Method and system for risk measurement and modeling

A computer program product embodied on a non-transitory computer-readable medium, comprising code executable by a computer having a processor and a memory and connected to at least one information system subject to a risk scenario, to cause the computer to carry out the following steps:

• selecting a model for identifying a quantitative residual risk of the risk scenario, wherein the model comprises a plurality of inputs, the inputs comprising a threat likelihood for the risk scenario, a business impact for the risk scenario, and a control effectiveness for the risk scenario, the risk scenario comprising a threat type and a targetable system;
• performing, with the processor, a plurality of assessment activities on the at least one information system based on the model and based on at least one anticipated vulnerability of the at least one information system, and determining, with the processor, from the plurality of assessment activities, the threat likelihood of the risk scenario, the business impact for the risk scenario, and the control effectiveness of the risk scenario;
• generating, with the processor, from the model, the quantitative residual risk of the risk scenario;
• generating a residual risk report comprising an implicit risk summary and a residual risk summary, the implicit risk summary comprising a combination of threat likelihood data including the threat likelihood of the risk scenario for the at least one information system and business impact data including the business impact of the risk scenario for the at least one information system, the residual risk summary comprising a control effectiveness summary including the control effectiveness of the risk scenario for the at least one information system;
• wherein the implicit risk summary further comprises a plurality of possible controls and a ranking of the plurality of possible controls based on the impact of each of the possible controls on an aggregate control effectiveness score;
• and
• wherein the residual risk summary further comprises a plurality of unimplemented controls and a ranking of the plurality of unimplemented controls based on the impact of each of the unimplemented controls on the aggregate control effectiveness score;
• receiving, from an operator of the at least one information system, via a user interface, an alteration to the set of implemented controls comprising at least one of adding a control or removing the control;
• simulating an effect of the control on an expected loss value, and comparing the effect of the control on the expected loss value to the cost of generating the control;
• outputting a simulation result to the operator based on the simulated effect of the control;
• and
• modifying the at least one information system by making at least one adjustment to implement an unimplemented control.

An information system configured to identify and mitigate information security implicit risks experienced by the information system, the information system comprising a processor and a memory and configured to perform the steps of:

• selecting a model for identifying a quantitative residual risk of the risk scenario, wherein the model comprises a plurality of inputs, the inputs comprising a threat likelihood for the risk scenario, a business impact for the risk scenario, and a control effectiveness for the risk scenario, the risk scenario comprising a threat type and a targetable system;
• performing, with the processor, a plurality of assessment activities on the information system based on the model and based on at least one anticipated vulnerability of the information system, and determining, with the processor, from the plurality of assessment activities, the threat likelihood of the risk scenario, the business impact for the risk scenario, and the control effectiveness of the risk scenario;
• generating, with the processor, from the model, the quantitative residual risk of the risk scenario;
• generating a residual risk report comprising an implicit risk summary and a residual risk summary, the implicit risk summary comprising a combination of threat likelihood data including the threat likelihood of the risk scenario for the at least one information system and business impact data including the business impact of the risk scenario for the at least one information system, the residual risk summary comprising a control effectiveness summary including the control effectiveness of the risk scenario for the at least one information system;
• wherein the implicit risk summary further comprises a plurality of possible controls and a ranking of the plurality of possible controls based on the impact of each of the possible controls on an aggregate control effectiveness score;
• and
• wherein the residual risk summary further comprises a plurality of unimplemented controls and a ranking of the plurality of unimplemented controls based on the impact of each of the unimplemented controls on the aggregate control effectiveness score;
• receiving, from an operator of the at least one information system, via a user interface, an alteration to the set of implemented controls comprising at least one of adding a control or removing the control;
• simulating an effect of the control on an expected loss value, and comparing the effect of the control on the expected loss value to the cost of generating the control;
• outputting a simulation result to the operator based on the simulated effect of the control;
• and
• modifying the information system by making at least one adjustment to implement an unimplemented control.