WO2000008543A9 - Adaptive countermeasure selection method and apparatus - Google Patents
Adaptive countermeasure selection method and apparatusInfo
- Publication number
- WO2000008543A9 WO2000008543A9 PCT/US1999/017575 US9917575W WO0008543A9 WO 2000008543 A9 WO2000008543 A9 WO 2000008543A9 US 9917575 W US9917575 W US 9917575W WO 0008543 A9 WO0008543 A9 WO 0008543A9
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- countermeasure
- strength level
- determining
- application
- level
- Prior art date
Links
- 238000010187 selection method Methods 0.000 title description 3
- 230000003044 adaptive effect Effects 0.000 title description 2
- 238000000034 method Methods 0.000 claims abstract description 51
- 230000008520 organization Effects 0.000 claims abstract description 46
- 230000004044 response Effects 0.000 claims description 7
- 238000012546 transfer Methods 0.000 claims description 4
- 238000004891 communication Methods 0.000 description 16
- 230000006870 function Effects 0.000 description 12
- 238000003860 storage Methods 0.000 description 8
- 238000012549 training Methods 0.000 description 7
- 230000003287 optical effect Effects 0.000 description 5
- 230000000694 effects Effects 0.000 description 4
- 238000007726 management method Methods 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 230000004224 protection Effects 0.000 description 4
- 238000012502 risk assessment Methods 0.000 description 4
- 230000005540 biological transmission Effects 0.000 description 3
- 230000006378 damage Effects 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 230000009471 action Effects 0.000 description 2
- 238000006243 chemical reaction Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 238000009826 distribution Methods 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 230000007246 mechanism Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- RYGMFSIKBFXOCR-UHFFFAOYSA-N Copper Chemical compound [Cu] RYGMFSIKBFXOCR-UHFFFAOYSA-N 0.000 description 1
- 238000012550 audit Methods 0.000 description 1
- 238000003339 best practice Methods 0.000 description 1
- 230000001010 compromised effect Effects 0.000 description 1
- 230000008878 coupling Effects 0.000 description 1
- 238000010168 coupling process Methods 0.000 description 1
- 238000005859 coupling reaction Methods 0.000 description 1
- 230000002354 daily effect Effects 0.000 description 1
- 238000012217 deletion Methods 0.000 description 1
- 230000037430 deletion Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000003203 everyday effect Effects 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 238000009472 formulation Methods 0.000 description 1
- 238000009434 installation Methods 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000002620 method output Methods 0.000 description 1
- 239000000203 mixture Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000035515 penetration Effects 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 238000011084 recovery Methods 0.000 description 1
- 238000012552 review Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/577—Assessing vulnerabilities and evaluating computer system security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/102—Entity profiles
Definitions
- This invention relates generally to information security and, more particularly, to improved methods and apparatus for selecting information security solutions based on a multitude of parameters.
- firewalls are a combination of hardware and software that limits the exposure of a computer or group of computers to attacks from the outside.
- Firewalls provide a single point of entry to protect network resources from unauthorized access.
- a firewall may comprise, for example, application proxies, access control lists, logging capabilities, or filtering. Relying solely on firewall perimeter protection is often inadequate.
- firewalls frequently hinder business plans to communicate electronically between customers, suppliers, and business partners.
- Other existing security countermeasures include password protection, encryption, and fireridges.
- a fireridge is essentially a limited firewall operating on an internal network, such as an intranet, and can contain filters, application proxies, and other means for shielding computers from other computers on the internal network.
- the security of large co ⁇ orate networks is particularly challenging to assess for many reasons.
- the networks may have hundreds of different applications systems and servers, thousands of user accounts, and exchange billions of bytes of information with the Internet every day.
- the sheer volume of users and transactions make it more difficult to design and monitor a secure architecture.
- the process of inventorying an organization's application systems, the current level of security measures implemented by the organization, and even the applications architecture can be a daunting task.
- the information is difficult to keep current with the dynamism of the co ⁇ oration is a difficult task.
- systems and methods consistent with the present invention create a security model for an organization operating an application on a computer network to protect the application from attack by unauthorized sources.
- a current countermeasure strength level and a recommended countermeasure strength level are determined for each of at least one countermeasure based on input data and security risk data.
- a security model including at least one countermeasure and a corresponding strength level is determined based on the current and the recommended strength levels.
- Fig. 1 is a flow diagram representing states of a method consistent with the present invention.
- Fig. 2 is an example of a questionnaire consistent with the present invention
- Figs. 3a and 3b are tables showing parameters consistent with the present invention
- Fig. 4 is an example of a data base of rules consistent with the present invention.
- Fig. 5 is an example of rules for handling exception conditions consistent with the present invention
- Fig. 6 shows an example of information security policies consistent with the present invention
- Fig. 7 shows a block diagram of a system consistent with the present invention.
- Figure 1 is a flowchart showing states of a method consistent with the present invention. Some aspects of the following method will vary depending on the nature of the activities of an organization being evaluated. The following example describes an organization whose principle activity is the manufacture and development of computer systems.
- the organization begins by determining the business concerns of the organization (state 100).
- the set C of business concerns include specific consequences against which an organization would like to protect its application assets including, for example, loss of market share, system outage or unavailability, loss of property, and damage to reputation.
- the actual types of business concerns may vary depending in part on the activities of the organization being evaluated.
