Methods for using organizational behavior for risk ratings

A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a computer, cause the computer to:

• perform online discovery of first information about one or more technical assets that contribute to security characteristics of an entity, the technical assets comprising a set of first Internet Protocol (IP) addresses associated with the entity, wherein performing the online discovery comprises:
• receive, from a user, an identification of a first domain name for the entity,
• perform a series of passive Domain Name System (DNS) queries based at least in part on the first domain name to determine the set of first IP addresses associated with the entity,
• receive a list of first name servers for the first domain name,
• receive, for at least one of the first name servers, a list of second domain names for which the first name server is authoritative,
• receive, for at least one of the second domain names, a list of host names and second IP addresses for the host names, the set of first IP addresses comprising the second IP addresses for the host names, wherein at least one of the list of first name servers, the list of second domain names, the list of host names, or the second IP addresses for the host names is received in response to the series of passive DNS queries, and
• associate the set of first IP addresses with the entity in a database;
• automatically correlate the entity with the technical assets;
• assign a security rating to the entity based at least in part on the technical assets;
• and
• cause a user interface to be displayed, the user interface comprising second information about the technical assets, the second information comprising at least one of the set of first IP addresses, mail server configurations, or Autonomous System numbers.

A computing apparatus comprising:

• a processor;
• and
• a memory storing instructions that, when executed by the processor, configure the apparatus to:
• perform online discovery of first information about one or more technical assets that contribute to security characteristics of an entity, the technical assets comprising a set of first Internet Protocol (IP) addresses associated with the entity, wherein performing the online discovery comprises:
• receive, from a user, an identification of a first domain name for the entity,
• perform a series of passive Domain Name System (DNS) queries based at least in part on the first domain name to determine the set of first IP addresses associated with the entity,
• receive a list of first name servers for the first domain name,
• receive, for at least one of the first name servers, a list of second domain names for which the first name server is authoritative,
• receive, for at least one of the second domain names, a list of host names and second IP addresses for the host names, the set of first IP addresses comprising the second IP addresses for the host names, wherein at least one of the list of first name servers, the list of second domain names, the list of host names, or the second IP addresses for the host names is received in response to the series of passive DNS queries, and
• associate the set of first IP addresses with the entity in a database;
• automatically correlate the entity with the technical assets;
• assign a security rating to the entity based at least in part on the technical assets;
• and
• cause a user interface to be displayed, the user interface comprising second information about the technical assets, the second information comprising at least one of the set of first IP addresses, mail server configurations, or Autonomous System numbers.