# US 11,451,575 B2 · Method and system for determining cybersecurity maturity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,575 B2 - Document ID: US11451575B2 - Status: Granted - Kind: B2 - Application number: 16/943,554 - Filed: 2020-07-30 - Published: 2022-02-03 - Granted: 2022-09-20 - Earliest claimed: 2020-07-30 - Assignees: Saudi Arabian Oil Company - Applicants: Saudi Arabian Oil Company - Inventors: Mazen A. Baragaba; Muhammad S. Aljuaid; Marek Zidek - Web page: https://patentgrep.com/patent/US11451575B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 41/0853: by actively collecting configuration information or by backing up configuration information - H04L 43/12: Network monitoring probes - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method may include obtaining first cybersecurity data using a hardware probe disposed within a network. The first cybersecurity data may correspond to an analysis of the hardware probe regarding network data that is transmitted through the network. The method may further include obtaining second cybersecurity data using a software probe operating on a network element within the network. The second cybersecurity data may correspond to an analysis of the software probe regarding one or more configuration settings of the network element. The method may further include determining a cybersecurity maturity score using the first cybersecurity data and the second cybersecurity data. The cybersecurity maturity score may be based on a maturity model. The method may further include transmitting, based on the cybersecurity maturity score, a remediation command that adjusts a configuration setting of the network. ## Claims ### Claim 1 A method, comprising: obtaining, by a computer processor, first cybersecurity data using a hardware probe disposed within a network, wherein the first cybersecurity data corresponds to an analysis of the hardware probe regarding first network data that is transmitted through the network; obtaining, by the computer processor, second cybersecurity data using a software probe operating on a network element within the network, wherein the second cybersecurity data corresponds to an analysis of the software probe regarding one or more configuration settings of the network element; determining, by the computer processor, a cybersecurity maturity score using the first cybersecurity data and the second cybersecurity data, wherein the cybersecurity maturity score is based on a maturity model; and transmitting, by the computer processor and based on the cybersecurity maturity score, a remediation command configured to adjust at least one configuration setting of the network. ### Claim 2 (depends on 1) The method of claim 1, further comprising: obtaining, by the hardware probe, a packet that is transmitted over the network; determining, by the hardware probe, whether the packet comprises a clear text password; and transmitting, by the hardware probe in response to determining a presence of the clear text password, a message over the network that identifies a transmission of an unencrypted password. ### Claim 3 (depends on 1) The method of claim 1, wherein the hardware probe is disposed along a network path between a user device and a server, wherein the hardware probe monitors second network data transmitted along the network path between the user device and the server, and wherein the hardware probe transmits third cybersecurity data to a cybersecurity maturity manager in response to the second network data failing to satisfy one or more security standards. ### Claim 4 (depends on 1) The method of claim 1, wherein the network element is a server, wherein the software probe monitors changes in a plurality of configuration settings on the server, and wherein the software probe transmits third cybersecurity data to a cybersecurity maturity manager in response to at least one configuration setting among the plurality of security settings failing to satisfy one or more security standards. ### Claim 5 (depends on 1) The method of claim 1, wherein the maturity model is selected from a group consisting of: a capability maturity model integration (CMMI), a cybersecurity capability maturity model (C2M2), standardization's systems security engineering capability maturity model (SSE-CMM), and National Institute of Standards and Technology cyber security framework (NIST CSF). ### Claim 6 (depends on 1) The method of claim 1, further comprising: obtaining a predetermined security standard; obtaining third cybersecurity data regarding the network; and generating, using the third cybersecurity data, a maturity score based on the predetermined security standard. ### Claim 7 (depends on 1) The method of claim 1, wherein the cybersecurity maturity score is based on a user input regarding a cybersecurity risk. ### Claim 8 (depends on 1) The method of claim 1, further comprising: determining whether a change has occurred in a cybersecurity state of the network based on third cybersecurity data and at a predetermined interval; determining, in response to determining the change has occurred in the cybersecurity state, a second cybersecurity maturity score in response to the change in the cybersecurity state; and transmitting a report to a user device based on the second cybersecurity maturity score. ### Claim 9 (depends on 1) The method of claim 1, wherein the first cybersecurity maturity score is provided to a plurality of user devices using a graphical user interface that is provided by a cloud server. ### Claim 10 A system, comprising: a network comprising a plurality of network elements; a hardware probe coupled to the plurality of network elements; a network element coupled to the plurality of network elements, the network element comprising a software probe; and a cybersecurity maturity manager comprising a computer