Patent ID: 9747570
Date: 2017-08-29
CPC Classifications: G06F,G06Q,H04L

Claim:
1. A computer-implemented method of identifying and mitigating information security risks for at least one information system, the method comprising: selecting a model for identifying a quantitative residual risk of a risk scenario, wherein the model comprises a plurality of inputs, the inputs comprising a threat likelihood for the risk scenario, a business impact for the risk scenario, and a control effectiveness for the risk scenario, the risk scenario comprising a threat type and a targetable system; determining, with a processor, a plurality of assessment activities to apply, the determination of assessment activities being based on at least a determination of whether the at least one information system is vulnerable to the threat type; determining, with the processor, from the plurality of assessment activities, the threat likelihood of the risk scenario, the business impact for the risk scenario, and the control effectiveness of the risk scenario; generating, with the processor, from the model, the quantitative residual risk of the risk scenario; generating, with the processor, at least one recommendation for reducing the threat likelihood of the risk scenario by making at least one adjustment to the information system, the at least one adjustment being specifically identified in the at least one recommendation; transmitting, with the processor, the at least one recommendation to an operator of the at least one information system; and modifying the at least one information system by making the at least one adjustment; wherein determining the threat likelihood of the risk scenario comprises: determining a percentage of similar incidents, the percentage of similar incidents comprising a percentage of security incidents involving the threat type of the risk scenario being directed at the targetable system of the risk scenario, out of a total number of security incidents; determining a maximum incident percentage of security incidents involving any threat type and being directed at any targetable system, out of the total number of security incidents; multiplying the percentage of similar incidents by a scale value; and dividing the percentage of similar incidents by the maximum incident percentage to yield a threat likelihood of incidents value; wherein, representing the percentage of similar incidents as A, representing the scale value divided by the maximum incident percentage of security incidents involving any threat type and being directed at any targetable system as B, and the threat likelihood of incidents value as C, C=A×B.