- Application assets are any software programs and associated information data bases that carry out a useful task including transaction systems, database managers, spreadsheets, communications packages, and document processors. Some other examples of application assets are, for example, the software for managing general ledger data, distribution, and product tracking.
- the organization must also determine the types of attacks that the organization may be subject to and corresponding countermeasures that may be implemented to avert those attacks (state 105).
- the set T of attack types includes but is not limited to, for example, unauthorized access to and use of confidential business information, unauthorized deletion, destruction or modification of data records, and interruption or denial of service.
- the set M of countermeasures may include, for example, employing a person (such as an account or security administrator to oversee security measures), implementing a technique (such as password protection, event logging, or authentication), or a installing a device (such as a particular secure network configuration). Attack and countermeasure types may also vary depending on the application being evaluated, the type of business concerns, and the organization's co ⁇ orate and computing architecture.
- information is gathered that describes the application assets and system architecture of the organization, details about daily operations, and the countermeasures employed at the time of assessment (state 110).
- this information is obtained by using a questionnaire that is answered by personnel familiar with the organization's operations, although other mechanisms for obtaining the information may be used such as, for example, automated interrogation of computer configurations and networked security services.
- the questionnaire is tailored to solicit information consistent with the parameters identified above. For example, if co ⁇ orate training is identified as a countermeasure, then the questionnaire will ask questions such as how often training is performed, what type of training is given, and who delivers the training.
- a questionnaire consistent with the present invention is shown in Fig. 2.
- the identified parameters are used to generate two parameter tables as shown in of Figs. 3 A and 3B (state 115).
- Table 1 of Fig. 3 A shows identified business concerns in the lefthand column and attack types across the top.
- Each table entry, ⁇ 10 represents the probability that business concern, cradically will result from attack t,. determined by independent security councils of security consulting organizations or from existing data from actual business practice.
- Table 2 of Fig. 3B is a vulnerability profile showing the set of countermeasures in the left hand column and attack types across the top.
- Each table entry, g, 0 represents the probability that countermeasure, mitate will avert attack type, t,.
- the probabilities may be determined by independent security councils of security consulting organizations or from existing data from actual business practice.
- one or more rule data bases are constructed for inte ⁇ reting the information gathered in state 110 (state 120).
- the rule data bases may be constructed, for example, as rules for use in determining current and recommended countermeasure strength levels.
- Rule Base A in Fig. 4 is an example of a rule data base consistent with the present invention.
- Rule Base A reduces the user input on a questionnaire to a numeric value indicating the current countermeasure strength level.
- countermeasures are listed in the lefthand column.
- the columns marked “Level 1", “Level 2", etc., indicate the various levels of implementation of a countermeasure.
- Each of the boxes in the body of the table contains logical rules that determine the current level of a countermeasure for a given application as implemented by the organization. For example, in box 401, if the answer to question 1.1 on the questionnaire is 1.1.1 (no), "Policy Awareness” is accorded a Level 1. As shown in box 402, if the answer to question 2.1 is 2.1.2(yes) and the answer to question 2.2 is 2.2.3(item c), then countermeasure "Co ⁇ orate Security Awareness” is accorded "Level 4.” *
- Rule Base B may include, for example, rules for including or excluding various operating system services, such as authentication modules or I/O devices. Rule Base B may also include rules for identifying conditions that may require increasing existing countermeasure strengths, such as organization size or connections to insecure networks such as the Internet. Organization size may include number of employees, users, computers, and connections. Rule Base B may also contain rules for recognizing that combinations of certain countermeasures are indicated and for adjusting countermeasure effectiveness accordingly. In general, Rule Base B identifies special conditions that may require special actions, such as an engineering review, legal action, or additional physical security.
- v a maximum loss factor of the loss to the organization if loss of the current application asset results in the business concern c.
- the loss estimate includes such factors as cost to restore, recover, or rebuild the lost or damaged application asset or to recover from the side effects caused by compromise of the application asset, such as loss of market share, loss of revenue from crippled manufacturing operations and loss of intellectual property revenue.
- V the business concern that would result in the greatest loss if this application asset was compromised is identified.
- the maximum value v, for this application asset is submitted to the function f, to obtain a maximum loss factor, V.
- V may be represented mathematically as follows:
- v is the monetary value of the loss of the i th business concern identified for the current application asset and/ is a conversion function that returns a value factor depending on the maximum loss corresponding to a business concern.
- v is the monetary value of the loss of the i th business concern identified for the current application asset and/ is a conversion function that returns a value factor depending on the maximum loss corresponding to a business concern.
- / may be the following function:
- the outputted numeric factor acts to decrease or increase the required effectiveness level based on the application asset's potential recovery cost, replacement loss, and/or other damage created by the attack. Factors consistent with the present invention, such as the factors in the example above, will likely be developed by a panel of security experts and depend on the organization type.
- the method determines current and recommended strength levels. Current strength level is the level of a countermeasure that the organization was employing at the time of assessment. Current strength level of the n th countermeasure, H n is determined using Rule Base A compiled in state 120 and described above (state 130). For example, referring again to Fig. 4, for the countermeasure "Policy Awareness" with reference
- a n e represents the probability that a particular countermeasure, m n , will prevent all types of attack for a specific business concern, c e .
- a n e may be computed as follows:
- the quantity g n i is the probability that employing countermeasure m n will avert attack t ( as shown in Table 1 in Figure 3A.
