Patent ID: 8135823

Claim:
A method of objectively assessing the security of a network, said method comprising: assigning a vulnerability risk level to each of a plurality of vulnerabilities found on the network, utilizing a computer; assigning a vulnerability risk level to each of a plurality of nodes on the network based on vulnerabilities found on each of the plurality of nodes; assigning an exposure risk level to each exposure found on the network; providing a security score that is dependent on at least the vulnerability risk levels of the vulnerabilities, the vulnerability risk levels of the nodes, and a number of nodes on the network; wherein the security score is at least dependent upon V, which is derived from a formula of form V=min (b,(cV h H h +dV m H m +eV l H l )/H n )), where V is a vulnerability loss, min(. . .) is a standard minimum function, V h is a number of high level vulnerabilities detected, H h , is a number of hosts on which high level vulnerabilities are detected, V m , is a number of medium level vulnerabilities detected, H m is a number of hosts on which medium level vulnerabilities are detected, V l is a number of low level vulnerabilities detected, H l is a number of hosts on which low level vulnerabilities are detected, and H n is a total number of hosts on the network.