# US 10,320,830 B2 · Automated asset criticality assessment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,830 B2 - Document ID: US10320830B2 - Status: Granted - Kind: B2 - Application number: 15/959,946 - Filed: 2018-04-23 - Published: 2018-12-06 - Granted: 2019-06-11 - Earliest claimed: 2012-12-18 - Assignees: McAfee, Inc. - Applicants: McAfee, LLC - Inventors: Ratinder Paul Singh Ahuja; Sven Schrecker - Web page: https://patentgrep.com/patent/US10320830B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/568: {eliminating virus, restoring damaged files} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A set of attributes of a particular asset of a computing environment is identified that are determined from data collected by one or more utilities in the computing environment. A criticality rating is automatically determined for the particular asset based at least in part on the set of attributes. A security activity is caused to be performed relating to the particular asset based on the automatically determined criticality rating of the particular asset. ## Claims ### Claim 1 A method, comprising: identifying a set of attributes of an asset of a computing environment, wherein the set of attributes identifies one or more users and a context of use of the asset by the one or more users; determining, using at least one processor device, a criticality rating value for the asset based at least in part on the one or more users and the context of use, wherein the criticality rating value indicates an impact of damage to or loss of the asset, and the criticality rating value is determined in response to a countermeasure deployment involving the asset or an attempt to launch the asset or an application hosted by or interacting with the asset; calculating a risk measure for the asset from the criticality rating value, vulnerability detection data identifying vulnerabilities of the asset, and countermeasure detection data identifying countermeasures deployed on the asset; and causing a security activity to be performed based at least in part on the risk measure for the asset. ### Claim 2 (depends on 1) The method of claim 1, wherein the set of attributes are determined from data collected using an agent deployed on a computing device of the asset. ### Claim 3 (depends on 1) The method of claim 1, wherein the security activity includes a risk assessment using the criticality rating value as an input. ### Claim 4 (depends on 1) The method of claim 1, wherein the causing the security activity to be performed includes determining a priority for the security activity based on the criticality rating value. ### Claim 5 (depends on 1) The method of claim 1, wherein the criticality rating value is based on a detection that the asset is monitored, locked, encrypted, secured, or is protected. ### Claim 6 (depends on 1) The method of claim 1, wherein the criticality rating value is based on a whitelist used by, entrusted with, deployed on, or identifying the asset or a host thereof. ### Claim 7 (depends on 1) The method of claim 1, further comprising: determining that the criticality rating value does not exist for the asset based on an event involving the asset, wherein the set of attributes is determined from data collected by one or more utilities in the computing environment. ### Claim 8 At least one non-transitory storage medium having instructions stored thereon, wherein the instructions, when executed on a machine, cause the machine to perform a method comprising: identifying a set of attributes of an asset of a computing environment, wherein the set of attributes identifies one or more users and a context of use of the asset by the one or more users; determining, using at least one processor device, a criticality rating value for the asset based at least in part on the one or more users and the context of use, wherein the criticality rating value indicates an impact of damage to or loss of the asset, and the criticality rating value is determined in response to a countermeasure deployment involving the asset or an attempt to launch the asset or an application hosted by or interacting with the asset; calculating a risk measure for the asset from the criticality rating value, vulnerability detection data identifying vulnerabilities of the asset, and countermeasure detection data identifying countermeasures deployed on the asset; and causing a security activity to be performed based at least in part on the risk measure for the asset. ### Claim 9 (depends on 8) The medium of claim 8, wherein the set of attributes are determined from data collected using an agent deployed on a computing device of the asset. ### Claim 10 (depends on 8) The medium of claim 8, wherein the security activity includes a risk assessment using the criticality rating value as an input. ### Claim 11 (depends on 8) The medium of claim 8, wherein the causing the security activity to be performed includes determining a priority for the security activity based on the criticality rating value. ### Claim 12 (depends on 8) The medium of claim 8, wherein the criticality rating value is based on a detection that the asset is monitored, locked, encrypted, secured, or is protected. ### Claim 13 (depends on 8) The medium of claim 8, wherein the criticality rating value is based on a whitelist used by, entrusted with, deployed on, or identifying the asset or a host thereof. ### Claim 14 (depends on 8) The medium of claim 8, the method further comprising: determining that the criticality rating value does not exist for the asset based on an event involving the asset, wherein the set of attributes is determined from data collected by one or more utilities in the computing environment. ### Claim 15 A system, comprising: at least one memory element that stores instructions; and at least one processor device that executes the instructions to identify a set of attributes of an asset of a computing environment, wherein the set of attributes identifies one or more users and a context of use of the asset by the one or more users; determine a criticality rating value for the asset based at least in part on the one or more users and the context of use, wherein the criticality rating value indicates an impact of damage to or loss of the asset, and the criticality rating value is determined in response to a countermeasure deployment involving the asset or an attempt to launch the asset or an application hosted by or interacting with the asset; calculate a risk measure for the asset from the criticality rating value, vulnerability detection data identifying vulnerabilities of the asset, and countermeasure detection data identifying countermeasures deployed on the asset; and cause a security activity to be performed based at least in part on the risk measure for the asset. ### Claim 16 (depends on 15) The system of claim 15, wherein the set of attributes are determined from data collected using an agent deployed on a computing device of the asset. ### Claim 17 (depends on 15) The system of claim 15, wherein the security activity includes a risk assessment using the criticality rating value as an input. ### Claim 18 (depends on 15) The system of claim 15, wherein the causing the security activity to be performed includes determining a priority for the security activity based on the criticality rating value. ### Claim 19 (depends on 15) The system of claim 15, wherein the criticality rating value is based on a detection that the asset is monitored, locked, encrypted, secured, or is protected. ### Claim 20 (depends on 15) The system of claim 15, wherein the at least one processor device executes the instructions to determine that the criticality rating value does not exist for the asset based on an event involving the asset, and the set of attributes is determined from data collected by one or more utilities in the computing environment.