Evaluation and Measurement of Cyber Security Risks

Abstract

Describe the cross-domain monitoring service. The cross-domain monitoring service can receive a request from a requester to associate a set of attributes with a predetermined set of access control sets of users for computing resources of a domain, and the set of attributes includes at least one of read access privilege, write access privilege, or execution access privilege for the computing resources. In response to a determination that the requester has the privilege to associate the set of attributes with a predetermined set of access control sets of users, the cross-domain monitoring service can update the access control set using the association to the set of attributes, and by updating the access control set, one or more cryptographic keys associated with the access control set receive the set of attributes.

Description

Background Art

[0001] Companies and other organizations typically have computer infrastructures connected to networks including the Internet. Therefore, their infrastructures are exposed to cyber security attacks. Cyber security attacks range from pranks by mischievous individuals to organized crime and, in some cases, government agencies seeking to exploit or cause harm to data. According to Norton LifeLock (trademark), more than 2,200 cyber security attacks occur every day in 2021, with one attack occurring on average every 39 seconds. The more well-known a company or organization is, the higher the likelihood of an attack.

[0002] Therefore, companies and businesses have been trying to prevent damage caused by cyber security attacks. The determination of insurance compensation amounts can be made through techniques for evaluating the costs of successful cyber security attacks, ranging from the repair and recovery of web pages to the costs of responding to data breaches. However, the ability to determine insurance premiums is based on the ability of insurance providers to create accurate actuarial tables and statistics for measuring the risk of attacks.

[0003] One of the difficulties in calculating cyber security risk statistics is that there is currently no deterministic method for quantifying the number of cyber security attacks and successful cyber security attacks that a company or business receives. Specifically, a company may be subject to cyber security attacks that go undetected for months or years. Furthermore, some failed cyber security attacks go undetected. Therefore, even if, in reality, 2 out of 19 attacks are successful, a company may believe that 0 out of 5 attacks are successful. Companies and businesses, insurance companies, and other stakeholders are, to some extent, in the position of having to "prove a negative" that a cyber security attack has not been successful.

[0004] For these and similar reasons, it is necessary to deterministically evaluate and measure the frequency and success of cyber security attacks.

Brief Description of the Drawings

[0005] The detailed description will be described with reference to the accompanying drawings. In the drawings, the leftmost digit of a reference number identifies the drawing in which that reference number first appears. The use of the same reference number in different drawings indicates similar or identical items or features.

[0006]

Figure 1

[0007]

Figure 2

[0008]

Figure 3

[0009]

Figure 4

Modes for Carrying Out the Invention

[0010] Background of the Evaluation and Measurement of Cyber Security Risks Measurement assumes defining what to measure, i.e., defining the object of measurement. When evaluating and measuring cyber attacks, this can mean identifying everything from data theft to service impairment or denial to computing resources, or simply a security violation where a malicious or other unauthorized user accesses computing resources.

[0011] Prior art services had various drawbacks. First, there was no comprehensive investigation of the activities of all computing resources. In some cases, prior art parties might monitor the activities of data files and applications. Other prior art parties might monitor the activities of some, but not all, computing resources, such as registry keys of the Microsoft Windows (trademark) operating system. However, if not all activities of all computing resources were monitored, there was always a possibility that an event could occur where an unauthorized and potentially malicious party accessed the computing resources. If that computing resource was not being monitored, the access was not detected and thus not measured, whether or not it was permitted.

[0012] To address this drawback, the present disclosure describes a cross - domain monitoring service called quantum security service ("QSS") access to all resources, not just data files and applications. Specifically, if there are computing resources that can be accessed by an application programming interface (API), the API activities and access to the resources are monitored. Computing resources include, but are not limited to, data files, applications, memory access, communication channels, process / thread creation functions, and other activities available to a program. Previously, it may not have been practical to store monitoring data this comprehensively due to memory capacity limitations, but with the advent of large - scale storage capabilities in the cloud, it is now possible.

[0013] Unauthorized persons need to use the API, and by tracking all APIs and the resources accessible through the APIs, unauthorized persons will leave detectable traces. In this way, QSS can detect unauthorized access even when unauthorized persons do not modify data files or use applications.

[0014] Second, the resource monitoring was specific to the domain first accessed by the monitor. Therefore, when a data file was transferred from the first domain to the second domain, the monitor could detect unauthorized activities while the data file was within the first domain, but not while it was within the second domain. Therefore, when the data file was returned from the second domain, the returned data file was not fully trustworthy.

