Utilizing models to integrate data from multiple security systems and identify a security risk score for an asset

A device, comprising:

• one or more memories;
• and
• one or more processors, coupled to the one or more memories, configured to:
• receive security data identifying a plurality of assets of an entity, a plurality of security issues associated with the plurality of assets, and objectives associated with the plurality of assets;
• utilize a data model to generate, based on the security data, asset related data identifying mapped sets of security data;
• process a first portion of the asset related data, with an asset risk likelihood model, to calculate an asset risk likelihood score for an asset of the plurality of assets;
• process a second portion of the asset related data, with an asset criticality model, to calculate an asset criticality score for the asset;
• process a third portion of the asset related data, with an asset control effectiveness model, to calculate an asset control effectiveness score for the asset;
• combine the asset risk likelihood score, the asset criticality score, and the asset control effectiveness score to generate a security risk score for the asset;
• and
• perform one or more actions based on the security risk score.

A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• receive security data identifying a plurality of assets of an entity, a plurality of security issues associated with the plurality of assets, and objectives associated with the plurality of assets,
• wherein the security data includes data identifying one or more of:
• vulnerabilities associated with the plurality of assets,
• common weaknesses associated with the plurality of assets,
• security threats associated with the plurality of assets,
• attack patterns associated with the security threats,
• security controls associated with the plurality of assets,
• asset control objectives associated with the plurality of assets,
• configuration information associated with the plurality of assets,
• business impact scores associated with the plurality of assets,
• personal identification information associated with the plurality of assets, or
• penetration test results associated with the plurality of assets;
• utilize a data model to generate, based on the security data, asset related data identifying mapped sets of security data;
• process a first portion of the asset related data, with an asset risk likelihood model, to calculate an asset risk likelihood score for an asset of the plurality of assets;
• process a second portion of the asset related data, with an asset criticality model, to calculate an asset criticality score for the asset;
• process a third portion of the asset related data, with an asset control effectiveness model, to calculate an asset control effectiveness score for the asset;
• combine the asset risk likelihood score, the asset criticality score, and the asset control effectiveness score to generate a security risk score for the asset;
• and
• perform one or more actions based on the security risk score.