- the quantity ⁇ e i is the probability that attack t e will cause business concern c f as shown in Table 2 of Figure 3B.
- the constant k is a constant designed to establish the numerical range of A.
- the maximum effectiveness, S n of using a particular countermeasure m n to avert all attack types is determined in state 140.
- S n equals the maximum value that results from multiplying each Atechnisch e by the maximum loss factor, V.
- S n may be represented mathematically as follows:
- P n is the recommended strength level for the n th countermeasure (state 145).
- Function f 2 is a conversion function that accepts as input, S n , the maximum effectiveness of a particular countermeasure, and returns an ordinal value representing a recommended countermeasure strength level.
- the function f 2 (n,S n ) results in an value corresponding with a countermeasure strength level for countermeasure n and differs depending on the number of possible strength levels for the n th countermeasure. For example, if countermeasure 12 has two possible strength levels, f 2 (12,S n ) will output a value of 1 or 2. If four strength levels are possible for countermeasure 25, f 2 (25,S n ) will output a value of 1, 2, 3, or 4.
- the current effectiveness level of the current policy, ⁇ n for each countermeasure is determined using a third function, f 3 , that uses current strength level, H n , as input (state 150). Current policy effectiveness may be represented mathematically as follows:
- a n S H f 3 ( n , H,,)
- f 3 returns a ordinal value corresponding to the relative effectiveness of the countermeasure strength level such as in the example below.
- each of the countermeasures in the examples was assumed to have a linear distribution.
- the function f 3 for each countermeasure may also be adjusted for nonlinearity of the relative effectiveness of the strength levels of the countermeasures depending on the implementation.
- Recommended policy effectiveness, ⁇ n for countermeasure m n is also determined using the third function, f 3 , with recommended strength level, P n as input (state 155).
- Recommended policy effectiveness, ⁇ n may be represented mathematically as:
- an implementation cost N n is computed using recommended strength level, P n (state 157).
- Implementation cost N n is the estimated cost to implement the n th countermeasure at level P n .
- Countermeasure efficiency Q n for the n th countermeasure can then be calculated as follows (state 159):
- ⁇ n and N n are the recommended strength level and implementation cost for the n th countermeasure.
- Countermeasure efficiency is useful for selecting between countermeasures of approximately the same effectiveness. A higher efficiency will show a greater payback for a given investment.
- the level of conformance to recommended security policies is calculated (state 170).
- the level of conformance of the application system at the time of assessment, or application risk is the difference between current strength level effectiveness and recommended strength level effectiveness of the countermeasures.
- only the positive differences between current and recommended strength levels are considered.
- the method does not give credit for "overachieving” or, in other words, implementing security procedures that are well above what is considered necessary to be effective. Overachieving can be costly and add unnecessarily to program expenditures.
- the level of conformance is calculated as follows:
- a high ⁇ , or conformance value indicates a secure application system.
- the conformance value also quantifies the difference between the current security level policy and security policies established by industry best practices and, indirectly, the amount of the applications vulnerability, or risk.
- a total amount of risk to the organization may be estimated by computing the weighted average of multiple application conformance values, weighted by the proportional value of each application to the organization's total application systems value.
- Fig. 5 is an example of additional rules consistent with the present invention that may constitute Rule Base B.
- any of the processors in the application system serve multiple functions, such as serving both as a file transfer server and a gateway, some of the countermeasures and recommended countermeasures may need to be adjusted. Additionally, some countermeasure strengths may need to be adjusted if the size of the user population exceeds a designated threshold.
- Organizations with user populations over a threshold may want to initiate more formal account management procedures such as periodic mandatory password changes, formal procedures for terminated or inactive accounts, or central password administration.
- An exception condition possibly warranting special attention is number and value of transactions processed by the application. If, for example, the application is used to access bank account data or make large payments, the organization may want to employ added security protections such as formalized configuration management, compartmentalizing data, special audit procedures, or requiring a minimum of two people acknowledge changes to the application code. Applications that are operated on network devices that are physically located in multiple geographic locations may also require special attention. Exception conditions may also take into consideration exceptional costs of implementation, such as licensing, training, installation and development costs.
- the method outputs a written report (state 180).
- the reports may contain specifications of both the current and recommended level of countermeasure implementation.
- Computer system 700 includes a bus 702 or other communication mechanism for communicating information, and a processor 704 coupled with bus 702 for processing information.
- Computer system 700 also includes a memory 706, which can be a random access memory (RAM) or other dynamic storage device, coupled to bus 702 for storing information, such as the parameter tables, rule data bases, and questionnaire, and instructions to be executed by processor 704.
- Memory 706 also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor 704.
- Computer system 700 further includes a read only memory (ROM) 708 or other static storage device coupled to bus 702 for storing static information and instructions for processor 704.
- ROM read only memory
- a storage device 710 such as a magnetic disk or optical disk, is provided and coupled to bus 702 for storing information and instructions.
- Computer system 700 may be coupled via bus 702 to a display 712, such as a cathode ray tube (CRT) or liquid crystal display (LCD), for displaying information to a computer user.
- a display 712 such as a cathode ray tube (CRT) or liquid crystal display (LCD)
- An input device 714 is coupled to bus 702 for communicating information and command selections to processor 704.
