Background

A major aspect of risk management for enterprises is the question of how cyber security and other information system resources should be allocated.  Many types of businesses and other institutions face markedly different cybersecurity threats and categorized losses, and enterprises must be able to prioritize their finite budgets and other finite enterprise resources based on what they anticipate being the most likely and severe losses.  Improperly prioritizing resources toward fending off lower-priority threats risk wasting those resources and leaving inadequate resources available for dealing with higher priority threats.

With limited options, enterprises typical draw cybersecurity risk characterizations from highly subjective sources, such as compliance and maturity questionnaires, somewhat subjective risk algorithms, such as value at risk modeling, or objective data sources, such as log monitoring and end point protection products.  Each of these solutions represents a portion of the complete cyber risk calculus, which means they can improperly inform an enterprise.

With the above subjective sources, subjective algorithms, and objective data sources, the qualification or quantification of risk is inconsistent and may only represent one or two of the three variables of the traditional risk formula, expressed as Risk = Threat x Vulnerability x Cost or the modified risk formula (as expressed in US patents 11,379,773, 11,282,018, 10,453,016, 10,395,201, and 9,747,570) expressed as Risk = Threat x Impact x (1 – Control Effectiveness).

As an example, an enterprise may use a subjective NIST Cyber Security Framework (CSF) assessment to determine the implementation posture of NIST CSF sub-categories (commonly known as controls) within the enterprise.  The NIST CSF assessment may indicate a maturity score (0 to 5) or a percent implementation score (0 to 100%).  In either case, the maturity score or implementation score only aligns with a subset of control effectiveness and does not provide any indication of threat or impact, hence representing an incomplete understanding of risk.

As a second example, an enterprise may use a subjective algorithm, such as a VaR simulator or Monte Carlo simulator, to determine the impact from a specific cyber scenario (such as ransomware).  A Monte Carlo simulator will determine a loss magnitude and loss frequency.  However, a Monte Carlo simulator requires historical data (which may or may not be available to the enterprise), a list of assumptions (which could be based on expert opinion or statistical analysis), and the definition of a cyber risk scenario (which may only be a small subset of all risks).  Further, a Monte Carlo simulator assumes that all returns are independent and identically distributed, which is not true when analyzing empirical cyber impact data.  In other words, a Monte Carlo simulator may contain extreme bias, may lack integrity, and may include a scope deficit.  Even the financial services industry struggles with the use of Monte Carlo simulators, which is sometimes known as “nonsensical” VaR modeling.

As a third example, an enterprise may use an objective data source, such as a log monitoring product, to determine the volume of cyber events.  The enterprise may use the volume of cyber events to better understand its threat profile.  The enterprise may directly analyze the volume of each event or may use a deviation formula to easily determine if events volumes are increasing or decreasing based on a known baseline value.  Even though this data provides objective threat analysis, it does not provide an understanding of impact or control effectiveness, hence representing an incomplete understanding of risk.

As a fourth example, an enterprise may decide not to measure and model cyber risk.  An enterprise may not want to warrant the cost of such a solution and may not want to truly understand the realities of cyber risk.  However, this lack of risk determination does not eliminate enterprise cyber risk, nor does it solve for the existence of enterprise cyber risk.

Embodiments of X-Analytics relate generally to systems, methods, and apparatuses for assessing cyber risk within an enterprise environment, more particularly to augmenting the modeling calibration by including additional data, such as historical data, cyber risk intelligence data, and enterprise-specific data, in the overall threat, impact, control, and incident data sets, by using a series of automated simulations to pinpoint and prioritize risk reduction, and by using trend analysis to address cyber risk within the context of the enterprise’s risk resilience journey.

In typical systems and methods to model cyber risk, operators may augment data in various ways to fit a particular outcome.  Data manipulation erodes the quality and integrity of the overall system, method, and apparatus, which could misinform the allocation of an enterprise’s finite budget and other finite enterprise resources.  This invention directly addresses this concern by using objective and representative data sets and a fixed data structure that are outside of the operator’s control or manipulation.  Further, this invention provides a set of fixed operator inputs to ensure the results align with the profile of the enterprise.

Many cyber risk applications are based on compliance and regulatory standards that assume that all controls are equal, and that data breach is the primary loss category.  Embodiments of this invention show that all controls are not equal, that each enterprise has a unique exposure profile, and that ransomware, business interruption, misappropriation of intellectual property, funds, and services are relevant loss categories in conjunction with data breach.

With a proper understand of cyber risk, and enterprise can effectively prioritize finite budget and other finite enterprise resources toward risk remediation and risk transfer mechanisms.