Assessing and Managing Cyber Threats

A method performed by one or more computers, the method comprising:

• one or more computers comprising one or more hardware processors;
• one or more computer-readable media storing instructions that, when executed by the one or more computers, cause the one or more computers to perform operations comprising:
• receiving and accessing, by the one or more computers, data specifying relationships between:
• (i) IT system infrastructures representing computing devices of an organization and a network connecting the computing devices and their physical and logical location, defined by information such as identity, name and category identity;
• (ii) system categories indicating characteristics of assets of the organization;
• (iii) operational processes of an organization, defined by identity, a name and a value in terms of a monetary value for a given time window having a beginning and end;
• (iii) a list of observed computer-based threats including at least one selected from the group consisting of a virus, malware, a network intrusion, and a denial of service attack, with data for each threat identifying frequency of occurrence, which may include at least one period of time and corresponding frequency of occurrence for a given time window having a beginning and end;
• (iv) mitigating actions representing the threat mitigation measures of the organization;
• the one or more computers performing a plurality of simulations using a Monte Carlo method, each simulation involving propagating data through stochastic modeling for a given time window having a beginning and end;
• sampling by the one or more computers, outcomes of the plurality of simulations for a given time window having a beginning and end;
• sampling by the one or more computers, outcomes of the plurality of simulations that include mitigating actions representing the threat mitigation measures of the organization for a given time window having a beginning and end;
• based on the sampled outcomes of the simulations, determining, by the one or more computers, measures of impact of the computer-related threats to the organization for a given time window having a beginning and end and providing, by the one or more computers and for output to a user, graphical representations of the determined measures of impact of the computer-based threats to the organization, for a given time window having a beginning and end, in a graphical user interface;
• the one or more computers further configured to predict future threat activity based upon stochastic modeling of computer-based threats and outputting said predicted future threat activity to one or more firewalls, to improve accuracy in identifying computer-based threats on the one or more computer networks.

A non-transitory computer-readable medium storing instructions that, when executed by the one or more computers, cause the one or more computers to perform operations comprising:

• receiving and accessing, by the one or more computers, data specifying relationships between:
• (i) IT system infrastructures representing computing devices of an organization and a network connecting the computing devices and their physical and logical location, defined by information such as identity, name and category identity;
• (ii) system categories indicating characteristics of assets of the organization;
• (iii) operational processes of an organization, defined by identity, a name and a value in terms of a monetary value for a given time window having a beginning and end;
• (iii) a list of observed computer-based threats including at least one selected from the group consisting of a virus, malware, a network intrusion, and a denial of service attack, with data for each threat identifying frequency of occurrence, which may include at least one period of time and corresponding frequency of occurrence for a given time window having a beginning and end;
• (iv) mitigating actions representing the threat mitigation measures of the organization;
• the one or more computers performing a plurality of simulations using a Monte Carlo method, each simulation involving propagating data through stochastic modeling for a given time window having a beginning and end;
• sampling by the one or more computers, outcomes of the plurality of simulations for a given time window having a beginning and end;
• sampling by the one or more computers, outcomes of the plurality of simulations that include mitigating actions representing the threat mitigation measures of the organization for a given time window having a beginning and end;
• based on the sampled outcomes of the simulations, determining, by the one or more computers, measures of impact of the computer-related threats to the organization for a given time window having a beginning and end and providing, by the one or more computers and for output to a user, graphical representations of the determined measures of impact of the computer-based threats to the organization, for a given time window having a beginning and end, in a graphical user interface;
• the one or more computers further configured to predict future threat activity based upon stochastic modeling of computer-based threats and outputting said predicted future threat activity to one or more firewalls, to improve accuracy in identifying computer-based threats on the one or more computer networks.