US 2026/0039680 A1Published application

Assessing security risk at scale for a computing environment

AssigneeOracle International Corporation

InventorsRobert Eugene Sandbothe, JR., Peter Albert Hewson, JR.

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques for assessing security risk at scale for a computing environment are disclosed. In an example method, a computing system accesses a risk model specified for a computing environment including at least a set of individual risk factors, a set of composite risk factors, and a final composite function for computing an overall risk score. The computing system receives a set of one or more inputs. The computing system computes an individual risk score for each individual risk factor using at least one input. The computing system computes a composite risk score for each composite risk factor. The computing system computes the overall risk score using the final composite function using at least two composite risk scores and outputs the overall risk score.

Claims20

Dependent claims

A method comprising:

accessing, by a Threat and Vulnerability Management Security System (TVMSS), a risk model specified for a first computing environment, the risk model including:
a set of individual risk factors;
a set of composite risk factors;
a final composite function for computing an overall risk score for the first computing environment;
for each individual risk factor in the set of individual risk factors:
an individual risk factor function associated with the individual risk factor used for computing an individual risk factor score for the individual risk factor;
and
one or more input parameters used by the individual risk factor function for computing the individual risk factor score;
and
for each composite risk factor in the set of composite risk factors:
a composite risk factor function associated with the composite risk factor used for computing a composite risk factor score for the composite risk factor;
and
at least two input parameters used by the composite risk factor function for computing the composite risk factor score;
receiving, by the TVMSS, a set of one or more inputs to the TVMSS;
for each individual risk factor in the set of individual risk factors, computing, by the TVMSS, the individual risk factor score using the individual risk factor function associated with the individual risk factor, wherein the one or more input parameters used by the individual risk factor function include at least one first input from the set of one or more inputs to the TVMSS;
for each composite risk factor in the set of composite risk factors, computing, by the TVMSS, the composite risk factor score using the composite risk factor function associated with the composite risk factor;
computing, by the TVMSS, the overall risk score for the first computing environment using the final composite function, wherein the final composite function uses at least two composite risk factor scores computed for at least two composite risk factors in the set of composite risk factors for computing the overall risk score;
and
outputting the overall risk score.

16 more elements

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

accessing, by a TVMSS, a risk model specified for a computing environment, the risk model including:
a set of individual risk factors;
a set of composite risk factors;
a final composite function for computing an overall risk score for the computing environment;
for each individual risk factor in the set of individual risk factors:
an individual risk factor function associated with the individual risk factor used for computing an individual risk factor score for the individual risk factor;
and
one or more input parameters used by the individual risk factor function for computing the individual risk factor score;
and
for each composite risk factor in the set of composite risk factors:
a composite risk factor function associated with the composite risk factor used for computing a composite risk factor score for the composite risk factor;
and
at least two input parameters used by the composite risk factor function for computing the composite risk factor score;
receiving, by the TVMSS, a set of one or more inputs to the TVMSS;
for each individual risk factor in the set of individual risk factors, computing, by the TVMSS, the individual risk factor score using the individual risk factor function associated with the individual risk factor, wherein the one or more input parameters used by the individual risk factor function include at least one input from the set of one or more inputs to the TVMSS;
for each composite risk factor in the set of composite risk factors, computing, by the TVMSS, the composite risk factor score using the composite risk factor function associated with the composite risk factor;
computing, by the TVMSS, the overall risk score for the computing environment using the final composite function, wherein the final composite function uses at least two composite risk factor scores computed for at least two composite risk factors in the set of composite risk factors for computing the overall risk score;
and
outputting the overall risk score.

16 more elements

A security system comprising:

one or more processors;
and
one or more computer-readable storage media storing instructions which, when executed by the one or more processors, cause the one or more processors to perform operations including:
accessing, by the security system, a risk model specified for a computing environment, the risk model including:
a set of individual risk factors;
a set of composite risk factors;
a final composite function for computing an overall risk score for the computing environment;
for each individual risk factor in the set of individual risk factors:
an individual risk factor function associated with the individual risk factor used for computing an individual risk factor score for the individual risk factor;
and
one or more input parameters used by the individual risk factor function for computing the individual risk factor score;
and
for each composite risk factor in the set of composite risk factors:
a composite risk factor function associated with the composite risk factor used for computing a composite risk factor score for the composite risk factor;
and
at least two input parameters used by the composite risk factor function for computing the composite risk factor score;
receiving, by the security system, a set of one or more inputs to the security system;
for each individual risk factor in the set of individual risk factors, computing, by the security system, the individual risk factor score using the individual risk factor function associated with the individual risk factor, wherein the one or more input parameters used by the individual risk factor function include at least one input from the set of one or more inputs to the security system;
for each composite risk factor in the set of composite risk factors, computing, by the security system, the composite risk factor score using the composite risk factor function associated with the composite risk factor;
computing, by the security system, the overall risk score for the computing environment using the final composite function, wherein the final composite function uses at least two composite risk factor scores computed for at least two composite risk factors in the set of composite risk factors for computing the overall risk score;
and
outputting the overall risk score.

19 more elements

Dependencies are inferred from the claim text.