Manage security-related IT services

Abstract

A method, apparatus, and system for managing information technology services are disclosed. Based on evaluation information about security factors of the information technology services and performance information about a current group of security controls for the information technology services, a current security assurance level of the information technology services related to security in an organization is determined. A target security assurance level for the information technology services is determined based on the criticality of the information technology services. A graphical representation of the difference between the current security assurance level and the target security assurance level is displayed on a display system. When the difference is greater than a threshold, a graphical indication of an additional security control is displayed that, if implemented for the information technology services, would cause the difference between the current security assurance level and the target security assurance level to be within a desired security assurance level for protecting the information technology services.

Description

Technical Field

[0001] The present disclosure relates generally to an improved computer system, and more particularly to a method, apparatus, system, and computer program product for managing security-related information technology services in an organization where the information technology services include physical components. Background Art

[0002] With respect to security-related information technology services, cybersecurity standards are published to provide standards for protecting an organization's environment, including users, networks, devices, software, and other components that can operate to provide a certain level of protection for security-related information technology services.

[0003] A Cybersecurity Assurance Level (SAL) can be calculated using industry standard methods to objectively represent the relative security currently associated with protecting information and components in an organization. Currently, factors such as integrity, confidentiality, and availability are used to calculate an organization's Security Assurance Level. Questions can be asked to individuals in the organization, from which the answers can be used to calculate the organization's Security Assurance Level. A report can be generated that describes one or more areas that need improvement.

[0004] However, common industry techniques for calculating an organization's security assurance level are much more difficult than desired. Current techniques are difficult to apply to different organizations and require extensive subject matter expertise (SMEs) in making these calculations. For example, questions about an organization cannot be answered without individuals in the organization having expertise about the different hardware and software components used in the organization's environment.

[0005] Therefore, it is desirable to have a method and apparatus that takes into account at least some of the above-mentioned problems and other possible problems.For example, it is desirable to have a method and apparatus that overcomes the technical problems of determining the security assurance level of an organization. Summary of the invention

[0006] Embodiments of the present disclosure provide a method for managing information technology services. Receive assessment information about the criticality and security factor groups of information technology services related to security in an organization. Determine the current security assurance level of the information technology service based on the assessment information about the security factor groups of the information technology service and the performance information about the current security control groups of the information technology service. Determine the target security assurance level of the information technology service based on the information about the criticality of the information technology service. Determine the difference between the current security assurance level and the target security assurance level. Compare the difference with a threshold value of the desired security assurance level for preventing attacks on the information technology service. When the difference is greater than the threshold value, display a graphical indication of an additional security control group that, if implemented for the information technology service, results in the difference between the current security assurance level and the target security assurance level being within the desired security assurance level for preventing attacks on the information technology service.

[0007] Another embodiment of the present disclosure provides a method for managing information technology services. Based on assessment information related to a group of security factors of the information technology service and performance information related to a current group of security controls of the information technology service, a current security assurance level of the information technology service related to security in the organization is determined. Based on assessment information about the criticality of the information technology service, a target security assurance level of the information technology service is determined. A graphical representation of the difference between the current security assurance level and the target security assurance level is displayed on a display system. When the difference is greater than a threshold, a graphical indication of an additional security control group is displayed, which, if implemented for the information technology service, causes the difference between the current security assurance level and the target security assurance level to be within a desired security assurance level for preventing attacks on the information technology service.

[0008] Yet another embodiment of the present disclosure provides an information technology service management system, which includes a computer system and an information technology service manager in the computer system. The information technology service manager receives assessment information about the criticality and security factor groups of information technology services related to security in an organization. The information technology service manager determines the current security assurance level of the information technology service based on the assessment information about the security factor groups of the information technology service and the performance information about the current security control group of the information technology service. The information technology service manager determines the target security assurance level of the information technology service based on the assessment information about the criticality of the information technology service, and determines the difference between the current security assurance level and the target security assurance level. The information technology service manager compares the difference with a threshold value of the desired security assurance level for preventing attacks on the information technology service. When the difference is greater than the threshold value, the information technology service manager displays a graphical indication of an additional security control group, which, if implemented for the information technology service, results in the difference between the current security assurance level and the target security assurance level being within the desired security assurance level for preventing attacks on the information technology service.

[0009] The features and functions may be achieved independently in various embodiments of the present disclosure or may be combined in yet other embodiments, in which further details may be seen with reference to the following description and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The novel features which are believed to be characteristic of the illustrative embodiments are set forth in the appended claims. However, the illustrative embodiments and their preferred modes of use, further objects and features will be best understood by reference to the following detailed description of illustrative embodiments of the present disclosure when read in conjunction with the accompanying drawings, in which:

[0011] Figure 1 is an illustration of a block diagram of an information technology services environment according to an illustrative embodiment;

[0012] Figure 2 is an illustration of a block diagram of a graphical user interface for displaying information to an operator according to an illustrative embodiment;

[0013] Figure 3 is an illustration of a block diagram of a security control according to an illustrative embodiment;

[0014] Figure 4 is an illustration of a data flow diagram for determining additional security controls for information technology services in accordance with an illustrative embodiment;

[0015] Figure 5 is an illustration of a questionnaire for collecting critical assessment information about information technology services according to an illustrative embodiment;

[0016] Fig. 6A and Figure 6B is an illustration of a questionnaire for collecting critical assessment information about information technology services according to an illustrative embodiment;

[0017] Figure 7 is an illustration of a graphical user interface for displaying recommendations and safety assurance levels according to an illustrative embodiment;

[0018] Figure 8 is an illustration of a graphical user interface for displaying a security assurance level when a security control is not operating as expected in accordance with an illustrative embodiment;

[0019] Fig. 9 is an illustration of a graphical user interface for displaying a security assurance level when a security control is not operating as expected in accordance with an illustrative embodiment;

[0020] Fig.10 is an illustration of a flow chart of a process for managing information technology services in accordance with an illustrative embodiment;

[0021] Fig.11 is an illustration of a flow chart of a process for managing information technology services in accordance with an illustrative embodiment;

[0022] Fig.12 is another illustration of a flowchart of a process for managing information technology services in accordance with an illustrative embodiment;

[0023] Fig.13 is an illustration of a flow chart of a process for managing a security software product for information technology services in accordance with an illustrative embodiment; and

[0024] Fig.14 is an illustration of a block diagram of a data processing system in accordance with an illustrative embodiment. DETAILED DESCRIPTION

[0025] The illustrative embodiments recognize and take into account one or more different considerations. For example, the illustrative embodiments recognize and take into account that current techniques do not prioritize or segment or partition environments into different information technology services for the purpose of determining security assurance levels. The illustrative embodiments recognize and take into account that determining a security assurance level for each information technology service related to security in an environment in an organization can provide an improved view of how the organization's environment is protected.

[0026] Furthermore, the illustrative embodiments recognize and take into account that when the environment is divided into different information technology services, it is easier to provide recommendations for improving the current security assurance level of the information technology services. The illustrative embodiments recognize and take into account that when the importance of each information technology service is identified in determining the security assurance level, it is also easier to make recommendations for improving the security assurance level.

[0027] The illustrative embodiments also recognize and take into account that, without structuring or identifying different information technology services in an organization, non-standard security approaches may occur. Additionally, the illustrative embodiments also recognize and take into account that inefficient allocation of resources and suboptimal system risk reduction may also occur.

[0028] Thus, the illustrative embodiments provide a method, apparatus, system, and computer program product for managing information technology services. In one illustrative example, a computer system determines a current security assurance level for an information technology service related to security in an organization based on evaluation information about a group of security factors for the information technology service and performance information about a current group of security controls for the information technology service. The computer system determines a target security assurance level for the information technology service based on the evaluation information about the criticality of the information technology service. When the difference is greater than a threshold, the computer system displays a graphical indication of an additional group of security controls that, if implemented for the information technology service, would result in a difference between the current security assurance level and the target security assurance level being within a desired security assurance level for preventing attacks on the information technology service.

[0029] As used herein, a "group" when used in relation to an item means one or more items. For example, a safety factor group is one or more safety factors.