[0015] To solve this problem, QSS adopts a multi-level global quantum key management system. Specifically, QSS implements a hierarchy of keys with a scope that exceeds a single domain. The keys may be disposable keys. To make the management of these keys practical, QSS is equipped with a new key management system for efficiently performing attribute changes and access control. This key management system will be described in more detail with reference to FIGS. 3 and 4 below.

[0016] Third, activity monitoring has been premised on the scope of activities being monitored being specific to certain devices such as personal computers and laptops. For example, registry key monitoring is specific only to a particular installation of Microsoft Windows (trademark) on a particular computer. This assumption conflicts with the current reality of cloud computing. In particular, in cloud computing, virtual machines and containers are instantiated and discarded on demand, creating a so-called "elastic cloud." All computing resources, including the temporary resources of elastic computing, should be monitored, but the focus has not been on the deliverables of cloud computing such as microservices and network data communication channels.

[0017] Therefore, QSS treats cloud resources as the main resources to be monitored. Currently, the most common way to access cloud resources is through cloud APIs, such as those implemented via JScript. QSS monitors access requests to APIs by monitoring OAuth 2.0 and similar token-based authentication exchanges. Next, QSS monitors the programmatic calls to these APIs. Finally, at the locations where data is sent and received, cloud-specific formats such as JSON-formatted data are also monitored. Note that lower-level activities represented by underlying operating system API calls are also monitored. Therefore, if the QSS monitor does not detect malicious activities at the cloud API level, the QSS monitor may instead detect malicious activities at the operating system API level. In this way, a form of defense in depth is achieved. Furthermore, when it is very difficult to interpret activities at the operating system API level, monitoring activities from the context of cloud activities reveals whether the activities are malicious. For example, there may be a series of operating system calls to open some communication ports and transfer data. However, if these calls are considered to access servers, authentication servers, and web services via an OAuth 2.0 exchange, it becomes clear that a rule engine or analysis engine needs to evaluate the activities in that context.

[0018] The fourth is that the encryption key can be compromised by state-of-the-art cyberattacks. Specifically, traditional encryption keys are generally created by a hash algorithm that uses a randomly generated seed value. However, the automatic generation of random numbers is an incredibly difficult problem. If the security of the generated encryption key is based on the distribution of the randomly generated seed, and the randomly generated seed supports one side of the distribution, the encryption keys may be close to each other. For example, if a party is using a 256-bit key, it can be assumed that there is 256-bit security. However, if the randomly generated seed is clustered within a 48-bit field for some reason, the party actually has 48-bit security and may be compromised by an attack that knows to focus on that 48-bit field. This is of course an extreme example, but cyberattacks can overcome statistically difficult problems by shrinking the size of the field.

[0019] To address this drawback, QSS employs a quantum seed generator. The quantum seed generator uses quantum computing to smoothly disperse the seed of the encryption key without clustering. In this way, when it is known that the encryption key hash or key generation algorithm evenly disperses the key across the field, the input seed is guaranteed to evenly disperse the seed across the field, so the party can be confident that the security of the encryption key is actually based on the size of the field.

[0020] This brief description is not intended to comprehensively enumerate the advantages and benefits of QSS, but rather to show the situation and approach underlying QSS. Additional advantages and merits of QSS are described in other sections.

[0021] Platform for the Evaluation and Measurement of Cybersecurity Risks QSS can be considered as a cloud-based potential service that manages keys and monitors the activities of a series of subscribed domains. Figure 1 is a diagram of an exemplary platform for the evaluation and measurement of cyber security risks.

[0022] Figure 1 is Diagram 100 of the situation of the evaluation and measurement of cyber security risks. Specifically, the situation is the situation of Cloud 102. Cloud 102 is a set of virtual machines and containers with network addresses exposed to the Internet via a hypervisor. The cloud infrastructure will be described in more detail with respect to Figure 2 below.

[0023] In Cloud 102, there may be one or more domains 104a, b...n owned by subscribers of the QSS service. Each of the domains 104a, b...n has its own applications 106a, b...n and its own data files 108a, b...n. Beyond the applications 106a, b...n and the data files 108a, b...n, each domain has its own computing resources (not shown) including domain data file and thread management, memory, persistent storage (such as hard drives and solid state drives), input / output resources, and communication channels (such as ports). Generally, in the context of QSS, an object is considered a computing resource if it can be programmatically accessed via an API. The reason is that if the object cannot be accessed via an API, there is no way for malicious parties to access the object, and for the purposes of QSS, it need not be tracked and may not actually be trackable at all.

