Threat-specific security risk evaluation for networked systems

A network security risk evaluation apparatus comprising:

• a processor;
• and
• a memory storing instructions which, when executed by the processor, cause the processor to:
• (A) identify, using at least one threat categorization model, a plurality of threats to a first component of a networked system;
• (B) assign a plurality of weighting values to the plurality of threats, wherein at least one of the assigned weighting values is equal to zero;
• (C) identify a plurality of vulnerabilities of the first component by accessing a database of vulnerabilities that stores vulnerability information;
• (D) determine a relevant threat set for a first vulnerability of the plurality of vulnerabilities based on the first vulnerability and the plurality of weighting values assigned to the plurality of threats and including eliminating threats from the plurality of threats that are not related to the first vulnerability, wherein the relevant threat set comprises one or more of the plurality of threats, and wherein the threats having an assigned weighting value equal to zero are excluded from the relevant threat set;
• (E) repeat step (D) for each of the plurality of vulnerabilities to determine a plurality of relevant threat sets;
• and
• (F) calculate a component risk of the first component based on the plurality of relevant threat sets.

A non-transitory, computer-readable medium storing instructions which, when performed by a processor, cause the processor to:

• (A) identify, using at least one threat categorization model, a plurality of threats to a first component of a networked system;
• (B) assign a plurality of weighting values to the plurality of threats, wherein at least one of the assigned weighting values is equal to zero;
• (C) identify a plurality of vulnerabilities of the first component by accessing a database of vulnerabilities that stores vulnerability information;
• (D) determine a relevant threat set for a first vulnerability of the plurality of vulnerabilities based on the first vulnerability and the plurality of weighting values assigned to the plurality of threats and including eliminating threats from the plurality of threats that are not related to the first vulnerability, wherein the relevant threat set comprises one or more of the plurality of threats, and wherein the threats having an assigned weighting value equal to zero are excluded from the relevant threat set;
• (E) repeat step (D) for each of the plurality of vulnerabilities to determine a plurality of relevant threat sets;
• and
• (F) calculate a component risk of the first component based on the plurality of relevant threat sets.