[0030] The computer system may also display, on the display system, a graphical representation of the difference between the current security assurance level and the target security assurance level.

[0031] Now refer to the drawings and Figure 1 , which depicts an illustration of a block diagram of an information technology service environment according to an illustrative embodiment. Information technology service environment 100 is an environment in which information technology services 102 for an organization 104 may be managed. In this illustrative example, organization 104 is selected from one of an airport authority, an airline, a maintenance service, an aircraft manufacturer, a government agency, a corporation, a city, and other suitable types of organizations.

[0032] As shown, information technology services 102 are related to security 106 of organization 104. Information technology services 108 in information technology services 102 are services provided by one or more components. These components can be at least one of software components or physical hardware components. These components communicate with each other through a network. The network can be composed of at least one of the Internet, an intranet, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a peer-to-peer network, an ad hoc network, or some other suitable network type.

[0033] As used herein, the phrase "at least one of" when used with a list of items means that different combinations of one or more of the listed items can be used, and only one of each item in the list may be required. In other words, "at least one of" means any combination of items and number of items that can be used from the list, but not all items in the list are required. The item may be a specific object, thing, or category.

[0034] For example, but not limited to, "at least one of item A, item B, or item C" may include item A, item A and item B, or item B. This example may also include item A, item B, and item C, or item B and item C. Of course, any combination of these items may exist. In some illustrative examples, "at least one of..." may be, for example, but not limited to, two of item A; one of item B; and ten of item C; four of item B and seven of item C; or other suitable combinations.

[0035] As shown, information technology services 102 may include at least one of a badge reader system, a surveillance system, a security checkpoint system, an X-ray scanner system, a metal detector system, a firewall, an intrusion prevention system, or some other suitable information technology service related to security 106 of organization 104. These various services may include at least one of hardware, software, or some combination thereof.

[0036] In the illustrative example, the information technology service manager 110 in the computer system 112 is operable to manage the information technology services 102 in the organization 104. The information technology service manager 110 can be implemented in software, hardware, firmware, or a combination thereof. When software is used, the operations performed by the information technology service manager 110 can be implemented in program code configured to run on hardware such as a processor unit. When firmware is used, the operations performed by the information technology service manager 110 can be implemented in program code and data and stored in persistent memory to run on the processor unit. When hardware is employed, the hardware may include circuits that operate to perform the operations in the information technology service manager 110.

[0037] In an illustrative example, the hardware may take the form of at least one of a circuit system, an integrated circuit, an application specific integrated circuit (ASIC), a programmable logic device, or some other suitable type of hardware configured to perform multiple operations. In the case of a programmable logic device, the device may be configured to perform multiple operations. The device may be reconfigured later or may be permanently configured to perform multiple operations. Programmable logic devices include, for example, programmable logic arrays, programmable array logic, field programmable logic arrays, field programmable gate arrays, and other suitable hardware devices. In addition, the process may be implemented in organic components integrated with inorganic components, and may be composed entirely of organic components other than humans. For example, the process may be implemented as a circuit in an organic semiconductor.

[0038] Computer system 112 is a physical hardware system and includes one or more data processing systems. When there is more than one data processing system in computer system 112, those data processing systems communicate with each other using a communication medium. The communication medium may be a network. The data processing system may be selected from at least one of a computer, a server computer, a tablet computer, or some other suitable data processing system.

[0039] As shown, information technology service manager 110 is operable to enable management of security-related information technology services in information technology services 102 in organization 104. In this illustrative example, each information technology service in information technology services 102 may be managed independently of other information technology services in information technology services 102.

[0040] In this illustrative example, the information technology service manager 110 receives input of assessment information 114 regarding criticality 116 and a group of security factors 118 for a particular information technology service, such as the information technology service 108, which are related to the security 106 of the organization 104. The information technology service manager 110 determines a current security assurance level 120 for the information technology service 108 based on the assessment information 114 regarding the group of security factors 118 for the information technology service 108 and input of performance information 122 regarding a current group of security controls 124 for the information technology service 108. In this illustrative example, at least one of the group of security factors 118 is selected from at least one of confidentiality, integrity, availability, system environment, or other suitable types of security factors. In this illustrative example, the security assurance level, such as the current security assurance level 120, is determined using currently available techniques. For example, the security assurance level may be determined using a standard.

[0041] For example, the Cybersecurity Evaluation Tool (CSET) is a tool from the U.S. Department of Homeland Security that can be used to determine security assurance levels. As used herein, "CSET" is a registered trademark of the U.S. Department of Homeland Security.

[0042] The software tool takes into account security factors such as integrity, confidentiality, and availability. Currently available tools do not take into account the system environment, which is a factor considered in security assessments. Currently available tools can be modified to take into account this additional factor.

[0043] As shown, the information technology service manager 110 determines a target security assurance level 130 for a particular information technology service, such as the information technology service 108, based on input assessment information 114 regarding the criticality 116 of the information technology service 108. In this illustrative example, the target security assurance level 130 is the desired security level for the information technology service 108. Other information technology services in the information technology services 102 may have different target security assurance levels depending on the criticality of those information technology services in the organization 104.

[0044] Information technology service manager 110 determines a difference 132 between current security assurance level 120 and target security assurance level 130. In this illustrative example, information technology service manager 110 compares difference 132 to threshold 134 of a desired security assurance level 136 for preventing attacks on information technology services 108.

[0045] As shown, threshold 134 can be set in a variety of different ways. For example, threshold 134 can be set based on factors such as the financial impact of a cybersecurity incident taking into account direct and indirect costs.

[0046] The desired security assurance level 136 may be different amounts of security depending on factors such as criticality, return on security investment (ROSI), difficulty of implementation, and other factors. The desired security assurance level 136 may be different for the same information technology service in different organizations. The desired security assurance level 136 may be as high as considered completely secure, but may be at a lower level depending on factors considered for the information technology service 108.

[0047] As shown, when the difference 132 is greater than the threshold 134, the information technology service manager 110 displays a graphical indication 138 of a set of additional security controls 140 that, if implemented for the information technology service 108, would cause the difference 132 between the current security assurance level 120 and the target security assurance level 130 to be within the desired security assurance level 136 for preventing attacks on the information technology service 108. Such display of the graphical indication 138 may be performed on a display system 142 of the computer system 112.

[0048] Next reference Figure 2, depicts an illustration of a block diagram of a graphical user interface in which information is displayed to an operator according to an illustrative embodiment. In the illustrative examples, the same reference numeral may be used in more than one of the figures. This reuse of reference numerals in different figures represents the same element in the different figures.

[0049] In this illustrative example, graphical user interface 200 is displayed to operator 202 on display system 142 of computer system 112. Display system 142 is a physical hardware system and includes one or more display devices on which graphical user interface 200 may be displayed with graphical indications 138. The display device may include at least one of a light emitting diode (LED) display, a liquid crystal display (LCD), an organic light emitting diode (OLED) display, a computer monitor, a projector, a flat panel display, a head-up display (HUD), or some other suitable device that can output information for information presentation.

[0050] In this illustrative example, display system 142 is configured to display graphical user interface 200. As shown, operator 202 is a person who can interact with graphical user interface 200 through user input 204 generated by input system 206 for computer system 112. Input system 206 is a physical hardware system and can be selected from at least one of a mouse, keyboard, trackball, touch screen, stylus, motion sensing input device, cyber glove, or some other suitable type of input device.

[0051] As shown, the information technology service manager 110 may display a graphical indication 138 of the additional set of security controls 140 to an operator 202 in a graphical user interface 200 on a display system 142 of the computer system 112 .

[0052] Additionally, information technology service manager 110 may also display graphical representation 208 of difference 132 between current security assurance level 120 and target security assurance level 130 in graphical user interface 200 on display system 142. In this illustrative example, graphical representation 208 may be selected from at least one of a spider chart, a radar chart, a radar graph, an area chart, a histogram, a bar chart, a line chart, a combination chart, or some other suitable graphical representation.

