# US 12,223,454 B2 · Method and system for risk measurement and modeling

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,223,454 B2
- Document ID: US12223454B2
- Status: Granted
- Kind: B2
- Application number: 17/828,593
- Filed: 2022-05-31
- Published: 2022-10-20
- Granted: 2025-02-11
- Earliest claimed: 2016-09-08
- Assignees: Secure Systems Innovation Corporation
- Applicants: Secure Systems Innovation Corporation
- Inventors: Robert Vescio
- Web page: https://patentgrep.com/patent/US12223454B2

## CPC

- G06Q 10/0635: Risk analysis of enterprise or organisation activities
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 2221/034: Test or assess a computer or a system
- G06Q 10/063: Operations research, analysis or management
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 63/1458: {Denial of Service}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method and system for risk measurement and modeling, which may be used to identify and mitigate information security risks for an information system, and which may improve the efficiency of risk measurement and modeling. Such a system may perform risk modeling based on threat likelihood information, the potential business impacts of particular threats, and data on the effectiveness of particular controls implemented by the operators of the information system, which may be used to calculate residual risk scores for particular risk scenarios that the information system may face.

## Claims

### Claim 1

A computer-implemented method comprising:
maintaining, in association with at least one information system, a threat library comprising a plurality of threat likelihoods, wherein each of the plurality of threat likelihoods is derived from at least one of an external source or an internal source;
automatically retrieving, from the external source, an updated threat likelihood;
generating a composite risk model;
storing the composite risk model in association with the at least one information system, wherein generating the composite risk model comprises, for each of a plurality of predetermined risk scenarios:
selecting a model for identifying a quantitative implicit risk of a risk scenario,
incorporating the model into the composite risk model, wherein the model comprises a threat likelihood of the risk scenario in the plurality of threat likelihoods, a business impact of the risk scenario in a plurality of business impacts, and a control effectiveness of the risk scenario in a plurality of control effectivenesses, and the risk scenario comprises at least one threat type and a targetable system;
collecting scope and expectation information for an entity associated with the at least one information system,
determining, with a processor, based on the scope and expectation information, whether the at least one information system is vulnerable to the at least one threat type;
determining, with the processor, from a set of possible assessment activities, a plurality of assessment activities to apply, based on at least the determination of whether the at least one information system is vulnerable to the at least one threat type,
identifying, in an available list of assessment activities, a plurality of manual assessment activities and a plurality of automatic assessment activities,
providing each of the plurality of manual assessment activities on a user interface,
automatically applying the plurality of automatic assessment activities to the at least one information system,
determining, with the processor, from the plurality of assessment activities, the threat likelihood of the risk scenario and the business impact of the risk scenario,
determining, from the threat likelihood of the risk scenario and the business impact of the risk scenario, an implicit risk score for the risk scenario,
automatically executing, with the processor, at least one test on the at least one information system,
selecting a control framework from a set of stored control frameworks,
mapping the plurality of assessment activities and a result of the at least one test to the control framework via a plurality of pre-defined input fields associated with the control framework; and
calculating, from the implicit risk score and the control effectiveness, a residual risk value;
adding the residual risk value to a set of residual risk values;
generating, from the set of residual risk values, an overall residual risk score;
determining, from the plurality of control effectivenesses and the set of residual risk values, a plurality of control gaps based on a contribution of each of the plurality of control effectivenesses to the overall residual risk score;
providing a control effectiveness summary comprising the plurality of control gaps displayed in a ranked order; and
triggering, upon identification of a trigger condition comprising at least one of a modification to the at least one information system stored in association with the composite risk model and a passage of a predetermined amount of time after generation of the composite risk model, automatic scheduling of a process for generating an updated composite risk model.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, further comprising:
generating, from the plurality of control effectivenesses and the control framework, a compliance alignment score;
classifying each control effectiveness value in the plurality of control effectivenesses as having an alignment level, wherein the alignment level is one of: a primary control, a secondary control, and a tertiary control;
assigning each of the primary control, the secondary control, and the tertiary control a different weight, and adjusting each control effectiveness value by a weight associated with the alignment level; and
summing each control effectiveness value.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, wherein the control effectiveness summary further comprises an industry comparison chart, and further comprising:
pairing the overall residual risk score and the compliance alignment score as a first data point;
retrieving one or more other data points associated with at least one other operator of an information system;
anonymizing the one or more other data points to remove information associated with the at least one other operator of the information system; and
plotting and displaying the first data point and the one or more other data points on the industry comparison chart.

