Patent Document ID: 7900259
Application ID: 11694659
Patent Status: 1

Claim One:
1. A computer-implemented method for technology risk assessment, comprising: receiving identifying information for multiple sets of at least one software process each, wherein each set is executed at a corresponding one of multiple computer devices; matching the identifying information to software characteristics associated with the software processes, wherein each software characteristic defines a property of an associated software process as a value within a range; identifying software characteristic values, wherein each software characteristic value is associated with one of a set of software characteristics of a software process, the set of software characteristics including at least respective user oriented, software oriented, system oriented and security oriented software characteristics, and wherein each software characteristic value reflects a degree of contribution to at least one of multiple security risk categories by the software process; receiving an identification of at least one technology control to be applied to a computer network formed by the computer devices; applying a modifier to the software characteristic value of at least one of the software characteristics of at least one of the software processes, the modifier being determined as a function of an extent to which the identified technology control increases or decreases the degree of contribution by the software process to the at least one of the security risk categories associated with the software characteristic; calculating risk indexes, at least one for each of the multiple security risk categories regarding each of the software processes, the risk indexes including at least respective confidentiality, data, reviewability, communication and security risk indexes, wherein for each software process each risk index is determined as a function of at least a subset of the software characteristic values of the software process, and wherein at least one of the subsets includes the modified software characteristic value; aggregating the risk index for each of the multiple security risk categories regarding each set of software processes into a risk index for each of the multiple security risk categories regarding each of the corresponding computer devices, wherein each aggregated risk index of each computer device is an average of the corresponding risk indexes of the set of software processes that are executed at the computer device; aggregating the risk index for each of the multiple security risk categories regarding each of the computer devices into a risk index for the computer network, wherein each aggregated risk index of the computer network is an average of the corresponding aggregated risk indexes of the computer devices; and presenting an enterprise risk assessment on a display device, wherein the enterprise risk assessment is based on the risk indexes for the software processes, the aggregated risk indexes for the computer devices, and the aggregated risk indexes for the computer network, wherein the enterprise risk assessment presents a distribution that shows a number of the computer devices that have particular aggregated risk index values for one or more of the multiple security risk categories, and wherein the enterprise risk assessment presents one or more of the aggregated risk indexes of the computer network as a mean and a standard deviation about the mean for the distribution.