# US 12,010,137 B2 · Information technology security assessment system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,010,137 B2
- Document ID: US12010137B2
- Status: Granted
- Kind: B2
- Application number: 18/453,488
- Filed: 2023-08-22
- Published: 2023-12-14
- Granted: 2024-06-11
- Earliest claimed: 2010-09-24
- Assignees: BitSight Technologies, Inc.
- Applicants: BitSight Technologies, Inc.
- Inventors: Stephen Wayne Boyer; Nagarjuna Venna; Megumi Ando
- Web page: https://patentgrep.com/patent/US12010137B2

## CPC

- H04L 63/1433: {Vulnerability analysis}
- G06Q 10/0639: Performance analysis of employees; Performance analysis of enterprise or organisation operations
- H04L 43/062: related to network traffic
- H04L 43/0876: Network utilisation, e.g. volume of load or congestion level
- H04L 61/5007: Internet protocol [IP] addresses
- H04L 67/53: using third party service providers
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A method and system for creating a composite security rating from security characterization data of a third party computer system. The security characterization data is derived from externally observable characteristics of the third party computer system. Advantageously, the composite security score has a relatively high likelihood of corresponding to an internal audit score despite use of externally observable security characteristics. Also, the method and system may include use of multiple security characterizations all solely derived from externally observable characteristics of the third party computer system.

## Claims

### Claim 1

A system comprising:
one or more computers programmed to perform operations comprising:
collecting, from two or more sources, information corresponding to an entity, the information collected about the entity being indicative of (i) vulnerabilities of computing systems of the entity and (ii) resiliencies of the entity to recover from the vulnerabilities, wherein the information is indicative of durations of events associated with the vulnerabilities, wherein one or more of the sources is not controlled by the entity, wherein the information from at least the one or more sources that are not controlled by the entity is collected without permission of the entity;
processing the information to form a composite security rating of the entity that is indicative of a degree of cybersecurity risk to (i) the entity or (ii) a third-party entity having a relationship with the entity, the composite security rating comprising a combination of security features extracted from the information, wherein the security features are indicative of (i) a measure of an extent of, a frequency of, or a duration of the vulnerabilities of the computing systems of the entity and (ii) a measure of a resilience of the entity to recover from a security breach corresponding to the vulnerabilities, the measure of the resilience being inversely proportional to a duration of detected malicious activity, and
providing, via a reporting facility, the composite security rating of the entity.

### Claim 2 (depends on 1)

The system of claim 1, wherein the information is represented by at least two data types.

### Claim 3 (depends on 2)

The system of claim 2, wherein the at least two data types include at least one of breach disclosures, block lists, configuration parameters, an identification of malware servers, an identification of a reputation, an identification of suspicious activity, an identification of spyware, white lists, an identification of compromised hosts, an identification of malicious activity, an identification of spam activity, an identification of vulnerable hosts, an identification of phishing activity, or an identification of e-mail viruses.

### Claim 4 (depends on 1)

The system of claim 1, wherein the information evidences internal security controls.

### Claim 5 (depends on 1)

The system of claim 1, wherein the information comprises one or more outcomes of the entity.

### Claim 6 (depends on 1)

The system of claim 1, wherein the information evidences operational execution of security measures of the entity.

### Claim 7 (depends on 1)

The system of claim 1, wherein the information indicates whether a computing system of the computing systems of the entity served malicious code to another system.

### Claim 8 (depends on 1)

The system of claim 1, wherein the information indicates whether a computing system of the computing systems of the entity communicated with a known attacker controlled network or sensor outside a control or network of the entity.

### Claim 9 (depends on 1)

The system of claim 1, wherein the operations further comprise:
forming a series of composite security ratings of the entity, wherein the series of composite security ratings comprises the composite security rating.

### Claim 10 (depends on 9)

The system of claim 9, wherein the operations further comprise:
determining a trend from the series of composite security ratings.

### Claim 11 (depends on 9)

The system of claim 9, wherein the operations further comprise:
displaying the series of composite security ratings.

### Claim 12 (depends on 11)

The system of claim 11, wherein the displaying the series of composite security ratings comprises posting the series of composite security ratings for the entity to a web portal.

### Claim 13 (depends on 1)

The system of claim 1, wherein the information represents externally observable outcome information.

### Claim 14 (depends on 1)

The system of claim 1, wherein the operations further comprise:
determining a badness score that corresponds to an intensity or duration of malicious activity determined from the information.

### Claim 15 (depends on 1)

The system of claim 1, wherein the information comprises a characterization of behavior of an employee of the entity.

### Claim 16 (depends on 1)

The system of claim 1, wherein the information comprises characterizations other than characterizations about the computing systems of the entity.

### Claim 17 (depends on 1)

The system of claim 1, wherein the information comprises characterizations about policies of the entity.

### Claim 18 (depends on 1)

The system of claim 1, wherein the information comprises characterizations about information technology assets that the entity owns, controls, uses, or is affiliated with.

### Claim 19 (depends on 1)

The system of claim 1, wherein the information represents: (a) physical states, (b) technical states, (c) organizational states, or (d) cultural states of the entity which can be exploited to create a security breach; or (e) the entity's ability to recover from a security breach; or any combination of two or more of these.

### Claim 20 (depends on 1)

The system of claim 1, wherein the processing the information to form the composite security rating comprises correlating data across the two or more sources.