### Claim 4 (depends on 3)

The computer-implemented method of claim 3, further comprising:
retrieving a threshold risk score corresponding to a set level of risk; and
plotting and displaying a bounded area based on the threshold risk score.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, further comprising:
generating, with the processor, based on the set of residual risk values, at least one recommendation for reducing one or more of the set of residual risk values by making at least one adjustment to the at least one information system, the at least one adjustment being specifically identified in the at least one recommendation;
transmitting, with the processor, the at least one recommendation to an operator of the at least one information system; and
modifying the at least one information system by making the at least one adjustment.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5, further comprising:
determining, for the residual risk value in the set of residual risk values, an attack-system pairing;
retrieving, from a recommendation library, a retrieved recommendation corresponding to the attack-system pairing; and
transmitting the retrieved recommendation to the operator of the at least one information system.

### Claim 7 (depends on 5)

The computer-implemented method of claim 5, further comprising:
determining when the at least one adjustment has been made; and
automatically scheduling a second execution of the computer-implemented method when the at least one adjustment has been made.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1, further comprising:
determining when the predetermined amount of time has passed; and
automatically scheduling a second execution of the computer-implemented method when the predetermined amount of time has passed.

### Claim 9 (depends on 8)

The computer-implemented method of claim 8, further comprising:
retrieving at least one assessment activity result for at least one other information system before the predetermined amount of time has passed; and
updating the model based on the at least one assessment activity result.

### Claim 10 (depends on 1)

The computer-implemented method of claim 1, further comprising:
receiving at least one hypothetical modification from an operator of the at least one information system; and
adjusting the control effectiveness summary including at least one control gap in the plurality of control gaps and generating a hypothetical residual risk score.

### Claim 11

A computer program product embodied on a non-transitory computer-readable medium, comprising code executable by a computer having a processor and a memory, wherein the computer is configured to:
maintain, in association with at least one information system, a threat library comprising a plurality of threat likelihoods, each of the plurality of threat likelihoods derived from at least one of an external source or an internal source;
automatically retrieve, from the external source, an updated threat likelihood;
generate a composite risk model;
store the composite risk model in association with the at least one information system, wherein generating the composite risk model comprises, for each of a plurality of predetermined risk scenarios:
selecting a model for identifying a quantitative implicit risk of a risk scenario,
incorporating the model into the composite risk model, wherein the model comprises a threat likelihood of the risk scenario in the plurality of threat likelihoods, a business impact of the risk scenario in a plurality of business impacts, and a control effectiveness of the risk scenario in a plurality of control effectivenesses, and the risk scenario comprises at least one threat type and a targetable system,
collecting scope and expectation information for an entity associated with the at least one information system, and
determining, with the processor, based on the scope and expectation information, whether the at least one information system is vulnerable to the at least one threat type,
determining, with the processor, from a set of possible assessment activities, a plurality of assessment activities to apply, based on at least a determination of whether the at least one information system is vulnerable to the at least one threat type,
identifying, in an available list of assessment activities, a plurality of manual assessment activities and a plurality of automatic assessment activities,
providing each of the plurality of manual assessment activities on a user interface,
automatically applying the plurality of automatic assessment activities to the at least one information system,
determining, with the processor, from the plurality of assessment activities, the threat likelihood of the risk scenario and the business impact of the risk scenario,
determining, from the threat likelihood of the risk scenario and the business impact of the risk scenario, an implicit risk score for the risk scenario,
automatically executing, with the processor, at least one test on the at least one information system,
selecting a control framework from a set of stored control frameworks, and
mapping the plurality of assessment activities and a result of the at least one test to the control framework via a plurality of pre-defined input fields associated with the control framework;
calculate, from the implicit risk score and the control effectiveness, a residual risk value;
add the residual risk value to a set of residual risk values;
generate, from the set of residual risk values, an overall residual risk score;
determine, from the plurality of control effectivenesses and the set of residual risk values, a plurality of control gaps based on a contribution of each of the plurality of control effectivenesses to the overall residual risk score;
provide a control effectiveness summary comprising the plurality of control gaps displayed in a ranked order; and
trigger, upon identification of a trigger condition comprising at least one of a modification to the at least one information system stored in association with the composite risk model and a passage of a predetermined amount of time after generation of the composite risk model, automatic scheduling of a process for generating an updated composite risk model.