[0024] In some embodiments, domains 104a, b…n may each have one or more agents 110a, b…n that perform global quantum key management, encryption, and decryption services, and optionally provide computing capabilities for monitoring activities within domains 104a, b…n. The agents can have a scope across the entire domain or, alternatively, a scope limited to a set of applications or a single application. There are many ways in which agents 110a, b…n can monitor APIs. In one embodiment, each operating system API can be targeted by a journaling hook, where the operating system call and the journaling hook handler are configured to take a trace of each API call. In other embodiments, the operating system may already have a monitoring function for agents 110a, b…n to participate in. For example, the Microsoft Windows™ operating system has a Windows Management Interface (WMI) module that can be used to monitor some API calls.

[0025] Agents 110a, b…n also include program functions for finding and accessing QSS functions, such as operating as a broker. Note that such key management, encryption, decryption, and mediation services need not be within domains 104a, b…n and may be managed by services external to the domain. However, having local functions in the form of one or more agents 110a, b…n can create a more performant embodiment by limiting the number and distance of network transactions to such services external to domains 110a, b…n.

[0026] Quantum Security Service (QSS) 112 also resides in cloud 102. QSS is implemented as one or more cloud services and may be programmatically exposed via a Web API. In some embodiments, QSS may be a set of microservices. A part of QSS that interfaces with domains 110a, b...n is cross-domain service 114. Cross-domain service 114 is composed of global quantum key manager 116 and monitor 118. Global quantum key manager 116 receives requests for generation and provision of cryptographic keys, requirements such as single use, and management requests for attributes of the generated cryptographic keys. Global quantum key manager 116 will be described in more detail with respect to FIGS. 3 and 4.

[0027] Monitor 118 aggregates data collected by agents 110a, b...n or data directly reported by domains via applications 106a, b...n. Monitor 118 can store all data or a selected subset of data in event data store 120. Event data store 120 may be a dedicated storage server or may be implemented as one or more storage clusters within cloud 102. Further, event data store 120 may be a database management system such as a relational database management system, thereby providing an indexing function. Cloud services and databases will be described in more detail with respect to FIG. 2 below.

[0028] When monitor data is stored in the event data store 120, the stored data is subject to analysis via the analysis engine 122. The analysis engine 122 utilizes machine learning and cognitive network algorithms to create a set of rules. These rules are used to determine whether a malicious event has occurred. For example, the monitor 118 can store in the event data store 120 data indicating that a predetermined number of files have been quickly encrypted, and the analysis engine 122 can trigger a response that interprets the event as a ransomware attack. Similarly, the monitor 118 can store in the event data store 120 data indicating that a predetermined threshold of access requests to the same set of localized communication network ports is being accessed by a discrete set of network addresses, and the analysis engine 122 can trigger a response that interprets the event as a distributed denial of service (DDoS) attack.

[0029] The response requested by the analysis engine 122 is executed via the feedback engine 124. The feedback engine 124 can deploy a predetermined repair response in response to the request. The repair can be executed by a single call or can be a script of calls that make up the repair. The repair response may be manually programmed by an administrator and received from the feedback engine.

[0030] The interpretation of data by the analysis engine 122, the repair response by the feedback engine 124, and other states such as those provided by the global quantum key manager 116 are reported via the reporting engine 126. Reports from the reporting engine 126 may be pre-programmed. Alternatively, the reporting engine 126 may be implemented as a dynamic query function such as that provided via a relational database management system.

[0031] The feedback engine 124 obtains inputs from two sources. The first is the global quantum key manager 116, and the second is the analysis engine 122. In particular, the global quantum key manager 116 sets access control to computing resources and tracks access to those computing resources. Thus, the global quantum key manager 116 provides static and semi-static state information regarding what is permitted for computing resources. Specifically, whether a particular data file is accessed only by Alice and Bob and not by Carol is tracked by the global quantum key manager 116. This is a static state. However, if Carol is also permitted access and Ted is not, this change is also tracked by the global quantum key manager 116 and represents a semi-static state. Based on general access control and key attributes, the feedback engine 124 can more accurately interpret the data stored in the event data store 120 with the increase in situational information. The global quantum key manager 116 is described in more detail with respect to FIGS. 3 and 4 below.

