Overall risk in a system

A computer-implemented method for identifying an overall risk in at least part of an information technology system comprising:

• (a) identifying a plurality of individual risks for an information technology system, wherein each of the risks represent a security vulnerability for the information technology system;
• (b) associating, with a risk analysis program stored on a computer, each of the plurality of individual risks with a corresponding severity risk band in a risk echelon;
• and
• (c) determining, with the risk analysis program stored on the computer, an overall risk according to:
• determining a mean risk value of the highest severity risk band containing a risk;
• and,
• for each risk in the highest severity risk band, adding an incremental risk value to the mean risk value;
• wherein:
• the incremental risk value is determined according to an associated risk band for each of the individual risks of the risk echelon and a rank of each of the individual risks in the risk echelon.

A computer-implemented method for assessing a risk in at least part of an information technology system comprising:

• (a) inputting into a memory storage device an association of a plurality of risks identified in the information technology system to at least one corresponding severity band in a risk echelon by utilizing at least one computer having a risk analysis program, wherein each of the plurality of risks represent a security vulnerability for the information technology system;
• (b) adding to an initial overall risk value a value of one half of the difference between an upper limit of a highest severity band containing a risk and the initial overall risk value to determine, with the risk analysis program stored on the at least one computer, an intermediate overall risk value, the initial overall risk value being a lower limit of the highest severity band containing a risk;
• (c) for each additional risk in the highest severity band containing a risk, using the risk analysis program stored on the at least computer to add successively one-half of the difference between the upper limit of the highest severity band containing a risk and the intermediate overall risk value to re-determine the intermediate overall risk value, and assign a most recent risk from the highest severity band used to re-determine the intermediate overall risk value as a final risk;
• (d) for each additional risk in bands having a severity less than the severity of the highest severity band containing a risk, adding in series a proportioned value of one half of a difference between the upper limit of the highest severity band containing a risk and the intermediate overall risk value, wherein one-half of the difference is proportioned by a coefficient factor relative to the highest risk value, to re-determine the intermediate overall risk value with the risk analysis program and assigning the most recent risk from the bands having a severity less than the severity of the highest severity band containing a risk used to re-determine the intermediate overall risk value as the final risk;
• and
• (e) assigning the intermediate overall risk value determined for the final risk as the overall risk value for the system.

A computer-implemented method for assessing the overall risk in an information technology system comprising:

• utilizing a risk analysis program stored on at least one computer to enter into a memory device a plurality of risks in a system, wherein each risk is associated with a component, category or method of the system;
• associating the risks with at least one severity band in a risk echelon and storing said associations in the memory device;
• assigning a numerical value to each risk utilizing the at least one computer having the risk analysis program;
• determining, with the risk analysis program stored on the least one computer, a band limit value for the at least one severity band that indicates a risk limit value for the numerical value assigned to each risk associated with the at least one severity band;
• determining, with the risk analysis program stored on the at least one computer, a coefficient factor for each of the risks, wherein the coefficient factor is determined based on the band limit value of the associated severity band for the assigned risk value and a rank of the risk within the at least one severity band, each coefficient factor having a decreasing magnitude from a coefficient factor corresponding to a highest numerical value to a coefficient factor corresponding to a lowest numerical value;
• summing, with the risk analysis program stored on the at least one computer, each of the coefficient factors associated with said one of a component, category or method together to determine a coefficient factor summation;
• multiplying, with the risk analysis program stored on the at least one computer, the coefficient factor summation with a risk multiplicand to determine a risk product, wherein the risk multiplicand is defined as
• r
• i
• max
• -
• r
• i
• max
• -
• 1
• r
• i
• max
• +
• r
• i
• max
• -
• 1
• ,
• wherein;
• rimax is an upper band limit;
• rimax−1 is a lower band limit;
• adding, with the risk analysis program stored on the at least one computer, the risk product to a risk addend to determine the overall risk in the system for the said one of a component, category or method, where the risk addend is defined as rimax−1 and,
• outputting an indication of the overall risk for the said one of a component in a humanly readable form.

A system for conducting a risk assessment of a computer network system, the system comprising:

• at least one risk assessment database for storing risk assessment information associated with the computer network system, the risk assessment information being recorded in the risk assessment database through user input;
• at least one internet scanner database for storing risk assessment information associated with the computer network system and being generated by an automated vulnerability scanner, the at least one internet scanner database being configured to share computer network system risk information with the at least one risk assessment database for analysis of a vulnerability of the computer network system;
• a processor for determining an overall risk value associated with at least one component associated with the computer network system according to information in the internet scanner database and the at least one risk assessment database and computer network information, wherein the overall risk value is determined according to:
• R
• =
• r
• i
• max
• -
• 1
• +
• r
• i
• max
• -
• r
• i
• max
• -
• 1
• r
• i
• max
• +
• r
• i
• max
• -
• 1
• ×
• ∑
• k
• =
• 1
• 
• ⁢
• R
• ⁢
• 
• ⁢
• ⁢
• [
• r
• i
• ⁡
• (
• m
• k
• )
• -
• 1
• +
• r
• i
• ⁡
• (
• m
• k
• )
• 2
• k
• ]
• ,
• rimax is an upper band limit;
• rimax−1 is a lower band limit;
• mk is a risk assigned a rank k;
• i(mk) is a severity band of the risk assigned the rank k;
• ri is an upper band limit for the severity band i;
• ∥R∥ is a total number of risks;
• and,
• R is the overall risk value;
• a user computer for inputting risk assessment information to and for receiving risk assessment information from said risk assessment database;
• and
• an interface for displaying said overall risk value determined by said processor.