System and method for assessing risk to a collection of information resources

A system for assessing security of a subset of information resources, including one or more information resources, wherein the subset of information resources is a subset of a plurality of information resources, the system comprising a plurality of modules stored in non-transitory computer-readable media, the modules including:

• a classification module for classifying security determination factors;
• an assignment module for assigning values to the security determination factors;
• a factor determining module for associating each of the security determination factors with at least one security assessment factor wherein the at least one security assessment factor comprises at least one of:
• a threat factor associated with a rate or frequency of security events that threaten the plurality of information resources,
• a vulnerability factor associated with a likelihood of a security event breaching the security of the subset of information resources, and
• an impact factor associated with an expected cost of a breach of the security of the plurality of information resources;
• and
• for combining the security determination factors associated with the at least one security assessment factor to determine a security assessment factor value based on the values assigned to the security determination factors;
• and
• a security risk index determining module for
• determining a security risk index based at least in part on the at least one security assessment factor value wherein the security risk index represents a security of the subset of information resources, and
• certifying the security of the specific subset of information resources with the security risk index when a local security risk index of the specific subset of information resources reaches a predetermined certification level indicating that the specific subset of information resources associated with the entity is secure, wherein the certification level is indicated by a dynamic value determined in part by a general security risk index;
• a security risk index preciseness determining module for
• tallying a number of security determination factors associated with at least one security assessment factor;
• determining a security risk index preciseness value derived from the tallied number of security determination factors;
• determining a security risk index quality rating derived from the determined preciseness value;
• and
• generating an information resource security assessment report including correlation of the security risk index with the security risk index quality rating.

A system for assessing security of one or more information resources, the system comprising a plurality of modules stored in non-transitory computer-readable media, the modules including:

• a classification module for classifying security determination factors;
• an assignment module for assigning values to the security determination factors;
• a security assessment factor determining module for associating each of the security determination factors with at least one security assessment factor associated with the information resources wherein the at least one security assessment factor comprises at least one of a threat factor, a vulnerability factor and an impact factor, and for combining the security determination factors associated with the at least one security assessment factor to determine a security assessment factor value based on the values assigned to the security determination factors;
• a security risk index determining module for
• determining a security risk index based at least in part on the at least one security assessment factor value wherein the security risk index represents a security of the information resources, and
• certifying the security of the specific subset of information resources with the security risk index when a local security risk index of the specific subset of information resources reaches a predetermined certification level indicating that the specific subset of information resources associated with the entity is secure, wherein the certification level is indicated by a dynamic value determined in part by a general security risk index;
• a security risk index preciseness determining module for tallying a number of security determination factors associated with the at least one security assessment factor, determining a security risk index preciseness value derived from the tallied number of security determination factors, determining a security risk index quality rating derived from the determined preciseness value, and generating an information resource security assessment report including correlation of the security risk index with the security risk index quality rating;
• and
• a trigger module for detecting for the presence of a predetermined trigger wherein the at least one security assessment factor is updated upon the detection of the predetermined trigger by the trigger module and the security risk index based at least in part on the updated at least one security assessment factor is also updated.

A processor-implemented method for assessing security of a plurality of information resources, the method comprising:

• classifying security determination factors;
• assigning values to the security determination factors;
• associating each of the security determination factors with at least one security assessment factor wherein the at least one security assessment factor comprises at least one of:
• a threat factor associated with a rate or frequency of security events that threaten the plurality of information resources,
• a vulnerability factor associated with a likelihood of a security event breaching the security of information resources, and
• an impact factor associated with an expected cost of a breach of the security of the plurality of information resources;
• combining the security determination factors associated with the at least one security assessment factor to determine a security assessment factor value based on the values assigned to the security determination factors;
• determining, using a computer processor, a security risk index based at least in part on the at least one security assessment factor value wherein the security risk index represents a security of the plurality of information resources
• certifying the security of the specific subset of information resources with the security risk index when a local security risk index of the specific subset of information resources reaches a predetermined certification level indicating that the specific subset of information resources associated with the entity is secure, wherein the certification level is indicated by a dynamic value determined in part by a general security risk index;
• tallying a number of security determination factors associated with the at least one security assessment factor;
• determining a security risk index preciseness value derived from the tallied number of security determination factors;
• determining a security risk index quality rating derived from the determined preciseness value;
• and
• generating an information resource security assessment report including correlation of the security risk index with the security risk index quality rating.

A processor-implemented method for assessing security of a subset of information resources including one or more information resources, wherein the subset of information resources is a subset of a plurality of information resources, the method comprising:

• gathering security factor components pertaining to future security events from at least one of a chat room and a message board;
• classifying the security factor components as either internal factor components or external factor components;
• assigning values to classified security factor components based on historical correlation;
• associating each classified security factor to at least one security assessment factor, the security assessment factors including:
• a threat factor associated with a rate of security events threatening security of the plurality of information resources;
• a vulnerability factor associated with a probability that a security event will lead to a breach in security;
• and
• an impact factor associated with an expected cost of a breach of security;
• normalizing the classified security factor components to yield a plurality of normalized classified security factor components which may be combined;
• weighting the normalized classified security factor components to yield a plurality of weighted normalized classified security factor components, wherein the weighting of the normalized classified security factor components associated with the vulnerability factor is based on a past rate of success for a specific type of security event against the subset of information resources;
• combining values for the weighted classified security factor components associated with the threat factor to yield a threat factor value via Bayesian logic;
• combining values for the weighted classified security factor components associated with the vulnerability factor to yield a vulnerability factor value via Bayesian logic;
• combining values for the weighted classified security factor components associated with the impact factor to yield an impact factor value via Bayesian logic;
• determining, using a computer processor, a security risk index as a product between the threat factor value, the vulnerability factor value, and the impact factor value;
• certifying the security of the specific subset of information resources with the security risk index when a local security risk index of the specific subset of information resources reaches a predetermined certification level indicating that the specific subset of information resources associated with the entity is secure, wherein the certification level is indicated by a dynamic value determined in part by a general security risk index:
• tallying numbers of security factor components associated with each security assessment factor;
• determining a security risk index preciseness value derived from the tallied numbers of security factor components;
• determining a security risk index quality rating derived from the determined preciseness value;
• and
• generating an information resource security assessment report including correlation of the security risk index with the security risk index quality rating.