Holistic computer system cybersecurity evaluation and scoring
AssigneeQomplx LLC
InventorsJason Crabtree, Andrew Sellers
Life of this patent
Estimating the term…
Abstract
A system and method for holistic computer system cybersecurity evaluation and risk rating that takes into account the operation of the entire computer system environment comprising hardware, software, and the operating system. Not only are the hardware, software, and operating system evaluated separately for cybersecurity concerns, their interaction and operation as a whole are also evaluated and scored. The results of such analyses may be used, for example, by underwriters of cybersecurity insurance policies to determine policy terms and rates.
Claims15
A system for holistic computer system cybersecurity evaluation and rating, comprising:
- a first computing device comprising a memory and a processor;
- a system analyzer comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the first computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the first computing device to:
- receive a system definition comprising a software definition, a hardware definition, and an operating system definition for a second computing device;
- identify a software function defined by the software definition and compare the function to a database of software functions to establish a software cybersecurity score;
- identify a hardware component defined by the hardware definition and compare the component to a database of components to establish a hardware cybersecurity score;
- and
- identify an operating system function defined by the operating system definition and compare the function to a database of operating system functions to establish an operating system cybersecurity score;
- and
- a scoring engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the first computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the first computing device to:
- generate a cybersecurity score for the second computing device based on a combination of the software cybersecurity score, hardware cybersecurity score, and operating system cybersecurity score.
A method for holistic computer system cybersecurity evaluation and rating, comprising the steps of:
- receiving a system definition comprising a software definition, a hardware definition, and an operating system definition for a second computing device;
- identifying a software function defined by the software definition and compare the function to a database of software functions to establish a software cybersecurity score;
- identifying a hardware component defined by the hardware definition and compare the component to a database of components to establish a hardware cybersecurity score;
- identifying an operating system function defined by the operating system definition and compare the function to a database of operating system functions to establish an operating system cybersecurity score;
- and
- generating a cybersecurity score for the second computing device based on a combination of the software cybersecurity score, hardware cybersecurity score, and operating system cybersecurity score.
The method of claim 9, wherein the software definition comprises source code for an application and further comprising the step of analyzing the coding complexity of the source code to update the software cybersecurity score.
A method for holistic computer system cybersecurity rating, comprising the steps of:
- generating a base cybersecurity score for a computing device by combining separate analyses of a software component, a hardware component, and an operating system component of a computer system;
- adjusting the cybersecurity score to reflect a domain in which the computer system will be used;
- adjusting the cybersecurity score to reflect a use to which the computer system will be put;
- adjusting the cybersecurity score to reflect a criticality of the computer system to overall operations of a business or larger network of computers;
- and
- adjusting the cybersecurity to reflect a magnitude of losses that would occur if the system was compromised.
Dependencies are inferred from the claim text.