[0053] In the graphical indication 138 that displays the set of additional security controls 140 when the difference 132 is greater than the threshold 134, the information technology service manager 110 displays the graphical indication 138 when the difference 132 is greater than the threshold 134, the graphical indication 138 including the set of links 210 associated with the set of additional security controls 140. In this example, if the set of additional security controls 140 is implemented, the difference 132 between the current security assurance level 120 and the target security assurance level 130 is within the desired security assurance level 136 for preventing attacks on the information technology service 108. In other words, the graphical indication 138 can be a graphical display of the set of links 210 that can be selected by the operator 202.

[0054] As shown, the selection of link 212 in the group of links 210 starts the implementation of the security control 214 corresponding to link 212. In this illustrative example, the implementation can take a variety of different forms. For example, selecting link 212 can cause software for security control 214 to be downloaded and installed, including software for real-time continuous scanning of adware, malware and virus detection and removal (such as anti-virus software and Internet security software sold by Kaspersky). Therefore, in the case where the selection of link 212 in the group of links 210 includes the selection of software for security control that provides real-time scanning of adware, malware and virus detection and removal, the information technology service manager 110 starts the installation of software that provides real-time scanning of adware, malware and virus detection and removal, so that the installation causes the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within the desired security assurance level (136) for preventing attacks on information technology services (108). In another illustrative example, selecting link 212 can cause a work order to be generated to install software or hardware for security control 214. In yet another illustrative example, when performing an upgrade or maintenance on information technology service 108 , selection of link 212 may result in a request to include security control 214 .

[0055] Next go to Figure 3 , depicts an illustration of a block diagram of a security control in accordance with an illustrative embodiment. As shown, security control 300 may be used to implement at least one of current security control 124 or additional security control 140 .

[0056] In this illustrative example, security controls 300 may be selected from at least one of software security products 302 or physical security products 304. The current set of security controls 124 may also be selected from at least one of software security products 302 or physical security products 304. In a similar manner, the set of additional security controls 140 may be selected from at least one of software security products 302 or physical security products 304. In an illustrative embodiment, the information technology service 108 may be a security gate checkpoint that requires a physical security product 304 (such as a security badge) for an individual to pass through the security gate checkpoint, and the set of additional security controls 140 that may be selected may include two-factor authentication consisting of a badge reader for scanning a badge with an embedded code and a keypad device for entering a personal identification code associated with the badge. In an illustrative embodiment where the information technology service 108 may be a network server that provides information to other devices within an organization via wireless communications, the set of additional security controls 140 that may be selected may include anti-malware, anti-virus software, scanners, firewalls, and access control systems. Selection of such additional security controls 140 may implement an antivirus software scanner, for example, where performance information of the additional security controls may be monitored based on the number of false positives of suspicious files reported or the number of malicious files detected and contained.

[0057] In this illustrative example, software security product 302 is for Figure 1 The information technology service 108 in the system provides security software. This security can be targeted Figure 1 The information technology service 108 in the system protects against network security attacks, malware, viruses, unauthorized access, or other undesirable behaviors. The software security product 302 can be selected from at least one of anti-malware software, anti-virus software, scanners, firewalls, access control systems, identity and access management systems, virtual private network servers, intrusion prevention software, and other suitable types of software programs, products, or suites.

[0058] In this illustrative example, physical security product 304 is a physical security product that can be used to protect Figure 1 The physical components of the location or hardware of the information technology service 108. In this illustrative example, physical security product 304 can be selected from modules, cameras, iris scanners, X-ray scanners, metal detectors, and other devices that can be used to protect Figure 1 One of other suitable types of physical components of the information technology service 108.

[0059] Next reference Figure 4 , depicts an illustration of a data flow diagram for determining additional security controls for information technology services according to an illustrative embodiment. As shown, the information technology service manager 110 Figure 1Assessment information 114 related to information technology services 108 in organization 104 is received.

[0060] As shown, assessment information 114 is received from data source 400. In this illustrative example, data source 400 includes at least one of service owner 402, service manager 404, or subject matter expert 406.

[0061] The service owner 402 may be a person who provides the assessment information 114 regarding the criticality 116 of the information technology service 108. For example, the service owner 402 may be a person who is responsible for delivering the information technology service 108 within an agreed upon service level.

[0062] In this illustrative example, service manager 404 may be a person who provides information about the operational importance of information technology services 108. Operational importance may include security factors 118. Service manager 404 is responsible for managing the operation of information technology services 108. For example, service manager 404 may be responsible for negotiating service level agreements and ensuring that service level agreements are met.

[0063] In this illustrative example, security factors 118 may include a number of different factors. For example, security factors 118 may include at least one of integrity 408, confidentiality 410, availability 412, or system environment 414.

[0064] As shown, integrity 408 is the state of information. A loss of integrity 408 can be an unauthorized modification or destruction of information in information technology services 108. Confidentiality 410 is the confidentiality of information in information technology services 108. A loss of confidentiality 410 occurs when unauthorized disclosure of information occurs. Availability 412 is access to information technology services 108. A loss of availability 412 involves a disruption in access to or use of information in information technology services 108.

[0065] In this illustrative example, system environment 414 represents all of the security controls that protect information technology services 108 , without information technology services 108 being able to adequately provide those security controls for themselves.

[0066] In this illustrative example, subject matter expert 406 may be an expert regarding information technology services 108. For example, if information technology services 108 include security checkpoints in an airport, subject matter expert 406 may be a person who has knowledge of security checkpoints. This knowledge may extend to the different physical components and software that operate at the security checkpoints in the airport.

[0067] More than one subject matter expert may be present for a particular information technology service. For example, one subject matter expert may be an expert on physical security products, while another subject matter expert may be an expert on software security products for security checkpoints.

[0068] In this illustrative example, information may be obtained from data source 400 through a variety of different mechanisms. For example, at least one of a questionnaire, interview, survey, or other information gathering technique may be used.

[0069] Information technology service manager 110 can use policies 416 to select different techniques for collecting assessment information 114. In this illustrative example, policy 416 is one or more rules and can include data for applying the rules. The rules can define at least one of the type of information technology service, the weight 118 of the security factor, the type of security control, or other rules for collecting assessment information 114.

[0070] In this illustrative example, information technology service manager 110 can process assessment information 114 using rules in policy 416 to determine current security assurance level 120 and target security assurance level 130. In this illustrative example, security factors 118 in assessment information 114 and weights of security factors 118 defined in policy 416 can be used to determine current security assurance level 120. Criticality 116 and policy 416 can be used to determine target security assurance level 130. In the illustrative example, criticality 116 can be based on the impact of a security control. This impact can be the impact of the security control on achieving target security assurance level 130.

[0071] Additionally, information technology service manager 110 determines a difference 132 between current security assurance level 120 and target security assurance level 130. In this illustrative example, this difference may also be referred to as a "gap."

[0072] As shown, the information technology service manager 110 displays a graphical user interface 200 having a graphical representation 208 of the current security assurance level 120 and the target security assurance level 130, wherein the difference 132 is indicated in the graphical representation 208. In addition, the information technology service manager 110 may also display a graphical indication 138 of a suggestion for an additional security control group 140 for the information technology service 108.

[0073] This information in graphical user interface 200 may be used to determine which of the set of additional security controls 140 should be implemented for information technology service 108. For example, a return on security investment analysis may be performed with respect to implementing the set of additional security controls 140 for information technology service 108.

[0074] In one illustrative example, one or more technical solutions are proposed that overcome the technical problem of determining a security assurance level for an organization. As a result, one or more technical solutions can provide a technical effect of determining a security assurance level for information technology services related to security in an organization.

[0075] The determination of the security assurance level is performed at the information technology service level, rather than focusing on the environment in which the entire information technology service operates. In addition, one or more technical solutions include additional security factors in the form of the environment, which are used to determine the security assurance level of the information technology service.

[0076] Thus, the illustrative examples provide a repeatable and customizable technique for determining current and target security assurance levels for different organizations.

[0077] Computer system 112 may be configured to perform the following operations using software, hardware, firmware, or a combination thereof: Figure 1-4 As a result, the computer system 112 operates as a special purpose computer system, wherein the information technology service manager 110 in the computer system 112 enables the management of the information technology service environment 100 of an organization, identifies information technology services in the organization, and then individually evaluates them when determining security assurance levels. In particular, the information technology service manager 110 converts the computer system 112 into a special purpose computer system compared to currently available general purpose computer systems that do not have the information technology service manager 110.

