Information technology security assessment system
AssigneeBitSight Technologies, Inc.
InventorsStephen Wayne Boyer, Nagarjuna Venna, Megumi Ando
Life of this patent
Estimating the term…
Abstract
A method and system for creating a composite security rating from security characterization data of a third party computer system. The security characterization data is derived from externally observable characteristics of the third party computer system. Advantageously, the composite security score has a relatively high likelihood of corresponding to an internal audit score despite use of externally observable security characteristics. Also, the method and system may include use of multiple security characterizations all solely derived from externally observable characteristics of the third party computer system.
Claims16
A method for determining a security rating of an entity, the method comprising:
- determining an internal security rating comprising:
- obtaining data indicative of internal security from a plurality of internal data sources;
- extracting a plurality of internal security features from the obtained data;
- applying a respective transformation function to each of the plurality of internal security features to determine a first plurality of transformed features;
- and
- combining the first plurality of transformed features to form the internal security rating;
- determining an external security rating comprising:
- obtaining data indicative of external security from a plurality of external data sources;
- extracting a plurality of external security features from the obtained data;
- applying a respective transformation function to each of the plurality of external security features to determine a second plurality of transformed features;
- and
- combining the second plurality of transformed features to form the external security rating;
- and
- providing, via a reporting facility, a composite security rating for the entity based on the internal security rating and the external security rating, wherein at least one of the internal security features or the external security features indicates malicious activity associated with an IP address of the entity.
A system for determining a security rating of an entity, the system comprising:
- one or more computer systems programmed to perform operations comprising:
- determining an internal security rating comprising:
- obtaining data indicative of internal security from a plurality of internal data sources;
- extracting a plurality of internal security features from the obtained data;
- applying a transformation function to each of the plurality of internal security features;
- and
- combining the transformed features to form the internal security rating;
- determining an external security rating comprising:
- obtaining data indicative of external security from a plurality of external data sources;
- extracting a plurality of external security features from the obtained data;
- applying a transformation function to each of the plurality of external security features;
- and
- combining the transformed features to form the external security rating;
- and
- providing, via a reporting facility, a composite security rating for the entity based on the internal security rating and the external security rating, wherein at least one of the internal security features or the external security features indicates malicious activity associated with an IP address of the entity.
Dependencies are inferred from the claim text.