[0032] The analysis engine 122 provides a dynamic aspect to the feedback engine 124. Specifically, when the data in the event data store 120 is interpreted by the analysis engine 122, the analysis engine 122 can request a repair response from the feedback engine 124. The feedback engine 124 maps repair requests from another QSS 112 software component such as the analysis engine 122, or from the management console 128, to pre-programmed responses and executes those pre-programmed responses.

[0033] The management console 128 provides functions for the administrator 130 to review the QSS 112 and intervene as needed. The management console 128 is used to execute both static reports and dynamic queries via the reporting engine 126, add responses to the feedback engine 124, review and modify the rules within the analysis engine 122, and manually manage keys via the global quantum key manager 116 as needed.

[0034] The above is only one potential implementation of QSS for the evaluation and measurement of cybersecurity risks and is not intended to be limiting.

[0035] Exemplary environment for the evaluation and measurement of cybersecurity risks Before explaining the evaluation and measurement of cybersecurity risks, an exemplary hardware, software, and communication computing environment will be described in FIG. 200 via FIG. 2. Specifically, the functions for the evaluation and measurement of cybersecurity risks are generally hosted on a computing device. Exemplary computing devices include, but are not limited to, personal computers, laptops, embedded devices, tablet computers, smartphones, and virtual machines. In many cases, the computing device is networked.

[0036] One computing device may be a client computing device 202. The client computing device 202 may have a processor 204 and a memory 206. The processor may be a central processing unit, a reused graphics processing unit, and / or a dedicated controller such as a microcontroller. The client computing device 202 may further include an input / output (I / O) interface 208 and / or a network interface 210. The I / O interface 208 may be any controller card such as a universal asynchronous receiver / transmitter (UART) used with a standard I / O interface protocol such as RS-232 and / or Universal Serial Bus (USB). The network interface 210 may potentially operate in cooperation with the I / O interface 208 and may be a network interface card that supports Ethernet and / or Wi-Fi and / or any number of other physical and / or data link protocols.

[0037] The memory 206 is any computer-readable medium capable of storing software components including an operating system 212, a software library 214, and / or a software application 216. Generally, a software component is a set of computer-executable instructions stored together as a discrete whole. Examples of software components include binary executable programs such as static libraries, dynamic link libraries, and executable programs. Other examples of software components include interpreted executable programs such as servlets, applets, p-Code binaries, and Java binaries that are executed at runtime. The software component can execute in kernel mode and / or user mode.

[0038] Computer-readable media includes at least two types of computer-readable media, namely, computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical storage devices, magnetic cassettes, magnetic tape, magnetic disk storage devices or other magnetic storage devices, or any other non-transmission media that can be used to store information for access by a computing device, but is not limited thereto. In contrast, communication media can embody computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transmission mechanisms. As defined herein, computer storage media does not include communication media.

[0039] Server 218 is any computing device that can participate in a network. The network can be, but is not limited to, a local area network ("LAN"), a virtual private network ("VPN"), a cellular network, or the Internet. Server 218 is similar to the host computer with respect to the image capture function. Specifically, it includes a processor 220, a memory 222, an input / output interface 224, and / or a network interface 226. In the memory, there is an operating system 228, a software library 230, and a server-side application 232. The server-side application includes a database including a file server and a relational database. Accordingly, server 218 may have a data store 234 including one or more hard drives or other persistent storage devices.

[0040] The services on cloud 236 can provide the services of server 218. Generally, the server may be a physical dedicated server or may be embodied within a virtual machine. In the latter case, cloud 236 may represent a plurality of subdivided servers that provide the functions of virtual application server 239 and virtual storage / database 240. The subdivided servers can be physical computer servers having a processor, a memory, an I / O interface, and / or a network interface. The characteristics and variations of the processor, the memory, the I / O interface, and the network interface are substantially the same as those described for server 218. The difference is the location where the subdivided servers are optimized for throughput and / or subdivision.

[0041] Cloud 236 services 238 and 240 can be made accessible via an integrated cloud infrastructure 242. Cloud infrastructure 242 not only provides access to cloud services 238 and 240, but also provides access to billing services and other monetization services. Cloud infrastructure 242 can provide additional service abstractions such as platform as a service ("PaaS"), infrastructure as a service ("IaaS"), and software as a service ("SaaS").

[0042] Global Quantum Key Management for Cyber Security Risk Assessment and Measurement In QSS 112, as described above, efficient management of quantum keys, which are cryptographic keys using quantum seeds, is one of the issues. Quantum seeds can be accessed through third-party services or open-source quantum seed services. When accessing computing resources, one or more quantum keys can be associated with the computing resources. In some cases, the quantum keys can also be used alone.