- cursor control 716 is Another type of user input device, such as a mouse, a trackball or cursor direction keys for communicating direction information and command selections to processor 704 and for controlling cursor movement on display 712.
- This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane.
- An embodiment of the present invention uses a computer system 700 for selecting a security model. Consistent with one implementation of the invention, information from the multiple remote resources is provided by computer system 700 in response to processor 704 executing one or more sequences of one or more instructions contained in memory 706. Such instructions may be read into memory 706 from another computer-readable medium, such as storage device 710. Execution of the sequences of instructions contained in memory 706 causes processor 704 to perform the process states described herein.
- hard-wired circuitry may be used in place of or in combination with software instructions to implement the invention. Thus implementations of the invention are not limited to any specific combination of hardware circuitry and software.
- Non-volatile media includes, for example, optical or magnetic disks, such as storage device 710.
- Volatile media includes dynamic memory, such as memory 706.
- Transmission media includes coaxial cables, copper wire, and fiber optics, including the wires that comprise bus 702. Transmission media can also take the form of acoustic or light waves, such as those generated during radio-wave and infra-red data communications.
- Computer-readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, a CD-ROM, any other optical medium, punch cards, papertape, any other physical medium with patterns of holes, a RAM, PROM, and EPROM, a FLASH-EPROM, any other memory chip or cartridge, a carrier wave as described hereinafter, or any other medium from which a computer can read.
- Various forms of computer readable media may be involved in carrying one or more sequences of one or more instructions to processor 704 for execution.
- the instructions may initially be carried on magnetic disk of a remote computer.
- the remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem.
- a modem local to computer system 700 can receive the data on the telephone line and use an infra-red transmitter to convert the data to an infra-red signal.
- An infra-red detector coupled to bus 702 can receive the data carried in the infra-red signal and place the data on bus
- Bus 702 carries the data to memory 706, from which processor 704 retrieves and executes the instructions.
- the instructions received by memory 706 may optionally be stored on storage device 710 either before or after execution by processor 704.
- Computer system 700 also includes a communication interface 718 coupled to bus 702.
- Communication interface 718 provides a two-way data communication coupling to a network link 720 that is connected to local network 722.
- communication interface 718 may be an integrated services digital network (ISDN) card, a cable modem, or a modem to provide a data communication connection to a corresponding type of telephone line.
- ISDN integrated services digital network
- communication interface 718 may be a local area network (LAN) card provide a data communication connection to a compatible LAN.
- LAN local area network
- Wireless links may also be implemented.
- communication interface 718 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.
- Network link 720 typically provides data communication through one or more networks to other data devices.
- network link 720 may provide a connection through local network 722 to a host computer 724 and/or to data equipment operated by an Internet Service Provider (ISP) 726.
- ISP 726 in turn provides data communication services through the Internet 728.
- Local network 722 and Internet 728 both use electric, electromagnetic, or optical signals that carry digital data streams.
- the signals through the various networks and the signals on network link 720 and through communication interface 718, which carry the digital data to and from computer system 700, are exemplary forms of carrier waves transporting the information.
- Computer system 700 can send messages and receive data, including program code, through the network(s), network link 720 and communication interface 718.
- a server 730 might transmit a requested code for an application program through Internet 728, ISP 726, local network 722 and communication interface 718.
- one such downloaded application allows a user to select security countermeasures and countermeasure strength levels, as described herein.
- the received code may be executed by processor
- computer system 700 may obtain application code in the form of a carrier wave.
- computer system 700 is shown in Fig. 7 as being connectable to one server, 730, those skilled in the art will recognize that computer system 700 may establish connections to multiple servers on Internet 728. Additionally, it is possible to implement methods consistent with the principles of the present invention on other device comprising at least a processor, memory, and a display, such as a personal digital assistant.
Abstract
Description
Claims
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
