# US 11,909,758 B2 · Method and system for evaluating cyber security risks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,758 B2
- Document ID: US11909758B2
- Status: Granted
- Kind: B2
- Application number: 18/181,774
- Filed: 2023-03-10
- Published: 2023-07-06
- Granted: 2024-02-20
- Earliest claimed: 2021-01-15
- Assignees: Verizon Patent and Licensing Inc.
- Applicants: Verizon Patent and Licensing Inc.
- Inventors: Lori K. Bogren; Katrina Marie Kutchko; Allison J. Ashford; Charles A. Dallas; Yonatan Fridman
- Web page: https://patentgrep.com/patent/US11909758B2

## CPC

- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1458: {Denial of Service}
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 63/102: {Entity profiles}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods described herein provide a cyber risk assessment service. A computing device determines weights for techniques of a cyber security framework based on historical industry impact. The computing device associates an enterprise network with an industry identifier, obtains customer risk data for the enterprise network, and normalizes and/or combines the customer risk data to form normalized risk scores. The computing device maps the customer risk data to corresponding techniques in the cyber security framework, generates technique scores based on the mapping and the normalized risk scores, and generates weighted technique scores using some of the weights selected based on the industry identifier. The computing device calculates an overall security score for the enterprise network based on the weighted technique scores, identifies a corrective recommendation for the overall security score, and provides the overall security score and the corrective recommendation for presentation to a user.

## Claims

### Claim 1

A method, comprising:
obtaining, by a computing device, customer risk data for a customer network;
associating, by the computing device, the customer risk data with at least one of multiple corresponding attack techniques in a cyber security framework;
generating, by the computing device, multiple technique scores based on the associating and the customer risk data;
weighting, by the computing device, the multiple technique scores based on an industry-type associated with the customer network to generate weighted technique scores; and
providing, by the computing device, an overall security score for the customer network based on the weighted technique scores.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
identifying, by the computing device, a corrective recommendation for the overall security score.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
identifying category sub-scores for the overall security score;
indicating a highest category sub-score of the category sub-scores; and
retrieving, from a stored repository of remedial actions, one or more known remedial actions that may be used to improve security for a category with the highest category sub-score.

### Claim 4 (depends on 1)

The method of claim 1, wherein the associating includes mapping the customer risk data to different attack techniques in the cyber security framework.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
calculating category security scores from the weighted technique scores, wherein the category security scores contribute to the overall security score.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
storing, prior to obtaining the customer risk data, different weights associated with multiple industry identifiers.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
normalizing the customer risk data prior to generating the multiple technique scores, wherein normalizing the customer risk data includes:
storing settings for converting individual vendor security ratings to a uniform numerical scale;
receiving multiple security ratings for the customer network, wherein the multiple security ratings include a rating based on an outside-in data view and a rating based on an inside-out data view; and
matching each of the multiple security ratings to a uniform numerical scale.

### Claim 8 (depends on 1)

The method of claim 1, wherein providing the overall security score comprises:
providing the overall security score for presentation to a user.

### Claim 9 (depends on 8)

The method of claim 8, wherein providing the overall security score for presentation to the user further comprises:
providing category sub-scores for the overall security score.

### Claim 10 (depends on 1)

The method of claim 1, wherein providing the overall security score includes:
generating a graphical user interface that includes a presentation of the overall security score.

### Claim 11

A device, comprising:
one or more processors configured to:
obtain customer risk data for a customer network;
associate the customer risk data with at least one of multiple corresponding attack techniques in a cyber security framework;
generate multiple technique scores based on the associating and the customer risk data;
weight the multiple technique scores based on an industry-type associated with the customer network to generate weighted technique scores; and
provide an overall security score for the customer network based on the weighted technique scores.

### Claim 12 (depends on 11)

The device of claim 11, wherein the one or more processors are further configured to:
identify a corrective recommendation for the overall security score.

### Claim 13 (depends on 11)

The device of claim 11, wherein the one or more processors are further configured to:
identify category sub-scores for the overall security score;
indicate a highest category sub-score of the category sub-scores; and
retrieve, from a stored repository of remedial actions, one or more known remedial actions that may be used to improve security for a category with the highest category sub-score.

### Claim 14 (depends on 11)

The device of claim 11, wherein, when associating, the one or more processors are further configured to:
map the customer risk data to different attack techniques in the cyber security framework.

### Claim 15 (depends on 11)

The device of claim 11, wherein the one or more processors are further configured to:
calculate category security scores from the weighted technique scores, wherein the category security scores contribute to the overall security score.

### Claim 16 (depends on 11)

The device of claim 11, wherein the one or more processors are further configured to:
store, prior to obtaining the customer risk data, different weights associated with multiple industry identifiers.

### Claim 17

A non-transitory computer-readable medium having stored thereon instructions which, when executed by at least one processor, cause the at least one processor to:
obtain customer risk data for a customer network;
associate the customer risk data with at least one of multiple corresponding attack techniques in a cyber security framework;
generate multiple technique scores based on the associating and the customer risk data;
weight the multiple technique scores based on an industry-type associated with the customer network to generate weighted technique scores; and
provide an overall security score for the customer network based on the weighted technique scores.

### Claim 18 (depends on 17)

The non-transitory computer-readable medium of claim 17, wherein the instructions further cause the at least one processor to:
generate a graphical user interface that includes a presentation of the overall security score.

### Claim 19 (depends on 17)

The non-transitory computer-readable medium of claim 17, wherein the instructions further cause the at least one processor to:
calculate category security scores from the weighted technique scores.

### Claim 20 (depends on 17)

The non-transitory computer-readable medium of claim 17, wherein the instructions further cause the at least one processor to:
identify a corrective recommendation for the overall security score.