Patent ID: 8438643

Claim:
An apparatus comprising: a risk analyzer configured to identify one or more assets of an information system that have respective relationships with a service provided by the information system, and to determine one or more security risks to the service by analyzing effects of security vulnerabilities which are associated with the identified assets and are propagated to the service through the relationships; and an interface operatively coupled to the risk analyzer and configured to provide a consolidated representation of the service, the consolidated representation comprising an indication of the one or more determined security risks and an indication of at least one of the respective relationships between the service and the one or more identified assets, the indication of the one or more determined security risks comprising, for each determined security risk, an indication of an overall security state associated with the security risk and respective indications of a plurality of security sub-states comprising the overall security state, wherein at least one of the risk analyzer and the interface is implemented using hardware, wherein the one or more identified assets comprise an asset that has a relationship with the service only through a relationship with an asset that has a relationship with the service, wherein the indication of the one or more determined security risks comprises different representations of a security risk arising from a security vulnerability associated with an asset that has a relationship with the service and a security risk arising from a security vulnerability associated with an asset that has a relationship with the service only through a relationship with an asset that has a relationship with the service.