AT99946583T ATE233918T1 (en) | 1998-08-05 | 1999-08-04 | ADAPTABLE ARRANGEMENT AND ADAPTABLE METHOD FOR SELECTING COUNTERMEASURES |
AU58969/99A AU5896999A (en) | 1998-08-05 | 1999-08-04 | Adaptive countermeasure selection method and apparatus |
DE69905726T DE69905726T2 (en) | 1998-08-05 | 1999-08-04 | ADAPTABLE ARRANGEMENT AND ADAPTABLE METHOD FOR SELECTING COUNTER MEASURES |
EP99946583A EP1101159B1 (en) | 1998-08-05 | 1999-08-04 | Adaptive countermeasure selection method and apparatus |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US09/129,626 | 1998-08-05 | ||
US09/129,626 US6374358B1 (en) | 1998-08-05 | 1998-08-05 | Adaptive countermeasure selection method and apparatus |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2000008543A1 WO2000008543A1 (en) | 2000-02-17 |
WO2000008543A9 true WO2000008543A9 (en) | 2000-08-03 |
Family
ID=22440855
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US1999/017575 WO2000008543A1 (en) | 1998-08-05 | 1999-08-04 | Adaptive countermeasure selection method and apparatus |
Country Status (6)
Country | Link |
---|---|
US (2) | US6374358B1 (en) |
EP (1) | EP1101159B1 (en) |
AT (1) | ATE233918T1 (en) |
AU (1) | AU5896999A (en) |
DE (1) | DE69905726T2 (en) |
WO (1) | WO2000008543A1 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9009321B2 (en) | 2007-01-24 | 2015-04-14 | Mcafee, Inc. | Multi-dimensional reputation scoring |
US9544272B2 (en) | 2007-01-24 | 2017-01-10 | Intel Corporation | Detecting image spam |
Families Citing this family (99)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6374358B1 (en) * | 1998-08-05 | 2002-04-16 | Sun Microsystems, Inc. | Adaptive countermeasure selection method and apparatus |
US7272855B1 (en) | 1999-06-08 | 2007-09-18 | The Trustees Of Columbia University In The City Of New York | Unified monitoring and detection of intrusion attacks in an electronic system |
US7013296B1 (en) | 1999-06-08 | 2006-03-14 | The Trustees Of Columbia University In The City Of New York | Using electronic security value units to control access to a resource |
US7140039B1 (en) | 1999-06-08 | 2006-11-21 | The Trustees Of Columbia University In The City Of New York | Identification of an attacker in an electronic system |
JP4084914B2 (en) * | 1999-09-29 | 2008-04-30 | 株式会社日立製作所 | Security evaluation method and apparatus, security measure creation support method and apparatus |
JP2001273388A (en) * | 2000-01-20 | 2001-10-05 | Hitachi Ltd | System and method for security management |
US6484173B1 (en) * | 2000-02-07 | 2002-11-19 | Emc Corporation | Controlling access to a storage device |
US6925443B1 (en) * | 2000-04-26 | 2005-08-02 | Safeoperations, Inc. | Method, system and computer program product for assessing information security |
US20040034794A1 (en) * | 2000-05-28 | 2004-02-19 | Yaron Mayer | System and method for comprehensive general generic protection for computers against malicious programs that may steal information and/or cause damages |
JP2002056176A (en) * | 2000-06-01 | 2002-02-20 | Asgent Inc | Method and device for structuring security policy and method and device for supporting security policy structuring |
WO2002019097A1 (en) * | 2000-09-01 | 2002-03-07 | International Interactive Commerce, Ltd. | System and method for collaboration using web browsers |
US8515783B1 (en) * | 2000-11-06 | 2013-08-20 | Swiss Reinsurance Company Ltd. | Risk assessment method |
AU2002243763A1 (en) * | 2001-01-31 | 2002-08-12 | Internet Security Systems, Inc. | Method and system for configuring and scheduling security audits of a computer network |
US8140415B2 (en) * | 2001-03-20 | 2012-03-20 | Goldman Sachs & Co. | Automated global risk management |
US8069105B2 (en) | 2001-03-20 | 2011-11-29 | Goldman Sachs & Co. | Hedge fund risk management |
US7958027B2 (en) | 2001-03-20 | 2011-06-07 | Goldman, Sachs & Co. | Systems and methods for managing risk associated with a geo-political area |
US8121937B2 (en) | 2001-03-20 | 2012-02-21 | Goldman Sachs & Co. | Gaming industry risk management clearinghouse |
US8209246B2 (en) | 2001-03-20 | 2012-06-26 | Goldman, Sachs & Co. | Proprietary risk management clearinghouse |
US7287280B2 (en) * | 2002-02-12 | 2007-10-23 | Goldman Sachs & Co. | Automated security management |
US7899722B1 (en) | 2001-03-20 | 2011-03-01 | Goldman Sachs & Co. | Correspondent bank registry |
US8234156B2 (en) * | 2001-06-28 | 2012-07-31 | Jpmorgan Chase Bank, N.A. | System and method for characterizing and selecting technology transition options |
US20030084349A1 (en) * | 2001-10-12 | 2003-05-01 | Oliver Friedrichs | Early warning system for network attacks |
US7836503B2 (en) * | 2001-10-31 | 2010-11-16 | Hewlett-Packard Development Company, L.P. | Node, method and computer readable medium for optimizing performance of signature rule matching in a network |
US7281020B2 (en) * | 2001-12-12 | 2007-10-09 | Naomi Fine | Proprietary information identification, management and protection |
AU2003205537A1 (en) * | 2002-01-10 | 2003-07-24 | Neupart Aps | Information security awareness system |
US8256002B2 (en) * | 2002-01-18 | 2012-08-28 | Alcatel Lucent | Tool, method and apparatus for assessing network security |
US7937326B1 (en) * | 2002-02-20 | 2011-05-03 | The Standard Register Company | Document security protection analysis assistant |
US8561167B2 (en) | 2002-03-08 | 2013-10-15 | Mcafee, Inc. | Web reputation scoring |
