System and method for modeling and assessing risk

Abstract

The disclosure relates to systems and methods for modeling and assessing risks. A system, method, and non-transitory computer readable medium are disclosed for modeling the risk of an assessed system (SUA) and automatically assessing its security and / or confidentiality compliance. The present disclosure is particularly suited for independent assessment of SUA and does not constitute part of SUA.

Description

technical field [0001] The present disclosure relates to systems and methods for modeling and assessing risk. Background technique [0002] The following discussion of the background art is merely intended to facilitate an understanding of the present disclosure. It should be appreciated that this discussion is not an acknowledgement or admission that any of the material referred to was published, known or part of the general knowledge of those skilled in the art in any jurisdiction prior to the priority date of the present invention. [0003] Risk modeling and assessment are necessary activities throughout the life cycle of a component, device or system. One approach involves manually recording potential hazards and possible mitigations for those hazards. Although tool support such as spreadsheets can be used to support document processing, tool support is typically used to manage documents and is not available for performing deep semantic analysis or automating decision ...

AI Technical Summary

Problems solved by technology

However, such models are often difficult to use because risk assessors may not be proficient in formal modeling

Furthermore, due to the computational complexity associated with formal modeling, known formal models may be limited in their application and involve the use of intensive computational resources

Existing formal methods may not satisfactorily handle dynamically changing and interacting elements within the system being assessed

[0007] In summary, existing systems and methods have significant shortcomings in modeling and assessing risk

Depending on the methodology used, they do not allow complete independence from the system being assessed, do not enable complete risk modeling, and are often domain-specific

Images