US 2012/0233698 A1 · Information System Security Based on Threat Vectors

Abstract

A security system is provided. The system comprises a computer system, a memory accessible to the computer system, a data store, and an application. The data store comprises a threat catalog, wherein the threat catalog comprises a plurality of threat vectors, each threat vector comprising a plurality of fields, wherein each field is constrained to carry a value selected from a predefined list of enumerated values. The application is stored in the memory and, when executed by the computer system receives a threat report, wherein the threat report comprises an identification of at least one threat vector, determines a correlation between the at least one threat vector received in the threat report with the threat vectors comprising the threat catalog, and, based on the correlation, sends a notification to a stakeholder in an organization under the protection of the security system.

Claims20

Dependent claims

A security system, comprising:

a computer system;
a memory accessible to the computer system;
a data store comprising a threat catalog, wherein the threat catalog comprises a plurality of threat vectors, each threat vector comprising a plurality of fields, wherein each field is constrained to carry a value selected from a predefined list of enumerated values;
and
an application stored in the memory that, when executed by the computer system,
receives a threat report, wherein the threat report comprises an identification of at least one threat vector,
determines a correlation between the at least one threat vector received in the threat report with the threat vectors comprising the threat catalog,
based on the correlation, sends a notification to a stakeholder in an organization under the protection of the security system.

5 more elements

A method of managing security risks, comprising:

defining a plurality of threat descriptors, wherein defining a threat descriptor comprises defining an enumerated list of values that the threat descriptor can take on;
analyzing a first organization to identify a plurality of threat paths, wherein each threat path associates an asset or a procedure of the organization with a threat source and with one of an attack tool, an attack tactic, or an attack procedure;
based on the threat paths, building a threat catalog comprising a plurality of threat vectors, wherein each threat vector comprises a plurality of threat descriptors;
receiving a first threat report comprising a first manifest threat vector, wherein the first manifest threat vector identifies aspects of an attack experienced by a second organization;
correlating the first manifest threat vector with the threat vectors in the threat catalog;
based on correlating, revising a security risk metric of the organization;
and
presenting the revised security risk metric.

5 more elements

Dependencies are inferred from the claim text.

Information System Security Based on Threat Vectors

Life of this patent

Information System Security Based on Threat Vectors

Life of this patent

Abstract

Claims20