[0043] As a result, quantum keys are frequently associated with attributes and computing resources. In high-performance systems, it is necessary to associate keys with resources and attributes. The global quantum key manager 116 utilizes a new directory system to achieve performance and scalability.

[0044] Figure 3 is a diagram 300 showing an example of this directory system. The data owner 302 has a set of privileges for one or more computing resources. As described above, computing resources are not necessarily only data files and applications, but can be anything that can be programmatically accessed via an API and thereby tracked.

[0045] Computing resources are associated with one or more access control sets 304. The access control set 304 is a set of all attributes associated with an access control set 304 for a given set of users that may include the data owner 302. For example, if there is a data file X and it is associated with an access control set 304a, it is associated with the attributes 306 A1 of all users within the access control set 304a.

[0046] However, the data file X can also be associated with an access control set 304b. This is associated with the attributes 308 A2 of all users within the access control set 304b. It is also possible to associate the attributes 310 A3 of all users within the access control set 304c. Note that the attributes 308 A2 and the attributes 310 A3 may be different from the attributes 306 A1. This is because the access control set 304 has a scope of computing resources associated with the user. An example of an attribute is that all users of the access control set 304b have read access rights to the data file X.

[0047] Similarly, if data file X is associated with access control set 304c, then that data file is associated with attribute 310 A3. Thus, all users associated with 304c can access data file X and can access other computing resources associated with access control set 304c with all the permissions associated with attribute A3.

[0048] A feature of access control set 304 is that when a quantum key is generated by global quantum key manager 116, the generated key is associated with a computing resource. A way to do this quickly is to associate the key with access control set 304. Thus, the association may be done in a single step.

[0049] Access control set 304 is hierarchical, and child access control sets 304 inherit attributes from a parent access control set 304. In FIG. 3, access control sets 304d and 304e are children of access control set 304b. Similarly, access control sets 304g and 304h are children of access control set 304d. Access control set 304d has associated attributes 312 B1 and C1. Note, however, that access control set 304d also inherits attribute 308 A2, so it has attributes A2, B1, and C1. This is in contrast to access control set 304e, which has associated attributes 314 B2 and C2 and inherits attribute 308 A2, so it has attributes A2, B2, and C2.

[0050] This situation can continue indefinitely. Suppose access control sets 304g and 304h are associated with attributes 316 D1 and E1, and attributes 318 D2 and E2, respectively. By inheritance, access control set 304g is associated with attributes A2, B1, C1, D1, and E1, and access control set 304h is associated with attributes A2, B1, C1, D2, and E2.

[0051] The hierarchical structure provides the advantage of fast propagation of attributes. For example, assume that a global quantum key manager generates two disposable quantum keys. The generated keys can be associated with children within the access control set 304g corresponding to the request. A user accesses a file and associates one of the generated disposable keys with that file and can use that disposable key. However, in the meantime, an administrator changes an attribute in the parent access control set (such as access control set 304b). This change is propagated to the access control set 304g via inheritance. As a result, when a subsequent user accesses another file associated with the access control set 304g and accesses the generated disposable key, the event is interpreted according to the updated attribute. This process is described in more detail with respect to FIG. 4.

[0052] In practice, the global quantum key manager 116 utilizes global keys. This is done by potentially aggregating standard cryptographic keys. Due to the hierarchical structure of key management, different keys can be aggregated by different access control sets 304. Thus, a first key can be associated with 304b, another key with 304d, and a third key with 304g. In this way, the verification of the access control set 304 can be done only by checking a single key associated with that access control set 304, rather than all keys within the access control set inheritance chain.

[0053] The hierarchical structure used by the global quantum key manager 116 can be configured to follow the corporate organization. For example, there are corporate level, department level, manager level, team level, and individual staff level. Also, there may be a global level above the corporate level. Consider the case where a party has died. If the party is associated with the top access control set 304, the associated data may be permanently locked. However, at the upper global level, overwriting may occur. Similarly, in the case of a corporation, there may be a situation where law enforcement agencies request access to specific data files. Here too, at the global level, overwrite permissions are provided to access data files that cannot be accessed otherwise.

[0054] Also, in practice, the global quantum key manager 116 is distributed and / or decentralized. A distributed infrastructure for networked resource directory functions such as Microsoft (trademark) LDAP / Open Directory and Active Directory can be used to perform associations in a distributed manner. When attributes are decentralized, a distributed database such as CouchDB, or even a blockchain, can be used to implement decentralization and consensus.

