Product risk profile
AssigneeEntit Software LLC
InventorsTomer Gershoni, Yaniv Toledano
Life of this patent
Estimating the term…
Abstract
In one implementation, a system calculating a product risk profile includes a criticality score engine to calculate a criticality score via an aggregation of values assigned to a plurality of descriptions of a component of a product criticality. In addition, the system includes a vulnerability score engine to calculate a vulnerability score via an aggregation of a quantity of security risks found during a security assessment for the product. In addition, the system includes a product risk profile engine to calculate a product risk profile for the product via a multiplication of the criticality score and the vulnerability score.
Claims18
A system, comprising:
- a processor;
- and
- a storage device comprising instructions executable by the processor to:
- calculate a criticality score via a weighted aggregation of numeric values assigned to a plurality of descriptions of a component of a product criticality of a software product, wherein the component of product criticality is a deployment model associated with the software product, and wherein the plurality of descriptions of the component comprise a description of an external deployment model, a description of a mixed deployment model, and a description of an internal deployment model;
- calculate a vulnerability score via an aggregation of a quantity of security risks, wherein the quantity of security risks includes a plurality of security risks detected during a security assessment for the software product;
- and
- after calculation of the criticality score and the vulnerability score, calculate a product risk profile for the software product via a multiplication of the criticality score and the vulnerability score.
A non-transitory computer readable medium storing instructions executable by a processing resource to cause a computer to:
- calculate a criticality score via a weighted aggregation of numeric values assigned to a plurality of descriptions of at least one component of a product criticality of a software product undergoing development, wherein the at least one component of product criticality comprises a deployment model associated with the software product, and wherein the plurality of descriptions of the at least one component comprise a description of an external deployment model, a description of a mixed deployment model, and a description of an internal deployment model;
- calculate a vulnerability score via a weighted aggregation of a quantity of security risks, wherein the quantity of security risks includes a plurality of security risks detected during a security assessment of the software product;
- after calculation of the criticality score and the vulnerability score, calculate a product risk profile for the software product via a multiplication of the criticality score and the vulnerability score;
- and
- compare the product risk profile of the software product with a product risk profile of another software product.
A method, comprising:
- calculating, by a processor, a criticality score for a software product via a weighted aggregation of numeric values assigned to a plurality of descriptions of at least one component of a product criticality for the software product, wherein the software product has not completed development wherein the at least one component of product criticality comprises a deployment model associated with the software product, and wherein the plurality of descriptions of the at least one component comprise a description of an external deployment model, a description of a mixed deployment model, and a description of an internal deployment model;
- calculating, by the processor, a vulnerability score via an aggregation of an amount of each of a plurality of security risk levels for the software product, wherein the amount of each of the plurality of security risk levels is weighted, wherein each of the plurality of security risk levels is detected during a security assessment of the software product;
- after calculating the criticality score and the vulnerability score, calculating, by the processor, a product risk profile based on the criticality score and the vulnerability score;
- and
- mapping, by the processor, a product risk profile trend via comparing the product risk profile to a historical product risk profile.
Dependencies are inferred from the claim text.