[0078] In the illustrative example, the process is integrated into an actual application for managing information technology services using the information technology service manager 110 in the computer system 112, and the actual application improves the performance of the computer system 112. In other words, the information technology service manager 110 in the computer system 112 is directed to the actual application of the process integrated into the information technology service manager 110 in the computer system 112, and the information technology service manager 110 determines the current security assurance level and the target security assurance level of the information technology service in a plurality of information technology services in the environment of the organization. Based on whether the security assurance level of the information technology service related to security is within the threshold of the desired security assurance level, a recommendation is made. The recommendation can be identified and displayed to allow analysis and implementation of additional security controls for protecting the information technology service being evaluated.

[0079] In this illustrative example, when a link display with recommendations for security controls is selected from the graphical user interface, the information technology service manager 110 in the computer system 112 can enable the download and installation of security controls in the form of software security products. In this way, the information technology service manager 110 in the computer system 112 provides practical application for managing information technology services in the context of an organization, such that the operation of the computer system 112 is improved as a tool for providing users with visual estimates of information technology services and recommendations for additional security controls.

[0080] Figure 1 Information technology service environment 100 and Figure 1-4 The illustration of different components in the illustrative embodiments is not meant to imply physical or architectural limitations on the manner in which the illustrative embodiments may be implemented. Other components other than the components shown or other components in place of the components shown may be used. Some components may be unnecessary. In addition, square blocks are provided to illustrate some functional components. When implemented in the illustrative embodiments, one or more of these square blocks may be combined, divided, or combined and divided into different square blocks.

[0081] For example, the information technology service manager 110 may be distributed across one or more different data processing systems in the computer system 112, or may be located on a single data processing system. As another example, the graphical representation 208 may also show the difference between the adjusted security assurance level and at least one of the current security assurance level 120 or the target security assurance level 130 in the graphical user interface 200 on the display system 142.

[0082] Reference now Figure 5 , depicts an illustration of a questionnaire for collecting assessment information about the criticality of an information technology service, according to an illustrative embodiment. In this illustrative example, window 500 is an example of a window for a questionnaire, which may be displayed in a graphical user interface to collect information from a data source such as Figure 4 The data source 400 in collects the evaluation information.

[0083] In this illustrative example, window 500 includes a plurality of different windows that can be used to obtain information about Figure 1 The information of the criticality 116 of the information technology service 108 in the embodiment of the present invention. As shown in the figure, the window 500 includes a security window 502, a safety window 504, a financial window 506 and an efficiency window 508.

[0084] In this illustrative example, security window 502 includes questions about whether the information technology service will affect security if the information technology service fails to operate as expected. Security window 504 includes questions about the impact on security if the service fails to operate as expected. Financial window 506 includes questions to determine whether the information technology service will affect the financial function of the organization if the information technology service fails to operate as expected. Efficiency window 508 includes questions to determine whether the efficiency of the organization will be affected if the information technology service fails to operate as expected.

[0085] Reference now Fig. 6A and Figure 6B , depicts an illustration of a questionnaire for collecting criticality assessment information for information technology services according to an illustrative embodiment. In this illustrative example, window 600 is an example of a window for a questionnaire that can be displayed in a graphical user interface to collect information from a data source such as Figure 4 The data source 400 in collects the evaluation information.

[0086] In this illustrative example, window 600 includes a plurality of different windows that can be used to obtain information about Figure 1 600 includes an integrity window 602, an availability window 604, a confidentiality window 606, and an environment window 608. In this illustrative example, if the information technology service cannot operate as expected, the window 600 is configured to receive a response regarding the impact of the information technology service. For example, the integrity window 602 includes low 620, medium 622, high 624, very high 626, and extremely high 628. These selections are for the impact that would occur if the information was modified or destroyed in an unauthorized manner.

[0087] Availability windows 604 include low 630, medium 632, high 634, very high 636, and extremely high 638. These selections address the impact on operations in the organization if the information technology service fails to operate as expected. For example, the impact may be loss of redundancy, reduced security, or other operations.

[0088] In the illustrative example, confidentiality window 606 includes low 640, medium 642, high 644, very high 646, and extremely high 648. These selections address the impact of failing to keep the information confidential.

[0089] As shown, the system environment window 608 includes low 650, medium 652, high 654, very high 656, and extremely high 658. These selections address the impact on the ability of the information technology service to protect itself if security controls in the environment of the information technology service are unavailable. For example, this question may access the criticality of the system environment to the information technology service, such as firewalls, access control systems, or other security controls for the information technology service.

[0090] Figure 5 and Fig. 6A and Figure 6B The illustration of questions in the window in is provided as an example only and is not meant to limit the number or type of questions or the manner in which the questions may be represented. For example, the window may also include fields for typing additional information. In other illustrative examples, more specific questions or additional windows may be displayed in response to answers to the questions to obtain assessment information for determining the criticality of information technology services in the organization. In another example, instead of using low, medium, high, very high, and extremely high, other categories may be used to determine importance. For example, a numerical system of 1 to 10 may be used to rank the importance of security factors of determined information technology services.

[0091] Figure 7-Figure 9 is an example of a graphical user interface that can be used to display graphical indications of security assurance levels and improvement suggestions in a graphical representation. Figure 7 , depicts an illustration of a graphical user interface for displaying recommendations and security assurance levels according to an illustrative embodiment. In this example, graphical user interface 700 is Figure 2 An example of one implementation of a graphical user interface 200 is shown in block form in FIG.

[0092] As shown, window 702 in graphical user interface 700 is Figure 1 700. Additional security controls are displayed in window 702. Additionally, in graphical user interface 700, a radar chart or radar graph 704 is Figure 2 704. In radar chart 704, there are axes extending from origin 701. These axes represent security factors. As shown, axis 703 is integrity; axis 705 is confidentiality; axis 707 is availability; and axis 709 is system environment.

[0093] As shown, radar chart 704 shows current safety assurance level 706 and target safety assurance level 708. Graphic indicator 710 highlights the difference between current safety assurance level 706 and target safety assurance level 708.

[0094] Next go to Figure 8 , depicts an illustration of a graphical user interface for displaying recommendations and security assurance levels according to an illustrative embodiment. In this example, graphical user interface 800 is Figure 2 An example of one implementation of a graphical user interface 200 is shown in block diagram form in FIG.

[0095] In this illustrative example, radar chart 802 shows current security assurance level 804 and target security assurance level 806 before implementing additional security controls. Graphical indicator 808 indicates the difference between the security assurance levels.

[0096] Radar chart 803 shows the current security assurance level 810 and the target security assurance level 812 after implementing the additional security controls. Graphic indicator 814 shows the difference between these security assurance levels. In the illustrative example, the target security assurance level 812 also changes because the determination of the target security assurance level 812 is performed by considering the implementation of the proposed additional security controls.

[0097] exist Fig. 9 In FIG. 9 , a graphical user interface for displaying a security assurance level when a security control is not operating as expected is depicted according to an illustrative embodiment. In this example, the graphical user interface 900 is Figure 2 An example of one implementation of a graphical user interface 200 is shown in block diagram form in FIG.

[0098] As shown, a radar chart 902 in a graphical user interface 900 shows a current security assurance level 904 and a target security assurance level 906 with security controls A and B. These security controls may be, for example, firewalls and malware detectors or malware scanning and detection software. A graphical indicator 908 indicates the difference between the security assurance levels.

[0099] In this illustrative example, radar chart 910 in graphical user interface 900 shows current security assurance level 912 and target security assurance level 914 without security control A and security control B. Graphical indicator 916 indicates the difference between the security assurance levels.

[0100] Figure 7-Figure 9 The illustration of the graphical user interface in is presented only as an example of how information can be displayed and is not meant to limit the manner in which information can be displayed in other illustrative examples. For example, instead of a radar chart, a bar chart, a line chart, or other types of charts can be used.