[0055] Dynamic response for cyber security risk assessment and measurement Figure 4 is a flowchart of an exemplary operation of the global quantum key manager 116, including the propagation of changes to the access control set 304.

[0056] In block 402, the global quantum key manager 116 receives a first request from a requester (e.g., a data owner) to associate a first set of attributes with the access control set 304. Examples of attributes may be read access, write access, or execution access to a data file. For computing resources such as communication ports or memory access, other resource-specific privileges may apply. In practice, many operating systems such as Unix, Microsoft Windows (trademark), etc. analogize access to computing resources as files. For example, in the Microsoft Windows (trademark) API, CreateFile() can be used to access a communication channel.

[0057] In block 404, the global quantum key manager 116 verifies that the requester is actually the data owner or, if not, authenticates the requester as having privileges. In this case, not only are the attributes updated, but any cryptographic keys associated with the access control set 304 are also immediately received (e.g., inherited) by association in a disposable or other manner with these attributes.

[0058] In block 406, in some embodiments, changes to the access control set 304 are propagated to the subset. However, in one embodiment, the propagation occurs automatically. Specifically, resources on a child access control set such as 304g are associated with keys from its parent, specifically 304d and 304b. Thus, if the attributes of 304b are changed and 304g is already associated with 304b by having a key from 304b, there is no change to propagate.

[0059] In block 408, in some embodiments, the analysis engine 122 may be notified of changes by the global quantum key manager 116. In this way, the analysis engine 122 may immediately change the rules for interpreting received events. However, in alternative embodiments, the analysis engine 122 may simply receive the events and add the attributes of the associated subject access control set 304, which may potentially be associated with the cryptographic keys of each respective access control set 304, thereby not requiring notification.

[0060] Specifically, by simply using the attributes of the access control set 304 as another set of observables, any machine learning or cognitive network algorithms used by the analysis engine 122 will automatically take those attributes into account.

[0061] In block 410, the monitor 118 detects events and stores those events in the event data store 120. Next, in block 412, the analysis engine 122 analyzes these events to determine whether a harmful event or other event has occurred. In block 414, the analysis engine 122 sends a repair request to the feedback engine 124, and the feedback engine 124 searches for the relevant repair actions or scripts previously programmed by the administrator 130. The processes of blocks 410, 412, and 414 are further described with respect to FIG. 1 above.

[0062] In block 416, the global quantum key manager 116 receives a second request from the data owner to associate a second set of attributes with the same access control set 304. At this point, blocks 402 - 414 are repeated.

[0063] One of the results of the multiple-key configuration of the global quantum key manager 116 is noted to be speed and scalability. Data file X can be associated with access control set A and access control set B. Both A and B can have their own disposable keys. A and B can also have their own attributes. By associating data file X with both A and B, when the key of A is changed, data file X is changed. A propagation mechanism is not necessary. As described above, when the analysis engine 122 treats attributes as other observables for the applied machine learning or cognitive network algorithms, no notification is required between the global quantum key manager 116 and the analysis engine 122.

[0064] Deterministic Cyber Security Risk Assessment and Measurement Next, the risk assessment and measurement will be described. As described above, in the conventional system, statistics regarding recognized cyber security violations and harmful events were maintained. This was based on the premise that the violation or harmful event was recognized immediately. This is not the case because many violations and harmful events are not detected for months or years.

[0065] In QSS 112, all API events are tracked. If there are cloud APIs, application APIs, and operating system APIs, all are tracked, enabling detailed detection. Since all API events are tracked, QSS 112 can provide better statistics.

[0066] Specifically, assume there is a situation where it is necessary to determine the risk of a distributed denial of service (DDoS) attack. When a DDoS occurs, the enterprise recognizes it. That is, operations stop. However, if it is desired to detect a preliminary probe by a malicious actor before the DDoS, the conventional system may not be able to detect such an intrusion.

[0067] By sharing data across domains, QSS 112 can assume that a particular observed pattern is a precursor to DDoS from a successful DDoS in one domain. By observing those patterns in other domains, QSS 112 can confirm that the pattern is actually a precursor to DDoS.

[0068] This has several results. First, QSS 112 can measure the occurrence rate of this pattern that has not been observed before. In fact, this pattern can be applied to historical data to determine whether a violation or harmful event has occurred, and at that time it was simply not recognized. Second, QSS 112 can set rules to repair this pattern. For example, the IP port address can be rotated. Third, QSS 112 can provide statistics on the likelihood of DDoS based on this pattern information. Fourth, QSS 112 can refer to low-level operating system APIs to determine how the pattern is affected. In this way, the basic defensive weaknesses of cyber security can be identified and thereby repaired.

