Patent ID: 11930032
Assignee: nan
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC H

Claim 1:
2. The method of claim 1, wherein step a) comprises:
a. using expert judgment and open source threat intelligence, predefining a list of generic risk factors and grouping these into risk categories for “Assets”, “Data”, “Media”, “Staff”, “3rd Parties”, “Facilities”, “IT infrastructure”, and “Applications”;
b. using expert judgement and open source threat intelligence, pre-assigning a weighting factor wi for each risk factor i, which represents an estimate of the size of risk factor i relative to other factors in the same category;
c. using expert judgement, pre-assigning a set of declarative statements for each of said risk factors, which describe levels of minimal, moderate, and significant risk;
d. using expert judgement, pre-assigning a numerical value between 0 and 1 for each declarative statement, which represents an estimated risk rating rij for risk factor i and level j;
e. prompting the user with the choice of said declarative statements for each of said risk factors;
f. receiving the chosen response from the user and multiplying the risk rating rij for the chosen level j by the weighting factor pre-assigned for this risk factor wi, to establish an inherent risk score Ri for factor i, as in the formula Ri=wirij;
g. adding up the inherent risk scores for each risk category C and dividing by the maximum total inherent risk score for each category C to generate a normalized category inherent risk score, as in the formula RC=Σi=1nwirij/Σi=1nwi max(ri), where max(ri)=riSignificant and n is the number of risk factors in risk category C;
h. calculating a threat score T using the risk scores for the “Assets”, “Data”, and “Media” categories, and the formula, T
    =
    
      
        
          
            R
            Assets
          
          +
          
            R
            Data
          
        
        2
      
      *
      
        (
        
          0.5
          +
          
            0.5
            *
            
              R
              Media
            
          
        
        )
      
    
  
  ;

i. calculating a vulnerability score V using the risk scores for the “Staff”, “3rd Parties”, “Facilities”, “IT Infrastructure”, and “Applications” categories, and the formula, V
    =
    
      
        (
        
          
            
              
                
                  R
                  Staff
                
                +
                
                  R
                  
                    3
                    ⁢
                    
                      
                    
                    ⁢
                    rd
                    ⁢
                    
                      
                    
                    ⁢
                    Parties
                  
                
                +
                
                  R
                  Facilities
                
                +
              
            
          
          
            
              
                
                  R
                  
                    IT
                    ⁢
                    
                      
                    
                    ⁢
                    Infrastructure
                  
                
                +
                
                  R
                  Applications
                
              
            
          
        
        )
      
      5
    
  
  ;

j. calculating a consequence score C using the normalized inherent risk scores for the “Assets” and “Data” categories and the formula C=(RAssets+RData)/2;
k. calculating a normalized total inherent risk score RTotal using said scores for threat, vulnerability and consequence and the formula, R
      Total
    
    =
    
      
        (
        TVC
        )
      
      3
    
  
  ;

wherein the steps above are implemented using a computing device.