US20060015942A1 (en) | 2002-03-08 | 2006-01-19 | Ciphertrust, Inc. | Systems and methods for classification of messaging entities |
US20030233575A1 (en) * | 2002-06-12 | 2003-12-18 | Kimmo Syrjanen | Method of analysing level of information security in an organization |
US7930753B2 (en) * | 2002-07-01 | 2011-04-19 | First Data Corporation | Methods and systems for performing security risk assessments of internet merchant entities |
US20040117283A1 (en) * | 2002-07-17 | 2004-06-17 | Germack Victor F.. | Methods and systems for rating financial reporting of public companies and rating the performance of accounting firms |
US20040133439A1 (en) * | 2002-08-21 | 2004-07-08 | Dirk Noetzold | Method and system for valuation of complex systems, in particular for corporate rating and valuation |
US20050177415A1 (en) * | 2002-10-08 | 2005-08-11 | Mann Michael M. | Business analysis and management systems utilizing emergent structures |
US7848941B2 (en) * | 2002-10-08 | 2010-12-07 | Encompass Knowledge Systems, Inc. | Business analysis and management systems utilizing enterprise metrics |
US8909926B2 (en) * | 2002-10-21 | 2014-12-09 | Rockwell Automation Technologies, Inc. | System and methodology providing automation security analysis, validation, and learning in an industrial controller environment |
US20040107345A1 (en) * | 2002-10-21 | 2004-06-03 | Brandt David D. | System and methodology providing automation security protocols and intrusion detection in an industrial controller environment |
US20040153171A1 (en) * | 2002-10-21 | 2004-08-05 | Brandt David D. | System and methodology providing automation security architecture in an industrial controller environment |
US9009084B2 (en) | 2002-10-21 | 2015-04-14 | Rockwell Automation Technologies, Inc. | System and methodology providing automation security analysis and network intrusion protection in an industrial environment |
US20040103317A1 (en) * | 2002-11-22 | 2004-05-27 | Burns William D. | Method and apparatus for protecting secure credentials on an untrusted computer platform |
US7051322B2 (en) | 2002-12-06 | 2006-05-23 | @Stake, Inc. | Software analysis framework |
US7281270B2 (en) * | 2003-04-01 | 2007-10-09 | Lockheed Martin Corporation | Attack impact prediction system |
US20040250121A1 (en) * | 2003-05-06 | 2004-12-09 | Keith Millar | Assessing security of information technology |
US20050050346A1 (en) * | 2003-08-28 | 2005-03-03 | Felactu Odessa John | Dynamic comprehensive global enterprise defensive security system |
US8214906B2 (en) * | 2003-10-21 | 2012-07-03 | International Business Machines Corporation | System, method and program product to determine security risk of an application |
US8566945B2 (en) * | 2004-02-11 | 2013-10-22 | Hewlett-Packard Development Company, L.P. | System and method for testing web applications with recursive discovery and analysis |
US20060282494A1 (en) * | 2004-02-11 | 2006-12-14 | Caleb Sima | Interactive web crawling |
US7765597B2 (en) * | 2004-02-11 | 2010-07-27 | Hewlett-Packard Development Company, L.P. | Integrated crawling and auditing of web applications and web content |
US7974894B2 (en) * | 2004-03-05 | 2011-07-05 | Institutional Shareholder Services Inc. | Methods and systems for classifying entities according to metrics of earnings quality |
US8762191B2 (en) | 2004-07-02 | 2014-06-24 | Goldman, Sachs & Co. | Systems, methods, apparatus, and schema for storing, managing and retrieving information |
US8996481B2 (en) | 2004-07-02 | 2015-03-31 | Goldman, Sach & Co. | Method, system, apparatus, program code and means for identifying and extracting information |
US8442953B2 (en) | 2004-07-02 | 2013-05-14 | Goldman, Sachs & Co. | Method, system, apparatus, program code and means for determining a redundancy of information |
US8510300B2 (en) | 2004-07-02 | 2013-08-13 | Goldman, Sachs & Co. | Systems and methods for managing information associated with legal, compliance and regulatory risk |
US20060018478A1 (en) * | 2004-07-23 | 2006-01-26 | Diefenderfer Kristopher G | Secure communication protocol |
US8171555B2 (en) | 2004-07-23 | 2012-05-01 | Fortinet, Inc. | Determining technology-appropriate remediation for vulnerability |
US7665119B2 (en) | 2004-09-03 | 2010-02-16 | Secure Elements, Inc. | Policy-based selection of remediation |
US7761920B2 (en) | 2004-09-03 | 2010-07-20 | Fortinet, Inc. | Data structure for policy-based remediation selection |
US7774848B2 (en) * | 2004-07-23 | 2010-08-10 | Fortinet, Inc. | Mapping remediation to plurality of vulnerabilities |
US7703137B2 (en) * | 2004-09-03 | 2010-04-20 | Fortinet, Inc. | Centralized data transformation |
US7672948B2 (en) * | 2004-09-03 | 2010-03-02 | Fortinet, Inc. | Centralized data transformation |
US7657942B2 (en) * | 2005-01-11 | 2010-02-02 | International Business Machines Corporation | Method of assuring enterprise security standards compliance |
US8460079B2 (en) * | 2005-02-25 | 2013-06-11 | Ernie Smith | Pari-mutuel wagering apparatus and method |
CN101156149A (en) * | 2005-02-25 | 2008-04-02 | 阿尔尼·史密斯 | Pari-mutuel wagering system |
US20070157311A1 (en) * | 2005-12-29 | 2007-07-05 | Microsoft Corporation | Security modeling and the application life cycle |
US7890315B2 (en) * | 2005-12-29 | 2011-02-15 | Microsoft Corporation | Performance engineering and the application life cycle |
