Patent CA-3070685-A1 (CA)
Inventor: HURST JEREMY L
IPC: G06Q10/06
Filed: 2020-02-02
Abstract: Patent Description - Cyber risk segmentation, quantification and visualization methodology Abstract The invention is a method of performing dynamic system modeling to enable the automated measurement, calculation and representation of inherent and residual risks across an organization's set of assets and related attack surfaces and broader ecosystem (e.g. 3iri party service providers). This is based on defining a relational model representing the organization's most important assets (e.g. mission critical processes), attack surface (e.g.  applications and.  supporting infrastructure), controls, relevant threats, the associated logic enabling qualitative and quantitative risk scoring and the required data inputs (moving from one time entry to ongoing feeds to enable continuous monitoring). Background of the invention 1. Field of the invention a. This invention relates generally to cyber security as a sub-set of operational risk, and more particularly the measurement and presentation of cyber risk for an organization and related entities, be it a business segment/line of business, organization or business ecosystem. b. There are many urgently needed applications of this method, including: i. Providing efficient and consistent automated risk and control assessments that reduce manual effort and increase comparability (e.g. which business unit holds more inherent vs. residual risk) and lays the foundation for greater situational awareness via ongoing monitoring. ii. Enabling highly configurable, comprehensive and data driven views of inherent and residual risk that can be communicated to business, IT and information security professionals in both qualitative (e.g. heat map scoring) and quantifiable (e.g. dollar value) terms. One specific application would be the creation of a "digital twin" for risk management to visually depict an organization and show areas of higher risk(e.g. failure of a critical system leading to injury or loss of life) vs. lower risk (e.g. limited financial loss). iii. Allowing for dynamic and interactive planning of cyber security related initiatives - e.g. modelling what impact a given initiative will have the cyber resiliency of an organization, but expressed in terms of financial impact and return-on-investment (e.g. $2 million investment in new customer identity and management solution will lead to a potential risk reduction of $10 million dollars) 2. Description of the related art a) The measurement, quantification and representation of cyber risk is a relatively new and inconsistently defined practice, with the following observed issues:  i. First, while there are existing methods for defining, measuring and articulating risk through measurement of control conditions and assigning likelihood and impact, these methods do not formally relate the control conditions to the services and technology solutions of the organization (i.e. calculating the amount of coverage of protective controls such as data loss protection tools across all the endpoints of an organization), or to clearly state the financial impact of the data loss related to the failure of the control due to a threat actor compromising the endpoint. Put another way, there is no clearly defined methodology to align the threat (e.g. cyber criminals looking to steal data), surface (e.g. system endpoints such as a laptop), control (e.g. firewalls, data loss protection systems) and asset components (e.g. sensitive client data) in a consistent and practical manner.