks, strengthen their accuracy through the detection of anomalous firewall policy rules, into the network and firewall logs, updating the firewall policy tree to define the action of accept or deny, according to the changes automatically made to the policy tree of rules in the sets of firewall rules, which in turn inserts updated rules into the firewall policy.