US20070192344A1 (en) * | 2005-12-29 | 2007-08-16 | Microsoft Corporation | Threats and countermeasures schema |
US7818788B2 (en) * | 2006-02-14 | 2010-10-19 | Microsoft Corporation | Web application security frame |
US7712137B2 (en) * | 2006-02-27 | 2010-05-04 | Microsoft Corporation | Configuring and organizing server security information |
US7891003B2 (en) * | 2006-06-14 | 2011-02-15 | Microsoft Corporation | Enterprise threat modeling |
US20080077976A1 (en) * | 2006-09-27 | 2008-03-27 | Rockwell Automation Technologies, Inc. | Cryptographic authentication protocol |
US8613080B2 (en) | 2007-02-16 | 2013-12-17 | Veracode, Inc. | Assessment and analysis of software security flaws in virtual machines |
US9069967B2 (en) | 2007-02-16 | 2015-06-30 | Veracode, Inc. | Assessment and analysis of software security flaws |
US20100281248A1 (en) * | 2007-02-16 | 2010-11-04 | Lockhart Malcolm W | Assessment and analysis of software security flaws |
GB2459629A (en) * | 2007-02-16 | 2009-11-04 | Veracode Inc | Assessment and analysis of software security flaws |
US7770203B2 (en) * | 2007-04-17 | 2010-08-03 | International Business Machines Corporation | Method of integrating a security operations policy into a threat management vector |
US8166551B2 (en) * | 2007-07-17 | 2012-04-24 | Oracle International Corporation | Automated security manager |
US8185930B2 (en) * | 2007-11-06 | 2012-05-22 | Mcafee, Inc. | Adjusting filter or classification control settings |
WO2009116173A1 (en) * | 2008-03-21 | 2009-09-24 | 富士通株式会社 | Countermeasure selection program, countermeasure selection device, and countermeasure selection method |
US20110093955A1 (en) * | 2009-10-19 | 2011-04-21 | Bank Of America Corporation | Designing security into software during the development lifecycle |
US8495745B1 (en) | 2009-11-30 | 2013-07-23 | Mcafee, Inc. | Asset risk analysis |
US8495747B1 (en) | 2010-03-31 | 2013-07-23 | Mcafee, Inc. | Prioritizing asset remediations |
US20120159624A1 (en) * | 2010-12-21 | 2012-06-21 | Fujitsu Technology Solutions Intellectual Property Gmbh | Computer security method, system and model |
WO2012109633A2 (en) * | 2011-02-11 | 2012-08-16 | Achilles Guard, Inc. D/B/A Critical Watch | Security countermeasure management platform |
US9727733B2 (en) | 2011-08-24 | 2017-08-08 | International Business Machines Corporation | Risk-based model for security policy management |
US9286063B2 (en) * | 2012-02-22 | 2016-03-15 | Veracode, Inc. | Methods and systems for providing feedback and suggested programming methods |
US8726393B2 (en) * | 2012-04-23 | 2014-05-13 | Abb Technology Ag | Cyber security analyzer |
US9537881B2 (en) * | 2013-12-18 | 2017-01-03 | Cytegic Ltd. | Security risk mapping of potential targets |
US10341376B2 (en) * | 2014-12-29 | 2019-07-02 | Guidewire Software, Inc. | Diversity analysis with actionable feedback methodologies |
US10050990B2 (en) | 2014-12-29 | 2018-08-14 | Guidewire Software, Inc. | Disaster scenario based inferential analysis using feedback for extracting and combining cyber risk information |
US9699209B2 (en) | 2014-12-29 | 2017-07-04 | Cyence Inc. | Cyber vulnerability scan analyses with actionable feedback |
WO2017078986A1 (en) | 2014-12-29 | 2017-05-11 | Cyence Inc. | Diversity analysis with actionable feedback methodologies |
US11855768B2 (en) | 2014-12-29 | 2023-12-26 | Guidewire Software, Inc. | Disaster scenario based inferential analysis using feedback for extracting and combining cyber risk information |
US10050989B2 (en) | 2014-12-29 | 2018-08-14 | Guidewire Software, Inc. | Inferential analysis using feedback for extracting and combining cyber risk information including proxy connection analyses |
US11863590B2 (en) | 2014-12-29 | 2024-01-02 | Guidewire Software, Inc. | Inferential analysis using feedback for extracting and combining cyber risk information |
US10404748B2 (en) | 2015-03-31 | 2019-09-03 | Guidewire Software, Inc. | Cyber risk analysis and remediation using network monitored sensors and methods of use |
US11010717B2 (en) * | 2016-06-21 | 2021-05-18 | The Prudential Insurance Company Of America | Tool for improving network security |
US9930062B1 (en) | 2017-06-26 | 2018-03-27 | Factory Mutual Insurance Company | Systems and methods for cyber security risk assessment |
US11146583B2 (en) | 2019-05-01 | 2021-10-12 | Qatar Foundation For Education, Science And Community Development | Threat-specific security risk evaluation for networked systems |
US11861412B2 (en) * | 2020-12-09 | 2024-01-02 | EMC IP Holding Company LLC | Method for consolidating infrastructure deployment including networking, out-of-band management, and in-band management through a web graphical user interface |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5533123A (en) * | 1994-06-28 | 1996-07-02 | National Semiconductor Corporation | Programmable distributed personal security |
US5850516A (en) * | 1996-12-23 | 1998-12-15 | Schneier; Bruce | Method and apparatus for analyzing information systems using stored tree database structures |
US6374358B1 (en) * | 1998-08-05 | 2002-04-16 | Sun Microsystems, Inc. | Adaptive countermeasure selection method and apparatus |
US6542993B1 (en) * | 1999-03-12 | 2003-04-01 | Lucent Technologies Inc. | Security management system and method |
-
1998
- 1998-08-05 US US09/129,626 patent/US6374358B1/en not_active Expired - Lifetime