[0101] refer to Fig.10 , an illustration of a flowchart of a process for managing information technology services is depicted in accordance with an illustrative embodiment. Fig.10 The processes in may be implemented in hardware, software, or both. When implemented in software, the processes may take the form of program code executed by one or more processor units in one or more hardware devices in one or more computer systems. For example, the processes may be implemented in Figure 1 The information technology service manager 110 is implemented in the computer system 112 in the.

[0102] As shown, the process identifies information technology services in an environment for an organization (operation 1000). Information technology services may be identified through user input from an operations staff. The user input may be applied to criteria or rules in a policy that defines information technology services.

[0103] The process then selects an information technology service for evaluation (operation 1002). The process estimates the security assurance level of the selected information technology service (operation 1004). The process displays the evaluation results in a graphical user interface (operation 1006).

[0104] A determination is made as to whether there are any unestimated information technology services among the identified information technology services (operation 1008). If there are unestimated information technology services, the process returns to operation 1002. Otherwise, the process terminates.

[0105] Based on the results of different IT services, changes can be made in security controls based on recommendations to increase the level of security assurance. Some, none, or all of the recommendations can be based on each IT service. A return on security investment (ROSI) analysis can be used to form implementation plans for recommendations on security controls.

[0106] Next turn Fig.11 , an illustration of a flowchart of a process for managing information technology services is depicted in accordance with an illustrative embodiment. Fig.11 The processes in may be implemented in hardware, software, or both. When implemented in software, the processes may take the form of program code executed by one or more processor units in one or more hardware devices in one or more computer systems. For example, the processes may be implemented in Figure 1 The information technology service manager 110 is implemented in the computer system 112 in the.

[0107] The process begins by determining a current security assurance level for the information technology service related to security in the organization based on assessment information about a group of security factors for the information technology service and performance information about a current group of security controls for the information technology service (operation 1100). The process determines a target security assurance level for the information technology service based on assessment information about the criticality of the information technology service (operation 1102).

[0108] The process displays a graphical representation of the difference between the current security assurance level and the target security assurance level on a display system (operation 1104). When the difference is greater than a threshold, the process displays a graphical indication of an additional security control group that, if implemented for the information technology service, would cause the difference between the current security assurance level and the target security assurance level to be within a desired security assurance level for preventing attacks on the information technology service (operation 1106). The process terminates thereafter.

[0109] Next reference Fig.12 , another illustration of a flowchart of a process for managing information technology services is depicted in accordance with an illustrative embodiment. Fig.12 The processes in may be implemented in hardware, software, or both. When implemented in software, the processes may take the form of program code executed by one or more processor units in one or more hardware devices in one or more computer systems. For example, the processes may be implemented in Figure 1 The information technology service manager 110 is implemented in the computer system 112 in the.

[0110] The process begins by receiving assessment information regarding a set of criticality and security factors of information technology services related to security in an organization (operation 1200 ).

[0111] The process determines a current security assurance level for the information technology service based on the assessment information about the group of security factors for the information technology service and the performance information about the current group of security controls for the information technology service (operation 1202). The process determines a target security assurance level for the information technology service based on the assessment information about the criticality of the information technology service (operation 1204). The process determines a difference between the current security assurance level and the target security assurance level (operation 1206).

[0112] The process compares the difference to a threshold value of a desired security assurance level for preventing attacks on the information technology service (operation 1208). When the difference is greater than the threshold value, the process displays a graphical indication of an additional security control group that, if implemented for the information technology service, would result in a difference between the current security assurance level and the target security assurance level within the desired security assurance level for preventing attacks on the information technology service (operation 1210). The process terminates thereafter.

[0113] Next reference Fig.13 , an illustration of a flowchart of a process for managing secure software products for information technology services is depicted in accordance with an illustrative embodiment. Fig.13The processes in may be implemented in hardware, software, or both. When implemented in software, the processes may take the form of program code executed by one or more processor units in one or more hardware devices in one or more computer systems. For example, the processes may be implemented in Figure 1 The information technology service manager 110 in the computer system 112 in the example can be implemented in the information technology service manager 110 in the computer system 112 in the example. In this example, the security control can be a security software product.

[0114] The process begins by determining a current security assurance level of the information technology service based on evaluation information about a group of security factors of the information technology service and performance information of a security software product of the information technology service (operation 1300). For example, the information technology service for security may be a badge reader system. The badge reader system may include or use a security software product, such as a virus scan, a firewall, or some other suitable software security product.

[0115] In this example, the performance is the performance of the security software product when implemented for the badge reader system. The performance information can be, for example, how often a virus scanner generates false positives when detecting malware or how often a virus scanner misses detecting malware.

[0116] The process determines a target security assurance level for the information technology service based on the criticality of the security software product for the information technology service (operation 1302). The process then determines a difference between the current security assurance level and the target security assurance level (operation 1304). When the difference is greater than a threshold, the process identifies an additional security software product that, if implemented for the information technology service, causes the difference between the current security assurance level and the target security assurance level to be within a desired security assurance level for preventing attacks on the information technology service (operation 1306).

[0117] The process then displays a graphical indication of the additional security software product in a graphical user display on the display system (operation 1308). The process terminates thereafter.

[0118] The flow chart and block diagram in the different embodiments depicted show the architecture, function and operation of some possible embodiments of the equipment and method in the illustrative embodiments.In this regard, each square block in the flow chart or block diagram can represent at least one of a part of a module, section, function or operation or step.For example, one or more in the square block can be implemented as a combination of program code, hardware or program code and hardware.When implemented in hardware, the hardware can, for example, take the form of an integrated circuit, which is manufactured or configured to perform one or more operations in the flow chart or block diagram.When implemented as a combination of program code and hardware, the embodiment can take the form of firmware.Each square block in the flow chart or block diagram can be implemented using a combination of a dedicated hardware system or dedicated hardware that performs different operations and a program code run by dedicated hardware.

[0119] In some alternative implementations of the illustrative embodiments, one or more functions marked in the blocks may not occur in the order marked in the figure. For example, in some cases, two blocks shown in succession may be performed substantially simultaneously, or the blocks may sometimes be performed in reverse order, depending on the functions involved. Moreover, in addition to the blocks shown in the flowchart or block diagram, other blocks may be added.

[0120] Now turn to Fig.14 , depicts an illustration of a block diagram of a data processing system according to an illustrative embodiment. Data processing system 1400 may be used to implement Figure 1 1400. In this illustrative example, data processing system 1400 includes communications framework 1402, which provides communications between processor unit 1404, memory 1406, persistent storage 1408, communications unit 1410, input / output (I / O) unit 1412, and display 1414. In this example, communications framework 1402 takes the form of a bus system.

[0121] Processor unit 1404 is used to execute instructions of software that may be loaded into memory 1406. Processor unit 1404 includes one or more processors. For example, processor unit 1404 may be selected from at least one of a multi-core processor, a central processing unit (CPU), a graphics processing unit (GPU), a physical processing unit (PPU), a digital signal processor (DSP), a network processor, or some other suitable type of processor.

[0122] Memory 1406 and permanent storage 1408 are examples of storage 1416. A storage device is any hardware capable of storing information (such as, for example, but not limited to, at least one of data, program code in functional form, or other suitable information) on a temporary basis, a permanent basis, or both a temporary and a permanent basis. In these illustrative examples, storage 1416 may also be referred to as a computer-readable storage device. In these examples, memory 1406 may be, for example, a random access memory or any other suitable volatile or non-volatile storage device. Persistent storage 1408 may take various forms, depending on the particular implementation.

[0123] For example, permanent storage 1408 may include one or more components or devices. For example, permanent storage 1408 may be a hard drive, a solid state drive (SSD), flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination thereof. The media used by permanent storage 1408 may also be removable. For example, a removable hard drive may be used for permanent storage 1408.

[0124] In these illustrative examples, communications unit 1410 provides for communications with other data processing systems or devices. In these illustrative examples, communications unit 1410 is a network interface card.

[0125] Input / output unit 1412 allows for input and output of data with other devices that may be connected to data processing system 1400. For example, input / output unit 1412 may provide a connection for user input through at least one of a keyboard, a mouse, or some other suitable input device. Additionally, input / output unit 1412 may send output to a printer. Display 1414 provides a mechanism for displaying information to a user.