### Claim 12 (depends on 11)

The computer program product of claim 11, wherein the computer is further configured to:
generate, from the plurality of control effectivenesses and the control framework, a compliance alignment score,
classify each control effectiveness value in the plurality of control effectivenesses as having an alignment level, wherein the alignment level is one of: a primary control, a secondary control, and a tertiary control;
assign each of the primary control, the secondary control, and the tertiary control a different weight,
adjust each control effectiveness value by a weight associated with the alignment level, and
combine each control effectiveness value.

### Claim 13 (depends on 12)

The computer program product of claim 12, wherein the control effectiveness summary further comprises an industry comparison chart and the computer is further configured to:
pair the overall residual risk score and the compliance alignment score as a first data point;
retrieve one or more other data points associated with at least one other operator of an information system;
anonymize the one or more other data points to remove information associated with the at least one other operator of the information system; and
plot and display the first data point and the one or more other data points on the industry comparison chart.

### Claim 14 (depends on 13)

The computer program product of claim 13, wherein the computer is further configured to:
retrieve a threshold risk score corresponding to a set level of risk; and
plot and display a bounded area based on the threshold risk score.

### Claim 15 (depends on 11)

The computer program product of claim 11, wherein the computer is further configured to:
generate, with the processor, based on the set of residual risk values, at least one recommendation for reducing one or more of the set of residual risk values by making at least one adjustment to the at least one information system, the at least one adjustment being specifically identified in the at least one recommendation;
transmit, with the processor, the at least one recommendation to an operator of the at least one information system; and
modify the at least one information system by making the at least one adjustment.

### Claim 16 (depends on 15)

The computer program product of claim 15, wherein the computer is further configured to:
determine, for the residual risk value in the set of residual risk values, an attack-system pairing;
retrieve, from a recommendation library, a retrieved recommendation corresponding to the attack-system pairing; and
transmit the retrieved recommendation to the operator of the at least one information system.

### Claim 17 (depends on 15)

The computer program product of claim 15, wherein the computer is further configured to:
determine when the at least one adjustment has been made; and
perform a second instance of the set of residual risk score generation steps when the at least one adjustment has been made.

### Claim 18 (depends on 11)

The computer program product of claim 11, wherein the computer is further configured to:
determine when the predetermined amount of time has passed; and
automatically perform a second instance of the set of residual risk score generation steps when the predetermined amount of time has passed.

### Claim 19 (depends on 18)

The computer program product of claim 18, wherein the computer is further configured to:
retrieve at least one assessment activity result for at least one other information system before the predetermined amount of time has passed; and
update the model based on the at least one assessment activity result.

### Claim 20 (depends on 11)

The computer-implemented method of claim 11, further comprising:
receiving at least one hypothetical modification from an operator of the at least one information system;
adjusting the control effectiveness summary including at least one control gap in the plurality of control gaps; and
generating a hypothetical residual risk score.