-
1999
- 1999-08-04 EP EP99946583A patent/EP1101159B1/en not_active Expired - Lifetime
- 1999-08-04 AU AU58969/99A patent/AU5896999A/en not_active Abandoned
- 1999-08-04 DE DE69905726T patent/DE69905726T2/en not_active Expired - Fee Related
- 1999-08-04 WO PCT/US1999/017575 patent/WO2000008543A1/en active IP Right Grant
- 1999-08-04 AT AT99946583T patent/ATE233918T1/en not_active IP Right Cessation
-
2002
- 2002-03-26 US US10/105,250 patent/US6631473B2/en not_active Expired - Lifetime
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9009321B2 (en) | 2007-01-24 | 2015-04-14 | Mcafee, Inc. | Multi-dimensional reputation scoring |
US9544272B2 (en) | 2007-01-24 | 2017-01-10 | Intel Corporation | Detecting image spam |
Also Published As
Publication number | Publication date |
---|---|
EP1101159B1 (en) | 2003-03-05 |
DE69905726T2 (en) | 2003-12-18 |
WO2000008543A1 (en) | 2000-02-17 |
US6374358B1 (en) | 2002-04-16 |
DE69905726D1 (en) | 2003-04-10 |
ATE233918T1 (en) | 2003-03-15 |
AU5896999A (en) | 2000-02-28 |
US6631473B2 (en) | 2003-10-07 |
US20020188861A1 (en) | 2002-12-12 |
EP1101159A1 (en) | 2001-05-23 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US6374358B1 (en) | Adaptive countermeasure selection method and apparatus | |
US10692032B2 (en) | Pervasive, domain and situational-aware, adaptive, automated, and coordinated big data analysis, contextual learning and predictive control of business and operational risks and security | |
US11909757B2 (en) | System and method for assessing cybersecurity risk of computer network | |
Mukhopadhyay et al. | Cyber-risk decision models: To insure IT or not? | |
Shetty et al. | Reducing informational disadvantages to improve cyber risk management | |
US20130227696A1 (en) | Automated Security Management | |
WO2004079539A2 (en) | System and method for generating and using a pooled knowledge base | |
Zadeh et al. | Characterizing cybersecurity threats to organizations in support of risk mitigation decisions | |
Leppänen et al. | Cyber security incident report—Norsk hydro | |
Winarno et al. | IT infrastructure security risk assessment using the Center for Internet Security Critical Security Control framework: a case study at insurance company | |
Fung et al. | Electronic information security documentation | |
Chan | Information security risk modeling using Bayesian index | |
Al-Mudaires et al. | Information security risk management framework for a governmental educational institute | |
Goldstein | The Rise of Interconnected Devices: What Healthcare Organizations Can Learn from The IoT Cybersecurity Improvement Act of 2020, its Accompanying NIST Standards and Guidelines, and Related Industry Best Practices | |
Maja et al. | Challenges of Cyber Security in Insurance Business | |
Pak | The near real time statistical asset priority driven (NRTSAPD) risk assessment methodology | |
Evans | The Importance of Incident Response | |
Angle | Information Technology Governance, Risk and Compliance in Healthcare | |
Hughes et al. | Organization, Documentation, and Coordination: Responding Successfully to a Cyber Attack | |
Usable | CYBERSECURITY Bank and Other Depository Regulators Need Better Data Analytics and | |
Korzyk Sr | A conceptual design model for integrative information system security | |
Magnusson et al. | Method for insuring IT risks | |
Hatzivasilis et al. | ORCID: 0000-0003-0424-7425, Yautsiukhin, A., Antoniou, M., Katehakis, DG and Panayiotou, M.(2019). Cyber insurance of information systems: Security and privacy cyber insurance contracts for ICT and helathcare organizations | |
Laliberte | Risk assessment for IT security | |
Cammarata | Data Security |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A1 Designated state(s): AE AL AM AT AU AZ BA BB BG BR BY CA CH CN CR CU CZ DE DK EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MD MG MK MN MW MX NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT UA UG UZ VN YU ZA ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A1 Designated state(s): GH GM KE LS MW SD SL SZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
DFPE | Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101) | ||
AK | Designated states |
Kind code of ref document: C2 Designated state(s): AE AL AM AT AU AZ BA BB BG BR BY CA CH CN CR CU CZ DE DK EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MD MG MK MN MW MX NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT UA UG UZ VN YU ZA ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: C2 Designated state(s): GH GM KE LS MW SD SL SZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG |
|
COP | Corrected version of pamphlet |
Free format text: PAGES 1-20, DESCRIPTION, REPLACED BY NEW PAGES 1-15; PAGES 21-35, CLAIMS, REPLACED BY NEW PAGES 16-23; PAGES 1/7-7/7, DRAWINGS, REPLACED BY NEW PAGES 1/7-7/7; DUE TO LATE TRANSMITTAL BY THE RECEIVING OFFICE |
|
WWE | Wipo information: entry into national phase |
Ref document number: 1999946583 Country of ref document: EP |
|
WWP | Wipo information: published in national office |
Ref document number: 1999946583 Country of ref document: EP |
|
REG | Reference to national code |
Ref country code: DE Ref legal event code: 8642 |
|
WWG | Wipo information: grant in national office |
Ref document number: 1999946583 Country of ref document: EP |