[0069] The detection of violations and harmful events is essentially qualitative. QSS 112 is suitable for quantitative measurements. As described above, by accessing a global data set, QSS 112 can determine the total set of actual and potential events, and thereby has the best ability to create percentage or statistical risk measurements. Traditional systems that simply measure actual events did not have a denominator (i.e., the number of potential events) for calculating risk. Furthermore, QSS 112 can evaluate data historically (by applying new patterns to historical data to determine whether there were violations or harmful events not detected in the past), and thus can generate an appropriate numerator (i.e., the number of actual events).

[0070] Measurements of this level are suitable for performing statistical calculations. Recall that there are various types of measurements. One type of measurement is simply classifying problems (e.g., red, blue, green). More advanced measurements order the categories (e.g., good, better, best). Note that while the order is shown, we have no way of saying how much better. We only know that better than good is higher in the order. In more advanced measurements, addition (and subtraction) operations are possible. Thus, it can be said that Violation A was worse than the combination of Violation B and Violation C. Finally, in even more advanced measurements, multiplication and division operations are possible. As a result of measurements that support such operations, it becomes possible to calculate items such as standard deviation and other arithmetic-based statistical calculations.

[0071] The denominator can be calculated only when all events are tracked, and QSS 112 can perform statistical calculations because it tracks all events including the API. Thus, QSS 112 can provide a calculation of the likelihood of risk that is improved over the prior art.

[0072] Examples of Use for Cyber Security Risk Assessment and Measurement The first example of the use of cyber security risk assessment and measurement is dynamic adaptation and remediation. When the analysis engine 122 interprets incoming data, it can not only detect patterns but also calculate risks. The risk calculation may be some function of the likelihood and severity of the risk. Thereby, the analysis engine 122 can rank and prioritize remediation requests to the feedback engine 124. Specifically, the analysis engine 122 can create a queue of ranked requests ordered by priority and dispatch them to the feedback engine 124.

[0073] This is particularly useful when there are several monitors 118 feeding a single feedback engine 124, enabling ordered queuing or repair requests. In one case, the feedback engine 124 serializes repair requests to eliminate duplicates and creates a master priority queue. It should be noted that if duplicate requests are put into the queue, they are close to each other, thereby providing efficiency when removing duplicates. Since the QSS 112 can create statistical metrics as described above, a second use case is to create an insurance actuarial table for calculating insurance risk.

[0074] It is worth considering the various information sets that are the subject of machine learning and cognitive network algorithms. The more situations there are, the higher the accuracy of the analysis. Some information is directly observed by the QSS 112 from the data and events themselves, but additional information can be provided by the information technology (IT) department and other sources. Generally, when data artifacts such as files or computing resources are invoked, event data can be collected. Beyond the artifacts themselves, the QSS 112 can observe APIs at the cloud, application, and operating system levels. Beyond direct observation, the practices of the IT group can be input into the analysis engine 122. Finally, the administrator 130 can provide information such as user behavior patterns, such as the degree of compliance.

[0075] As a result of the above, this external data can be used to create a more predictive and accurate insurance actuarial table. Supplementary information (i.e., information not directly measured via data artifacts or APIs) may be collected via an insurance questionnaire. Examples of questions may include the type of exposure (type and degree of risk), type of asset (to determine the threat surface), historical data (to be more accurate), and impact assessment questions. Furthermore, each of these categories may be further divided into lower-level details.

[0076] One insight is that the types of questionnaires created to gather more information can be evaluated against the analytical models used. Specifically, administrator 130 can determine that the predictive characteristics of an analytical model are improved by a particular class of information. Thus, QSS 112 can be a source of improved questionnaires used in cyber security insurance evaluations.

[0077] Conclusion The subject matter is described in language specific to structural features and / or methodological acts, but it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as examples of forms of carrying out the claims.

Claims

1. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed, cause one or more processors to receive a requestor's request to associate a set of attributes with an access control set for a given set of users with respect to computing resources of a domain, wherein the set of attributes includes at least one of a read access privilege, a write access privilege, or an execution access privilege to the computing resources, the receiving; in response to a determination that the requestor has the privilege to associate the set of attributes with the access control set for the given set of users, execute an operation including updating the access control set using the association to the set of attributes; the media, wherein updating the access control set causes the set of attributes to be received by one or more cryptographic keys associated with the access control set.

