Patent ID: 7613625

Claim:
A computer-implemented method for assessing a single value representative of an overall risk in at least part of an information technology system comprising: inputting into a risk assessment database a plurality of risks for an information technology system by utilizing at least one computer having a risk analysis program, wherein each of the risks represent a security vulnerability for the information technology system; associating the plurality of risks with at least one severity band in a risk echelon and storing said association in a memory storage device; assigning a risk value to each of the plurality of risks that represents a value of danger associated with the risk; for each of the plurality of risks, assigning a risk rank to the risk that indicates the magnitude of the risk value assigned to the risk; determining, with the risk analysis program stored on the at least one computer, a band limit value for the at least one severity band, wherein the band limit value indicates a risk limit value for the risk values associated with the at least one severity band; for each of the plurality of risks, determining, with the risk analysis program stored on the at least one computer, a corresponding coefficient factor based on the assigned risk rank and the band limit value for the at least one severity band associated with the risk, each coefficient factor having a decreasing magnitude from a coefficient factor corresponding to a highest risk value to a coefficient factor corresponding to a lowest risk value; summing, with the risk analysis program stored on the at least one computer, each of the corresponding coefficient factors together to determine a coefficient factor summation; multiplying, with the risk analysis program stored on the at least one computer, the coefficient factor summation with a risk multiplicand to determine a risk product, wherein the risk multiplicand is defined as r i max - r i max - 1 r i max + r i max - 1 , wherein: r i max is an upper band limit; r i max −1 is a lower band limit; adding, with the risk analysis program stored on the at least one computer, the risk product to a risk addend to determine the overall risk, where the risk addend is defined as r i max −1 and, outputting an indication of the overall risk.