A computer program product, encoded on a machine-readable storage device, operable to cause one or more processors to perform operations for technology risk assessment, the operations comprising:
- receiving software characteristic values for a set of software characteristics for each software process in a plurality of sets of software processes, wherein the set of software characteristics for each software process includes a level of input validation employed by the software process, a level of error correction and detection employed by the software process, a level of buffer overflow prevention employed by the software process, a level of complexity of the software process, a level of multi-threaded processing employed by the software process, a level of structure of the software process, a level of maintenance required to keep the software process working in a proper condition, a level of configuration file usage by the software process, a level of invoking other software processes employed by the software process, a level of user privilege checks performed by the software process, a level of flexibility contained in the software process, a level of encryption of hashing used by the software process, a level of authentication employed by the software process where something known to a user is provided, a level of authentication employed by the software process where something a user physically possesses is provided, a level of authentication employed by the software process where a user provides something from himself or herself, a level of backup operations for automatically switching if the software process fails, a level of time function usage by the software process, a level of network usage by the software process, a level of Trojan behavior by the software process, and a level of logging used by the software process;
- receiving a user input identifying a technology control to be applied to one or more of the software processes, wherein the identified technology control includes at least one selected from the group of:
- patch management, data storage re-imaging control, network or computer intrusion detection, network or computer intrusion prevention, transactional logging of network or computer activities, outsourcing logs to another entity, log review, alarming and alerting, a dummy computer designed to attract an intruder, computer virus scanning or removal, token based two-factor authentication, use of digital signatures to authenticate data and permissions, offsite backup for data storage, server clustering, encrypted data storage, use of strong passwords, centralized location for user authentication, fingerprint biometric authentication, and hand geometry biometric authentication;
- receiving a technology control value that is a function of an impact the identified technology control has on at least one risk index category associated with one or more of the software processes;
- receiving a user input identifying an administrative control to be applied to one or more of the software processes;
- receiving an administrative control value, the administrative control value being a function of an impact the identified administrative control has on at least one risk index category associated with one or more of the software processes;
- determining a set of risk indexes, at least one for each software process, wherein a modifier is applied to one or more software characteristic values associated with one or more software processes, the modifier depending at least in part on an extent to which the identified technology control or the administrative control increases or decreases a risk index associated with the software characteristic, wherein the risk indexes include at least respective confidentiality, data, reviewability, communication and security risk indexes;
- and
- outputting a risk model report that comprises the sets of risk indexes.