2. The one or more non-transitory computer-readable media of claim 1, wherein the operation further includes propagating the association of the set of attributes to one or more child access control sets of the access control set such that the one or more child access control sets inherit the set of attributes.

3. The one or more non-transitory computer-readable media of claim 2, wherein a child access control set of the one or more child access control sets further includes an additional set of attributes independent of the set of attributes.

4. The one or more non-transitory computer-readable media of claim 1, wherein the access control set includes one or more child access control sets associated with the one or more cryptographic keys, and updating the access control set causes the set of attributes to be automatically propagated to the one or more child access control sets of the access control set.

5. The one or more non-transitory computer-readable media of claim 1, wherein the one or more cryptographic keys include keys for accessing the computing resources.

6. The one or more non-transitory computer-readable media of claim 5, wherein the keys are disposable keys for accessing the computing resources.

7. The one or more non-transitory computer-readable media of claim 1, wherein the computing resource is a data file, and the one or more cryptographic keys include cryptographic keys for accessing the data file. **Claim 8** The one or more non-transitory computer-readable media of claim 1, wherein the one or more cryptographic keys include quantum cryptographic keys generated using a quantum seed generator. **Claim 9** The one or more non-transitory computer-readable media of claim 1, wherein the operation further includes sending, to an analysis engine, a notification of one or more events including an association of the set of attributes to the access control set for the predetermined set of users. **Claim 10** The one or more non-transitory computer-readable media of claim 9, wherein sending the notification of the one or more events to the analysis engine causes the analysis engine to interpret the one or more events. **Claim 11** The one or more non-transitory computer-readable media of claim 9, wherein by sending the notification of the one or more events to the analysis engine, the analysis engine interprets the one or more events and triggers a repair action based on the interpretation of the one or more events. **Claim 12** The one or more non-transitory computer-readable media of claim 9, wherein by sending the one or more events to the analysis engine, the analysis engine adds an association of the set of attributes, the access control set, and the one or more cryptographic keys to an event data store. **Claim 13** The one or more non-transitory computer-readable media of claim 1, wherein the operation further includes receiving an additional request to associate an additional set of attributes to the access control set of the predetermined set of users, and updating the access control set using the additional association with the additional set of attributes. **Claim 14** The one or more non-transitory computer-readable media of claim 1, wherein the computing resource is further associated with an additional access control set for an additional predetermined set of users. **Claim 15** The one or more non-transitory computer-readable media of claim 14, wherein the additional access control set is associated with an additional set of attributes and one or more additional cryptographic keys. **Claim 16** The one or more non-transitory computer-readable media of claim 1, wherein the operation further comprises tracking API events from a set of APIs associated with the domain, the operation including at least a cloud application program interface (API) of cloud computing resources.

17. The one or more non-transitory computer-readable media of claim 16, wherein the operation further comprises analyzing the API events to detect at least one of a set of one or more harmful events and a set of one or more potentially harmful events, and generating one or more statistical risk measurements based on the set of one or more harmful events and the set of one or more potentially harmful events.

18. The one or more non-transitory computer-readable media of claim 17, wherein the operation further comprises creating an insurance actuarial table for calculating an insured risk based on the one or more statistical risk measurements.

19. A system comprising one or more processors and a memory including a plurality of computer-executable components executable by the one or more processors to perform a plurality of actions, the plurality of actions including receiving a request from a requester to associate a set of attributes including at least one of a read access privilege, a write access privilege, or an execution access privilege regarding computing resources of a domain with an access control set regarding a predetermined set of users regarding the computing resources, the requester updating the access control set using the association to the set of attributes in response to a determination that the requester has the privilege to associate the set of attributes to the access control set regarding the predetermined set of users, the system, wherein updating the access control set comprises causing the set of attributes to be received by one or more cryptographic keys associated with the access control set.

20. Receiving, by a monitoring service, a request from a requester to associate a set of attributes with an access control set for a set of predetermined users with respect to computing resources of a domain, wherein the set of attributes includes at least one of a read access privilege, a write access privilege, or an execution access privilege for the computing resources, responding to a determination that the requester has a privilege to associate the set of attributes with the access control set for the set of predetermined users, and updating the access control set using the association to the set of attributes via the monitoring service, wherein updating the access control set causes a computer to receive the set of attributes at one or more cryptographic keys associated with the access control set.

Images