Method and tool to quantify the enterprise consequences of cyber risk

A method implemented by a cyber threat comprising:

• receiving data associated with a configuration of a network architecture of an enterprise network;
• determining one or more information assets stored within the enterprise network;
• mapping the one or more information assets to one or more nodes associated with the configuration of the network architecture of the enterprise network;
• performing a network behavioral analysis on the enterprise network to determine relative vulnerability levels of the one or more information assets based on one or more threat vectors that represent cyber threats to the one or more information assets;
• determining one or more operational impacts for one or more vulnerabilities associated with the one or more information assets;
• aggregating the one or more operational impacts to determine an enterprise impact;
• determining one or more measures of risk associated with the relative vulnerability levels of the one or more information assets determined from the network behavioral analysis and the enterprise impact of the one or more vulnerabilities associated with the one or more information assets;
• and
• outputting at least one of the one or more measures of risk associated with the relative vulnerability levels of the one or more information assets and the enterprise impact of the one or more vulnerabilities associated with the one or more information assets.

A computer readable storage medium encoded with instructions capable of being executed by a processor, wherein when executing the instructions the processor is configured to implement a method comprising:

• receiving data associated with a configuration of a network architecture of an enterprise network;
• determining one or more information assets stored within the enterprise network;
• mapping the one or more information assets to one or more nodes associated with the enterprise network;
• performing a network behavioral analysis on the enterprise network to determine relative vulnerability levels of the one or more information assets based on one or more threat vectors that represent cyber threats to the one or more information assets;
• determining one or more operational impacts for one or more vulnerabilities associated with the one or more information assets;
• aggregating the one or more operational impacts to determine an enterprise impact;
• determining one or more measures of risk associated with relative vulnerability levels of the one or more information assets determined from the network behavioral analysis and the enterprise impact of the one or more vulnerabilities associated with the one or more information assets;
• and
• outputting at least one of the one or more measures of risk associated with the relative vulnerability levels of the one or more information assets and the enterprise impact of the one or more vulnerabilities associated with the one or more information assets.