processor, wherein the cybersecurity maturity manager is coupled to the hardware probe, the software probe, and the plurality of network elements, and wherein the cybersecurity maturity manager comprises functionality for: obtaining first cybersecurity data using the hardware probe, wherein the first cybersecurity data corresponds to an analysis of the hardware probe regarding first network data that is transmitted through the network; obtaining second cybersecurity data using the software probe, wherein the second cybersecurity data corresponds to an analysis of the software probe regarding one or more configuration settings of the network element; determining a cybersecurity maturity score using the first cybersecurity data and the second cybersecurity data, wherein the cybersecurity maturity score is based on a maturity model; and transmitting, based on the cybersecurity maturity score, a remediation command configured to adjust at least one configuration setting of the network element. ### Claim 11 (depends on 10) The system of claim 10, wherein the cybersecurity maturity manager further comprises functionality for: obtaining a predetermined security standard; obtaining third cybersecurity data regarding the network; and generating, using the third cybersecurity data, a maturity score based on the predetermined security standard. ### Claim 12 (depends on 10) The system of claim 10, further comprising: a user device; and a server, wherein the hardware probe is disposed along a network path between the user device and the server, wherein the hardware probe is configured to monitor second network data transmitted along the network path, and wherein the hardware probe is configured to transmit third cybersecurity data to the cybersecurity maturity manager in response to the second network data failing to satisfy one or more security standards. ### Claim 13 (depends on 10) The system of claim 10, wherein the hardware probe is configured to obtain a packet that is transmitted over the network, and wherein the hardware probe is configured to perform a packet analysis on the packet to determine a presence of a clear text password. ### Claim 14 (depends on 10) The system of claim 10, wherein the network element is a server, wherein the software probe is configured to monitor changes in a plurality of configuration settings on the server, and wherein the software probe is configured to transmit third cybersecurity data to a cybersecurity maturity manager in response to at least one configuration setting among the plurality of security settings failing to satisfy one or more security standards. ### Claim 15 (depends on 10) The system of claim 10, wherein the maturity model is selected from a group consisting of: a capability maturity model integration (CMMI), a cybersecurity capability maturity model (C2M2), standardization's systems security engineering capability maturity model (SSE-CMM), and National Institute of Standards and Technology cyber security framework (NIST CSF). ### Claim 16 A non-transitory computer readable medium storing instructions executable by a computer processor, the instructions comprising functionality for: obtaining first cybersecurity data using a hardware probe disposed within a network, wherein the first cybersecurity data corresponds to an analysis of the hardware probe regarding first network data that is transmitted through the network; obtaining second cybersecurity data using a software probe operating on a network element within the network, wherein the second cybersecurity data corresponds to an analysis of the software probe regarding one or more configuration settings of the network element; determining a cybersecurity maturity score using the first cybersecurity data and the second cybersecurity data, wherein the cybersecurity maturity score is based on a maturity model; and transmitting, based on the cybersecurity maturity score, a remediation command configured to adjust at least one configuration setting of the network. ### Claim 17 (depends on 16) The non-transitory computer readable medium of claim 16, wherein the instructions further comprise functionality for: obtaining a predetermined security standard; obtaining third cybersecurity data regarding the network; and generating, using the third cybersecurity data, a maturity score based on the predetermined security standard. ### Claim 18 (depends on 16) The non-transitory computer readable medium of claim 16, wherein the hardware probe is disposed along a network path between a user device and a server, wherein the hardware probe monitors second network data transmitted along the network path between the user device and the server, and wherein the hardware probe transmits third cybersecurity data to a cybersecurity maturity manager in response to the second network data failing to satisfy one or more security standards. ### Claim 19 (depends on 16) The non-transitory computer readable medium of claim 16, wherein the maturity model is selected from a group consisting of: a capability maturity model integration (CMMI), a cybersecurity capability maturity model (C2M2), standardization's systems security engineering capability maturity model (SSE-CMM), and National Institute of Standards and Technology cyber security framework (NIST CSF). ### Claim 20 (depends on 16) The non-transitory computer readable medium of claim 16, wherein the instructions further comprise functionality for: determining, at a predetermined interval, whether a change has occurred in a cybersecurity state of the network based on third cybersecurity data; determining, in response to determining the change has occurred in the cybersecurity state, a second cybersecurity maturity score in response to the change in the cybersecurity state; and transmitting a report to a user device based on the second cybersecurity maturity score.