[0126] Instructions for at least one of an operating system, applications, or programs may be located in storage devices 1416, which are in communication with processor unit 1404 through communications framework 1402. The processes of the different embodiments may be performed by processor unit 1404 using computer-implemented instructions, which may be located in a memory, such as memory 1406.

[0127] These instructions are referred to as program code, computer usable program code, or computer readable program code, which can be read and executed by a processor in processor unit 1404. The program code in different embodiments may be embodied on different physical or computer readable storage media, such as memory 1406 or permanent storage 1408.

[0128] Program code 1418 is located in functional form on computer readable medium 1420, which may be selectively removed and loaded or transferred to data processing system 1400 for execution by processor unit 1404. In these illustrative examples, program code 1418 and computer readable medium 1420 form computer program product 1422. In the illustrative examples, computer readable medium 1420 is computer readable storage medium 1424.

[0129] In these illustrative examples, computer readable storage media 1424 is a physical or tangible storage device used to store program code 1418 rather than a medium that propagates or transmits program code 1418 .

[0130] Alternatively, program code 1418 may be transferred to data processing system 1400 using a computer readable signal medium. Computer readable signal media may be, for example, a propagated data signal containing program code 1418. For example, a computer readable signal medium may be at least one of an electromagnetic signal, an optical signal, or any other suitable type of signal. These signals may be transmitted via a connection such as a wireless connection, a fiber optic cable, a coaxial cable, an electric wire, or any other suitable type of connection.

[0131] The different components illustrated for data processing system 1400 are not meant to provide architectural limitations to the manner in which different embodiments may be implemented. In some illustrative examples, one or more of the components may be incorporated into or otherwise form a part of another component. For example, in some illustrative examples, memory 1406, or portions thereof, may be incorporated into processor unit 1404. The different illustrative embodiments may be implemented in a data processing system that includes components in addition to or in place of those illustrated for data processing system 1400. Fig.14 Other components shown can be varied from the illustrative examples shown. The different embodiments can be implemented using any hardware device or system capable of running program code 1418.

[0132] The description of different illustrative embodiments has been presented for the purpose of illustration and description, and is not intended to be exhaustive or limited to the embodiments in the disclosed form. The different illustrative examples describe components that perform actions or operations. In the illustrative embodiments, the components can be configured to perform the described actions or operations. For example, the components can have a configuration or design for a structure that provides the components with the ability to perform the actions or operations described as being performed by the components in the illustrative examples.

[0133] Thus, illustrative examples provide methods, apparatus, systems, and computer program products for managing information technology services. In one illustrative example, a current security assurance level for an information technology service related to security in an organization is determined based on assessment information about a group of security factors for the information technology service and performance information about a current group of security controls for the information technology service. A target security assurance level for the information technology service is determined based on the assessment information about the criticality of the information technology service. A graphical representation of the difference between the current security assurance level and the target security assurance level is displayed on a display system. When the difference is greater than a threshold, a graphical indication of an additional group of security controls is displayed that, if implemented for the information technology service, would cause the difference between the current security assurance level and the target security assurance level to be within a desired security assurance level for preventing attacks on the information technology service.

[0134] In one or more illustrative examples, using an information technology service manager can improve the way security controls are implemented in an environment or organization. The illustrative examples include improved systems and methods for calculating security assurance levels. In the illustrative examples, an additional factor that is not currently considered with current technology is the environment. In addition, dividing the environment into information technology services also provides a simplified way to recommend security access controls. In addition, the illustrative examples identify differences between current security access levels and target security access levels. These differences can be used to determine what changes have been made to security controls or recommendations for changes.

[0135] Furthermore, the present disclosure includes embodiments according to the following embodiments:

[0136] Embodiment 1. A method for managing information technology services (102), the method comprising:

[0137] Receiving (1200) by a computer system (112) assessment information (114) regarding a criticality (116) and a set of security factors (118) of an information technology service (108) related to security (106) in an organization (104);

[0138] Determining (1202), by a computer system (112), a current security assurance level (120) of the information technology service (108) based on evaluation information (114) of the set of security factors (118) of the information technology service (108) and performance information (122) of a current set of security controls (124) of the information technology service (108);

[0139] determining (1204), by a computer system (112), a target security assurance level (130) for an information technology service (108) based on assessment information (114) regarding a criticality (116) of the information technology service (108);

[0140] determining (1206), by the computer system (112), a difference (132) between the current security assurance level (120) and the target security assurance level (130);

[0141] comparing, by the computer system (112), the difference (132) to a threshold (134) of a desired security assurance level (136) for preventing attacks on the information technology service (108); and

[0142] When the difference (132) is greater than a threshold value (134), a graphical indication (138) of a set of additional security controls (140) is displayed (1210) by the computer system (112), which, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within a desired security assurance level (136) for preventing attacks on the information technology service (108).

[0143] Embodiment 2. The method according to embodiment 1 further includes:

[0144] A graphical representation (208) of a difference (132) between a current security assurance level (120) and a target security assurance level (130) is displayed on a display system (142) by a computer system (112).

[0145] Embodiment 3. The method of embodiment 2, wherein the graphical representation (208) is selected from at least one of a spider chart, a radar chart, a radar chart, an area chart, a histogram, a bar chart, a line chart, or a combination chart.

[0146] Embodiment 4. The method of embodiment 2, wherein when the difference (132) is greater than a threshold (134), a graphical indication (138) of a set of additional security controls (140) is displayed by the computer system (112), the set of additional security controls (140) that, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within a desired security assurance level (136) for preventing attacks on the information technology service (108), the method comprising:

[0147] When the difference (132) is greater than a threshold value (134), displaying, by the computer system (112), a graphical indication (138) of a set of additional security controls (140) that, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within a desired security assurance level (136) for preventing attacks on the information technology service (108); and

[0148] A graphical representation (208) of a difference (132) between the adjusted security assurance level and at least one of the current security assurance level (120) or the target security assurance level (130) is displayed on a display system (142) by the computer system (112).

[0149] Embodiment 5. The method of embodiment 1, wherein when the difference (132) is greater than a threshold (134), a graphical indication (138) of a set of additional security controls (140) is displayed by the computer system (112), the set of additional security controls (140) that, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within a desired security assurance level (136) for preventing attacks on the information technology service (108), the method comprising:

[0150] When the difference (132) is greater than a threshold value (134), a graphical indication (138) is displayed by the computer system (112) having a group of links (210) associated with a group of additional security controls (140) that, if implemented for the information technology service (108), would result in a difference (132) between the current security assurance level (120) and the target security assurance level (130) being within a desired security assurance level (136) for preventing attacks on the information technology service (108), wherein selection of a link (212) in the group of links (210) initiates implementation of a security control (214) corresponding to the link (212).

[0151] Embodiment 6. The method according to embodiment 1 further comprises:

[0152] A set of additional security controls (140) is determined by the computer system (112) which, if implemented for the information technology service (108), would cause a difference (132) between a current security assurance level (120) and a target security assurance level (130) to be within a desired security assurance level (136) for preventing attacks on the information technology service (108).

[0153] Embodiment 7. The method of embodiment 6, wherein determining, by the computer system (112), a set of additional security controls (140) that, if implemented for the information technology service (108), would result in a difference (132) between the current security assurance level (120) and the target security assurance level (130) being within a desired security assurance level (136) for preventing attacks on the information technology service (108), the method comprising:

[0154] A group of additional security controls (140) is determined by a computer system (112) from a list of security controls that is prioritized based on security return on investment, wherein the group of additional security controls (140) if implemented for an information technology service (108) would result in a difference (132) between a current security assurance level (120) and a target security assurance level (130) being within a desired security assurance level (136) for preventing attacks on the information technology service (108).

