US 2016/0239665 A1 · AUTOMATED AND CONTINUOUS RISK ASSESSMENT RELATED TO A CYBER LIABILITY INSURANCE TRANSACTION

Abstract

Systems, methods, and computer program products for evaluating situational awareness of a cyberspace operational environment in a security control server in connection with a cyber-liability insurance transaction. The system may include a security control server that generates a model representing a cyber-liability insurance transaction. The security control server may further generate a ranked list of recommended security controls that are designed to reduce cyber-risks, and thereby the premium, associated with the cyber-liability insurance transaction model. Additionally, the security control server may continuously and automatically monitor one or more security controls implemented by a cyber-liability insurance consumer to insured information technology assets to evaluate compliance with the cyber-liability insurance transaction model.

Claims22

Dependent claims

A method performed by a security control server to assess risk associated with a cyber-liability insurance transaction pertaining to an insured device, the method comprising the steps of:

transmitting, from the security control server, a configuration screen comprising a selectable list of a plurality of cyber-risks;
receiving, at the security control server, a selection of one or more of the cyber-risks;
receiving, at the security control server, information on each of one or more security controls associated with the one or more selected cyber-risks, wherein the information comprises an indication of whether each of the one or more security controls has been implemented on the insured device or has not been implemented on the insured device;
mapping, by the security control server, the information for each of the one or more security controls to the one or more selected cyber-risks;
generating, by the security control server, a set of policy axioms from the mappings, wherein the cyber-liability insurance transaction is represented as the set of policy axioms;
storing, by the security control server, the policy axioms in a knowledgebase;
generating, by the security control server, a list of mitigated and non-mitigated cyber risks based on the policy axioms;
and,
transmitting, by the security control server, the list of mitigated and non-mitigated cyber risks to a client device.

6 more elements

A security control server for assessing risk associated with a cyber-liability insurance transaction pertaining to an insured device, the server comprising:

a processor;
a memory coupled to the processor;
a knowledgebase;
and,
a network interface coupled to a network, wherein the processor is configured to:
transmit a configuration screen comprising a selectable list of a plurality of cyber-risks;
receive a selection of one or more of the cyber-risks;
receive information on each of one or more security controls associated with the one or more selected cyber-risks, wherein the information comprises an indication of whether each of the one or more security controls has been implemented on the insured device or has not been implemented on the insured device;
map the information for each of the one or more security controls to the one or more selected cyber-risks;
generate a set of policy axioms from the mappings, wherein the cyber-liability insurance transaction is represented as the set of policy axioms;
store the policy axioms in the knowledgebase;
generate a list of mitigated and non-mitigated cyber risks based on the policy axioms;
and,
transmit the list of mitigated and non-mitigated cyber risks to a client device.

11 more elements

A computer program product for assessing risk associated with a cyber-liability insurance transaction pertaining to an insured device, the computer program product comprising a non-transitory computer readable medium containing instructions for a processor to:

transmit a configuration screen comprising a selectable list of a plurality of cyber-risks;
receive a selection of one or more of the cyber-risks;
receive information on each of one or more security controls associated with the one or more selected cyber-risks, wherein the information comprises an indication of whether each of the one or more security controls has been implemented on the insured device or has not been implemented on the insured device;
map the information for each of the one or more security controls to the one or more selected cyber-risks;
generate a set of policy axioms from the mappings, wherein the cyber-liability insurance transaction is represented as the set of policy axioms;
store the policy axioms in a knowledgebase;
generate a list of mitigated and non-mitigated cyber risks based on the policy axioms;
and,
transmit the list of mitigated and non-mitigated cyber risks to a client device.

6 more elements

Dependencies are inferred from the claim text.

Automated and continuous risk assessment related to a cyber liability insurance transaction

Life of this patent

Automated and continuous risk assessment related to a cyber liability insurance transaction

Life of this patent

Abstract

Claims22