Risk modeling for cyberspace control implementation deficiencies

A data processing system adapted for risk modeling for cyberspace control deficiencies, the system comprising:

• a host computing platform comprising one or more computers, each with memory and one or processing units including one or more processing cores;
• a database storing threat assessment data mapped to different controls, each of the different controls corresponding to one or more threats, each of the different controls having an association in the database with one or more different characterizations of an organization;
• and,
• a risk modeling module comprising computer program instructions enabled while executing in the memory of at least one of the processing units of the host computing platform to perform:
• specifying a particular organization for risk modeling and characterizing the particular organization as one of the different characterizations;
• loading into the memory from the database a baseline set of controls mapped to respectively different threats for the one of the different characterizations and computing for each corresponding one of the different threats, a baseline risk value from a hypothetical implementation of the set of controls for the different characterizations for the corresponding one of the different threats;
• uploading risk assessment data for the particular organization and extracting from the risk assessment data, an implemented set of controls for the particular organization;
• mapping for each corresponding one of the threats, identified ones of the implemented set of controls that are mapped to the corresponding one of the threats in the baseline set of controls;
• computing a risk value for the particular organization based upon the mapped identified ones of the implemented set of controls and writing the computed risk value to a risk register in the memory in connection with the particular organization;
• comparing the baseline risk value to the computed risk value in the risk register to produce a determined risk deficit value for a current state and writing the determined risk deficit value to the risk register;
• and,
• responding to the determined risk deficit value exceeding a threshold value by writing a flag to the memory in association with the risk assessment data.

A computing device comprising a non-transitory computer readable storage medium having program instructions stored therein, the instructions being executable by at least one processing core of a processing unit to cause the processing unit to perform a method for risk modeling for cyberspace control deficiencies comprising:

• establishing a communicative connection with a database storing threat assessment data mapped to different controls, each of the different controls corresponding to one or more threats, each of the different controls having an association in the database with one or more different characterizations of an organization;
• specifying a particular organization for risk modeling and characterizing the particular organization as one of the different characterizations;
• loading into memory from the database a baseline set of controls mapped to respectively different threats for the one of the different characterizations and computing for each corresponding one of the different threats, a baseline risk value from a hypothetical implementation of the set of controls for the different characterizations for the corresponding one of the different threats;
• uploading risk assessment data for the particular organization and extracting from the risk assessment data, an implemented set of controls for the particular organization;
• mapping for each corresponding one of the threats, identified ones of the implemented set of controls that are mapped to the corresponding one of the threats in the baseline set of controls;
• computing a risk value for the particular organization based upon the mapped identified ones of the implemented set of controls and writing the computed risk value to a risk register in the memory in connection with the particular organization;
• comparing the baseline risk value to the computed risk value in the risk register to produce a determined risk deficit value for a current state and writing the determined risk deficit value to the risk register;
• and,
• responding to the determined risk deficit value exceeding a threshold value by writing a flag to memory in association with the risk assessment data.