[0155] Embodiment 8. The method of embodiment 1, wherein the current security control (124) group includes a software security product (302), and wherein determining, by the computer system (112), a current security assurance level (120) of the information technology service (108) based on the assessment information (114) of the security factor (118) group of the information technology service (108) and the performance information (122) of the current security control (124) group of the information technology service (108), the method comprising:

[0156] Determining, by a computer system (112), a current security assurance level (120) of an information technology service (108) based on evaluation information (114) of the group of security factors (118) of the information technology service (108) and performance information (122) of a software security product (302) of the information technology service (108), wherein when the difference (132) is greater than a threshold value (134), displaying, by the computer system (112), a graphical indication (138) of a group of additional security controls (140) that, if implemented for the information technology service (108), would result in a difference (132) between the current security assurance level (120) and a target security assurance level (130) being within a desired security assurance level (136) for preventing attacks on the information technology service (108), the method comprising:

[0157] When the difference (132) is greater than a threshold value (134), a graphical indication (138) of an additional software security product group is displayed by the computer system (112) that, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within a desired security assurance level (136) for preventing attacks on the information technology service (108).

[0158] Embodiment 9. The method according to embodiment 1, wherein the group of security factors (118) is selected from at least one of confidentiality (410), integrity (408), availability (412) or system environment (414).

[0159] Embodiment 10. The method according to embodiment 1, wherein the current security control (124) group is selected from at least one of a software security product (302) or a physical security product (304).

[0160] Embodiment 11. The method of embodiment 1, wherein the organization (104) is selected from one of an airport authority, an airline, a maintenance service, an aircraft manufacturer, a government agency, a company, and a city.

[0161] Embodiment 12. A method (102) for managing information technology services, the method comprising:

[0162] Determining (1100), by a computer system (112), a current security assurance level (120) of an information technology service (108) related to security (106) in an organization (104) based on assessment information (114) about a set of security factors (118) of the information technology service (108) and performance information (122) about a set of current security controls (124) of the information technology service (108);

[0163] determining (1204), by a computer system (112), a target security assurance level (130) for an information technology service (108) based on assessment information (114) regarding a criticality (116) of the information technology service (108);

[0164] displaying (1104), by the computer system (112), on the display system (142), a graphical representation (208) of a difference (132) between the current security assurance level (120) and the target security assurance level (130); and

[0165] When the difference (132) is greater than a threshold value (134), a graphical indication (138) of a set of additional security controls (140) is displayed (1106) by the computer system (112), which, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within a desired security assurance level (136) for preventing attacks on the information technology service (108).

[0166] Embodiment 13. An information technology service management system, comprising:

[0167] Computer system (112);

[0168] An information technology service manager (110) in a computer system (112), wherein the information technology service manager (110) receives assessment information (114) regarding a criticality (116) and a group of security factors (118) of an information technology service (108) related to security (106) in an organization (104); determines a current security assurance level (120) of the information technology service (108) based on the assessment information (114) regarding the group of security factors (118) of the information technology service (108) and performance information (122) regarding a current group of security controls (124) of the information technology service (108); and determines a performance level (120) of the information technology service (108) based on the assessment information (114) regarding the criticality (116) of the information technology service (108). A target security assurance level (130); determining a difference (132) between a current security assurance level (120) and the target security assurance level (130); comparing the difference (132) to a threshold (134) for a desired security assurance level (136) for preventing attacks on an information technology service (108); and when the difference (132) is greater than the threshold (134), displaying a graphical indication (138) of a group of additional security controls (140) that, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within the desired security assurance level (136) for preventing attacks on the information technology service (108).

[0169] Example 14. An information technology service management system according to Example 13, wherein the information technology service manager (110) displays a graphical representation (208) of the difference (132) between the current security assurance level (120) and the target security assurance level (130) on the display system (142).

[0170] Embodiment 15. An information technology service management system according to embodiment 14, wherein the graphical representation (208) is selected from at least one of a spider chart, a radar chart, a radar chart, an area chart, a histogram, a bar chart, a line chart or a combination chart.

[0171] Embodiment 16. An information technology service management system according to embodiment 14, wherein when the difference (132) is greater than a threshold value (134), in a graphical indication (138) of a group of additional security controls (140), if the group of additional security controls (140) is implemented for the information technology service (108), the difference (132) between the current security assurance level (120) and the target security assurance level (130) is within a desired security assurance level (136) for preventing attacks on the information technology service (108), and when the difference (132) is greater than the threshold value (134), the information technology service manager (11 0) displaying a graphical indication (138) of a set of additional security controls (140) that, if implemented for the information technology service (108), would result in a difference (132) between the current security assurance level (120) and the target security assurance level (130) being within a desired security assurance level (136) for preventing attacks on the information technology service (108), and displaying a graphical representation (208) of the difference (132) between the adjusted security assurance level and at least one of the current security assurance level (120) or the target security assurance level (130) on a display system (142).

[0172] Embodiment 17. An information technology service management system according to embodiment 13, wherein, when the difference (132) is greater than a threshold value (134), in a graphical indication (138) of a group of additional security controls (140), if the group of additional security controls (140) is implemented for the information technology service (108), the difference (132) between the current security assurance level (120) and the target security assurance level (130) is within a desired security assurance level (136) for preventing attacks on the information technology service (108), and when the difference (132) is greater than the threshold value (134), the information technology service (108) is The manager (110) displays a graphical indication (138) of a group of links (210) associated with a group of additional security controls (140) that, if implemented for the information technology service (108), would result in a difference (132) between a current security assurance level (120) and a target security assurance level (130) being within a desired security assurance level (136) for preventing attacks on the information technology service (108), wherein selection of a link (212) in the group of links (210) initiates implementation of a security control (214) corresponding to the link (212).

[0173] Example 18. An information technology service management system according to Example 13, wherein the information technology service manager (110) determines a group of additional security controls (140), which, if implemented for the information technology service (108), will cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within the expected security assurance level (136) for preventing attacks on the information technology service (108).

[0174] Example 19. An information technology service management system according to Example 18, wherein, in determining an additional security control (140) group, if the additional security control (140) group is implemented for the information technology service (108), the difference (132) between the current security assurance level (120) and the target security assurance level (130) is within the desired security assurance level (136) for preventing attacks on the information technology service (108), and the information technology service manager (110) determines an additional security control (140) group from a security control list that is prioritized based on security return on investment, wherein the additional security control (140) group, if implemented for the information technology service (108), the difference (132) between the current security assurance level (120) and the target security assurance level (130) is within the desired security assurance level (136) for preventing attacks on the information technology service (108).

[0175] Embodiment 20. An information technology service management system according to embodiment 13, wherein the current security control (124) group includes a software security product (302), and wherein in determining the current security assurance level (120) of the information technology service (108) based on the evaluation information (114) of the security factor (118) group about the information technology service (108) and the performance information (122) of the current security control (124) group about the information technology service (108), the information technology service manager (110) determines the current security assurance level (120) of the information technology service (108) based on the evaluation information (114) of the security factor (118) group about the information technology service (108) and the performance information (122) of the software security product (302) of the information technology service (108); and wherein when the difference (132) is greater than the threshold value (13 4), in displaying a graphical indication (138) of an additional security control group (140), if the additional security control group (140) is implemented for the information technology service (108), the difference (132) between the current security assurance level (120) and the target security assurance level (130) is within the desired security assurance level (136) for preventing attacks on the information technology service (108), and when the difference (132) is greater than a threshold value (134), the information technology service manager (110) displays a graphical indication (138) of an additional software security product group, which, if implemented for the information technology service (108), causes the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within the desired security assurance level (136) for preventing attacks on the information technology service (108).

[0176] Embodiment 21. An information technology service management system according to embodiment 13, wherein the group of security factors (118) is selected from at least one of confidentiality (410), integrity (408), availability (412) or system environment (414).

[0177] Embodiment 22. An information technology service management system according to embodiment 13, wherein the current security control (124) group is selected from at least one of a software security product (302) or a physical security product (304).

[0178] Embodiment 23. The information technology service management system of embodiment 13, wherein the organization (104) is selected from one of an airport authority, an airline, a maintenance service, an aircraft manufacturer, a government agency, a company, and a city.

[0179] Many modifications and variations will be apparent to those of ordinary skill in the art. In addition, different illustrative embodiments may provide different features than other desired embodiments. The selected one or more embodiments are chosen and described in order to best explain the principles of the embodiments, the practical application, and to enable others of ordinary skill in the art to understand the disclosure of various embodiments with various modifications as are suited to the intended specific use.

