Techniques for Information Security Assessment
OwnerMark D. McGoverninventor
Life of this patent
Estimating the term…
Abstract
Methods for information security assessment and data risk scoring are disclosed. A disclosed method includes identifying a plurality of parameters relevant to information security of information systems, establishing at least two risk levels associated with each of the plurality of parameters, assigning a numerical score to each of the at least two risk level associated with each of the plurality of parameters, recording the parameters, risk levels and numerical scores into one or more data structures, and assessing and scoring information security of a specified information system and/or collectively for an entire enterprise based at least in part on the one or more data structures.
Claims20
A computer-implemented method for information security and data risk assessment, the method comprising:
- identifying a plurality of security parameters corresponding to security aspects of the information security of an information system;
- establishing at least two risk levels associated with each of the plurality of security parameters;
- assigning a component score to each of the at least two risk levels associated with each of the plurality of security parameters;
- storing the security parameters, risk levels and component scores in a memory according to one or more data structures, the data structures corresponding to an industry security standard;
- and
- calculating a composite score based on the security parameters, risk levels and numerical scores, the composite score indicating the overall security risk exposure of the information system according to the industry security standard.
A computer-implemented method of employing a numerical scoring scheme in an information security assessment, the method comprising:
- collecting input data descriptive of an IT infrastructure of an organization;
- matching the input data with a plurality of security parameters in a scoring data structure corresponding to a regulatory standard;
- determining, for each security parameter and based on the input data, a component score by assessing a risk level corresponding to said each security parameter, thereby establishing a plurality of component scores;
- and
- synthesizing the plurality of component scores to generate a composite score indicative of an overall security risk exposure of the IT infrastructure or sector scores indicative of security risks in portions or aspects of the IT infrastructure.
A system, comprising:
- a memory storing input data descriptive of an IT infrastructure of an organization;
- and
- a processor configured to:
- match the input data with a plurality of security parameters in a scoring data structure;
- determine, for each security parameter and based on the input data, a component score by assessing a risk level corresponding to said each security parameter, thereby establishing a plurality of component scores;
- and
- synthesize the plurality of component scores to generate a composite score indicative of an overall security risk exposure of the IT infrastructure or sector scores indicative of security risks in portions or aspects of the IT infrastructure.
Dependencies are inferred from the claim text.