Flexible risk assessment and management system for integrated risk and value analysis

A system comprising:

• at least one server computers comprising one or more processors;
• and one or more computer readable media comprising computer readable code executable by one or more processors to:
• receive a request comprising undesired event data defining an undesired event, wherein the undesired event data corresponds to an asset;
• identify, from an attack database, one or more sets of attack attributes related to the undesired event data;
• determine that intent is a driver among the attack attributes;
• identify one or more protection measures relevant to the asset and the attack attributes;
• in response to determining that intent is the driver:
• perform a first set of Monte Carlo simulations, based on a Bayesian uncertainty model, for the undesired event based on a plurality of combinations of the attack attributes, the protection measures, and the asset;
• perform a second set of Monte Carlo simulations, based on a Bayesian uncertainty model, for the undesired event based on a subset of the plurality of combinations of the attack attributes, wherein the second set of Monte Carlo simulations comprises a subset of the first set of Monte Carlo simulations comprising one or more variables of uncertainty among the one or more sets of attack attributes, and wherein the first set of Monte Carlo simulations include at least one simulation that is not included in the second set of Monte Carlo simulations, and
• the one or more variables of uncertainty are based at least in part on data associated with an attacker's reaction or adaptation to a variation in attack conditions and the one or more protection measures;
• and
• providing one or more combinations of the attack attributes, the protection measures, and the asset which result in the undesired event in accordance with outcomes of the first set of Monte Carlo simulations and the second set of Monte Carlo simulations.

A method comprising:

• receiving a request comprising undesired event data defining an undesired event, wherein the undesired event data corresponds to an asset;
• identifying, from an attack database, one or more sets of attack attributes related to the undesired event data;
• determining whether intent is a driver among the attack attributes;
• identifying one or more protection measures relevant to the asset and the attack attributes;
• in response to determining that intent is the driver:
• performing a first set of Monte Carlo simulations, based on a Bayesian uncertainty model, for the undesired event based on a plurality of combinations of the attack attributes, the protection measures, and the asset;
• performing a second set of Monte Carlo simulations, based on the Bayesian uncertainty model, for the undesired event based on a subset of the plurality of combinations of the attack attributes, wherein the second set of Monte Carlo simulations comprises a subset of the first set of Monte Carlo simulations comprising one or more variables of uncertainty among the one or more sets of attack attributes, and wherein the first set of Monte Carlo simulations include at least one simulation that is not included in the second set of Monte Carlo simulations, and
• the one or more variables of uncertainty are based at least in part on data associated with an attacker's reaction or adaptation to a variation in attack conditions and the one or more protection measures;
• and
• providing one or more combinations of the attack attributes, the protection measures, and the asset which result in the undesired event in accordance with outcomes of the first set of Monte Carlo simulations and the second set of Monte Carlo simulations.