Claims

1. A method for managing information technology services (102), the method comprising: Receiving (1200) by a computer system (112) assessment information (114) regarding a criticality (116) and a set of security factors (118) of an information technology service (108) related to security (106) in an organization (104); determining (1202), by the computer system (112), a current security assurance level (120) of the information technology service (108) based on the assessment information (114) regarding the set of security factors (118) of the information technology service (108) and performance information (122) regarding the set of current security controls (124) of the information technology service (108); determining (1204), by the computer system (112), a target security assurance level (130) for the information technology service (108) based on the assessment information (114) regarding the criticality (116) of the information technology service (108); determining (1206), by the computer system (112), a difference (132) between the current security assurance level (120) and the target security assurance level (130); comparing, by the computer system (112), the difference (132) to a threshold (134) of a desired security assurance level (136) for preventing attacks on the information technology service (108); determining, by the computer system, an additional set of security controls that, if implemented for the information technology service, would cause the difference between the current security assurance level and the target security assurance level to be within the desired security assurance level for preventing the attack on the information technology service; when the difference (132) is greater than the threshold (134), displaying (1210), by the computer system (112), a graphical indication (138) of a group of additional security controls (140) having an associated group of links that, if implemented for the information technology service (108), would result in the difference (132) between the current security assurance level (120) and the target security assurance level (130) being within the desired security assurance level (136) for preventing the attack on the information technology service (108); and By selecting a link, enforcement of the security control corresponding to the link in the associated set of links is initiated.

2. The method according to claim 1, further comprising: A graphical representation (208) of the difference (132) between the current security assurance level (120) and the target security assurance level (130) is displayed on a display system (142) by the computer system (112).

3. The method of claim 2, wherein the graphical representation (208) is selected from at least one of a spider chart, a radar chart, a radar graph, an area chart, a histogram, a bar chart, a line chart, or a combination chart.

4. The method according to claim 2, wherein: When the difference (132) is greater than the threshold (134), displaying, by the computer system (112), the graphical indication (138) of the set of additional security controls (140) that, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within the desired security assurance level (136) for preventing the attack on the information technology service (108), the method comprising: displaying, by the computer system (112), the graphical indication (138) of the set of additional security controls (140) that, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within the desired security assurance level (136) for preventing the attack on the information technology service (108), when the difference (132) is greater than the threshold (134); and A graphical representation (208) of the difference (132) between the adjusted security assurance level and at least one of the current security assurance level (120) or the target security assurance level (130) is displayed on a display system (142) by the computer system (112).

5. The method of claim 1, wherein determining, by the computer system (112), the set of additional security controls (140) that, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within the desired security assurance level (136) for preventing the attack on the information technology service (108), the method comprising: The computer system (112) determines the group of additional security controls (140) from a list of security controls, the list of security controls being prioritized based on security return on investment, wherein the group of additional security controls (140), if implemented for the information technology service (108), results in the difference (132) between the current security assurance level (120) and the target security assurance level (130) being within the desired security assurance level (136) for preventing the attack on the information technology service (108).

6. The method of claim 1, wherein the current set of security controls (124) includes a software security product (302), and wherein determining, by the computer system (112), the current security assurance level (120) of the information technology service (108) based on the assessment information (114) about the set of security factors (118) of the information technology service (108) and performance information (122) about the current set of security controls (124) of the information technology service (108), the method comprising: Determining, by the computer system (112), the current security assurance level (120) of the information technology service (108) based on the assessment information (114) regarding the group of security factors (118) of the information technology service (108) and the performance information (122) of the software security product (302) of the information technology service (108), wherein when the difference (132) is greater than the threshold (134), displaying, by the computer system (112), the graphical indication (138) of the group of additional security controls (140) that, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within the desired security assurance level (136) for preventing the attack on the information technology service (108), the method comprising: When the difference (132) is greater than the threshold (134), the graphical indication (138) of the additional software security product group is displayed by the computer system (112), which, if implemented for the information technology service (108), causes the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within the desired security assurance level (136) for preventing the attack on the information technology service (108).

7. The method according to any one of claims 1 to 6, wherein the current security control (124) group is selected from at least one of a software security product (302) or a physical security product (304).

8. The method of claim 1, wherein the organization (104) is selected from one of an airport authority, an airline, a maintenance service, an aircraft manufacturer, a government agency, a corporation, and a city.

9. An information technology service management system, comprising: Computer system (112); The computer system (112) includes an information technology service manager (110); The information technology service manager (110) is configured as follows: receiving assessment information (114) regarding a criticality (116) and a set of security factors (118) of an information technology service (108) related to security (106) in an organization (104), such that the assessment information includes a percentage of time that the information technology service can protect itself when security controls of a network surrounding the information technology service are unavailable; Determining a current security assurance level (120) of the information technology service (108) based on the assessment information (114) about the set of security factors (118) of the information technology service (108) and performance information (122) about the set of current security controls (124) of the information technology service (108); determining a target security assurance level (130) for the information technology service (108) based on the assessment information (114) regarding the criticality (116) of the information technology service (108); determining a difference (132) between the current security assurance level (120) and the target security assurance level (130); comparing the difference (132) to a threshold (134) of a desired security assurance level (136) for preventing attacks on the information technology service (108); determining an additional set of security controls that, if implemented for the information technology service, would cause the difference between the current security assurance level and the target security assurance level to be within the desired security assurance level for preventing the attack on the information technology service; and When the difference (132) is greater than the threshold (134), a graphical indication (138) of a group of additional security controls (140) and an associated group of links is displayed, wherein the group of additional security controls (140), if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within the desired security assurance level (136) for preventing the attack on the information technology service (108), wherein selection of a link in the associated group of links initiates implementation of the security control corresponding to the link.

10. An information technology service management system according to claim 9, wherein the information technology service manager (110) displays a graphical representation (208) of the difference (132) between the current security assurance level (120) and the target security assurance level (130) on a display system (142), wherein the graphical representation (208) is selected from at least one of a spider chart, a radar chart, a radar chart, an area chart, a histogram, a bar chart, a line chart, or a combination chart.

11. The information technology service management system according to claim 10, wherein: When the difference (132) is greater than the threshold (134), in the graphical indication (138) displaying the set of additional security controls (140), the set of additional security controls (140), if implemented for the information technology service (108), would result in the difference (132) between the current security assurance level (120) and the target security assurance level (130) being within the desired security assurance level (136) for preventing the attack on the information technology service (108), and when the difference (132) is greater than the threshold (134), the information technology service manager (110) displays the additional security controls (140) in a graphical indication (138) displaying the set of additional security controls (140). 140) group, wherein the additional security controls (140) group, if implemented for the information technology service (108), results in the difference (132) between the current security assurance level (120) and the target security assurance level (130) being within the desired security assurance level (136) for preventing the attack on the information technology service (108), and a graphical representation (208) of the difference (132) between the adjusted security assurance level and at least one of the current security assurance level (120) or the target security assurance level (130) being displayed on a display system (142).

12. The information technology service management system according to any one of claims 9 to 11, wherein: When the difference (132) is greater than the threshold value (134), in the graphical indication (138) of the set of additional security controls (140), the set of additional security controls (140), if implemented for the information technology service (108), would result in the difference (132) between the current security assurance level (120) and the target security assurance level (130) being within the desired security assurance level (136) for preventing the attack on the information technology service (108), and when the difference (132) is greater than the threshold value (134), the graphical indication (138) of the set of additional security controls (140) is displayed. threshold (134), the information technology service manager (110) displays the graphical indication (138) having a group of links (210) associated with the group of additional security controls (140) which, if implemented for the information technology service (108), would cause the difference (132) between the current security assurance level (120) and the target security assurance level (130) to be within the desired security assurance level (136) for preventing the attack on the information technology service (108).

13. The information technology service management system of claim 9, wherein the organization (104) is selected from one of an airport authority, an airline, a maintenance service, an aircraft manufacturer, a government agency, a corporation, and a city.

Images