Back to results
US 2022/0286474 A1Published application
Continuous scoring of security controls and dynamic tuning of security policies
AssigneeTenable, Inc.
InventorsAditya KUPPA, Lamine AOUAD, Bryan Doyle
Life of this patent
Estimating the term…
Abstract
Techniques, methods and/or apparatuses are disclosed that enable of cyber risks on assets of networks to be evaluated in presence of security controls on the assets. In this way, effect of security controls already in place may be quantified. A novel scoring technique is presented. Also, use of causal inference is in the context of security risk assessment is described.
Claims32
A method of determining a cyber risk score of a target asset of a target network, the method comprising:
- identifying a vulnerability from a vulnerability scan data of the target asset;
- determining a raw cyber risk score of the identified vulnerability;
- identifying a security control applicable to the target asset;
- and
- determining an effective cyber risk score corresponding to the raw cyber risk score based on the identified security control and based on an observational dataset, the observational dataset being associated with a plurality of observational assets, a plurality of observational security controls, and a plurality observational vulnerabilities, the observational dataset comprising a plurality of observed outcomes, which are outcomes of vulnerability checks of one or more of the observational vulnerabilities performed on one or more of the observational assets on which one or more of the observational security controls are present.
2 more elements
A cyber risk scorer, comprising:
- a memory;
- and
- at least one processor coupled to the memory,
- wherein the memory and the at least one processor are configured to:
- identify a vulnerability from a vulnerability scan data of a target asset of a target network;
- determine a raw cyber risk score of the identified vulnerability;
- identify a security control applicable to the target asset;
- and
- determine an effective cyber risk score corresponding to the raw cyber risk score based on the identified security control and based on an observational dataset, the observational dataset being associated with a plurality of observational assets, a plurality of observational security controls, and a plurality observational vulnerabilities, the observational dataset comprising a plurality of observed outcomes, which are outcomes of vulnerability checks of one or more of the observational vulnerabilities performed on one or more of the observational assets on which one or more of the observational security controls are present.
6 more elements
A non-transitory computer-readable medium storing computer-executable instructions for a cyber risk scorer, comprising:
- one or more instructions causing the cyber risk scorer to identify a vulnerability from a vulnerability scan data of a target asset of a target network;
- one or more instructions causing the cyber risk scorer to determine a raw cyber risk score of the identified vulnerability;
- one or more instructions causing the cyber risk scorer to identify a security control applicable to the target asset;
- and
- one or more instructions causing the cyber risk scorer to determine an effective cyber risk score corresponding to the raw cyber risk score based on the identified security control and based on an observational dataset, the observational dataset being associated with a plurality of observational assets, a plurality of observational security controls, and a plurality observational vulnerabilities, the observational dataset comprising a plurality of observed outcomes, which are outcomes of vulnerability checks of one or more of the observational vulnerabilities performed on one or more of the observational assets on which one or more of the observational security controls are present.
2 more elements
Dependencies are inferred from the claim text.