System, method, and program for automated health check and risk assessment of computing assets

Abstract

Systems and techniques are provided that facilitate automated health check risk assessment of computing assets. In various embodiments, the system can include a baseline component that generates a baseline health check risk score corresponding to non-compliance of the computing asset with a prescribed control. In various aspects, the system can further include an adjustment component that can adjust the baseline health check risk score based on a weakness factor of the prescribed control. In some cases, the weakness factor can be based on an amount by which the state of the computing asset deviates from the prescribed control. In various embodiments, the adjustment component can further adjust the baseline health check risk score based on an environmental factor of the computing asset. In various cases, the environmental factor can be based on a security mechanism or security protocol associated with the computing asset. In various embodiments, the adjustment component can further adjust the baseline health check risk score based on a criticality factor. In some examples, the criticality factor can be based on an importance level of the computing asset. In various embodiments, the adjustment component can further adjust the baseline health check risk score based on a maturity factor. In some aspects, the maturity factor can be based on a difference between the prescribed control and the recommended control.

Description

[Technical field]

[0001] The subject disclosure relates to computing assets, and more particularly, to automated health-check risk assessment of computing assets. [Background technology]

[0002] A computing asset can be any suitable combination of computer hardware or computer software or both. A computing asset can be subject to one or more controls. In various embodiments, a control can be a standard, regulation, rule, or benchmark, or combination thereof, designed to enhance or protect or enhance and protect computing security or cyber security or both. For example, a control can include Center for Internet Security (CIS) benchmarks, Security Technical Implementation Guides (STIGs), industry standards, or any other suitable technical regulations, or combinations thereof. In various examples, a control can prescribe any suitable technical attribute / characteristic of a computing asset, or can relate to any suitable technical attribute / characteristic of a computing asset, or both. If a computing asset complies with a stipulated control, the computing asset can be considered to minimize the vulnerability of the computing asset to security breaches or exploitation, or both. However, if a computing asset is not in compliance with regulatory controls, the computing asset may be considered vulnerable and / or at risk with respect to data security.

[0003] Health checks can be performed periodically on computing assets to determine whether the computing assets meet the requirements of prescribed controls. In various cases, a health check can be a security process that examines information technology systems or application configurations, or both, to prevent or mitigate attacks, or to harden the systems or configurations, or both, to prevent and mitigate attacks. Computing systems often consist of many different computing assets, and the number of non-compliant controls can become so large that it can overwhelm the computing system operator. In such cases, different non-compliant controls on different computing assets can pose different risks, and the computing system operator may not be sure how to triage the non-compliant controls.

[0004] Traditionally, health check risk assessments are performed to assign severity levels to non-compliant controls. For example, Common Configuration Scoring System (CCSS) can assign health check risk scores to different controls, and risks for various computing assets can be derived from these scores based on non-compliant controls. However, such traditional health check risk assessment techniques are generally manual processes performed once or twice a year by human operators. Even for traditional health check risk assessment techniques that implement automation, they are based on subjective operator assessments and are therefore prone to error and not standardized. Furthermore, as described herein, such traditional health check risk assessment techniques ignore various important aspects of computing assets and non-compliant controls.

[0005] Systems and / or techniques that can ameliorate, solve, or both solve one or more of these technical problems would be desirable. Summary of the Invention

[0006] The following presents a summary in order to provide a basic understanding of one or more embodiments of the invention. This summary is not intended to identify key or critical elements or to limit the scope of particular embodiments or the claims. Its sole purpose is to present concepts in a simplified form as a prelude to the more detailed description that is presented later. In one or more embodiments described herein, a device, system, computer-implemented method, apparatus, or computer program product, or combination thereof, is described that can facilitate automated health check risk assessment of computing assets.

[0007] According to one or more embodiments, a system is provided. The system can include a memory capable of storing computer executable components. The system can further include a processor operatively coupled to the memory, the processor capable of executing the computer executable components stored in the memory. In various embodiments, the computer executable components can include a baseline component capable of generating a baseline health-check risk score corresponding to non-compliance of the computing asset with a prescribed control. In various aspects, the computer executable components can further include an adjustment component capable of adjusting the baseline health-check risk score based on a weakness factor of the prescribed control. In some cases, the weakness factor can be based on an extent to which a condition of the computing asset deviates from the prescribed control. In various embodiments, the adjustment component can further adjust the baseline health-check risk score based on an environmental factor of the computing asset. In various cases, the environmental factor can be based on a security mechanism or security protocol associated with the computing asset. In various embodiments, the adjustment component can further adjust the baseline health-check risk score based on a criticality factor. In some examples, the criticality factor can be based on a level of importance of the computing asset. In various embodiments, the adjustment component can further adjust the baseline health check risk score based on a maturity factor. In some aspects, the maturity factor can be based on a difference between a prescribed control and a recommended control.

[0008] According to one or more embodiments, the above-described systems may be implemented as computer-implemented methods and / or computer program products. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram of an exemplary, non-limiting system for facilitating automated health check risk assessment of computing assets, according to one or more embodiments described herein. [Diagram 2] FIG. 1 is a block diagram of an example, non-limiting system for facilitating an automated health check risk assessment of a computing asset, including a baseline health check risk score, in accordance with one or more embodiments described herein. [Diagram 3] FIG. 1 is a block diagram of an exemplary, non-limiting system for facilitating automated health check risk assessment of computing assets, including weakness factors, in accordance with one or more embodiments described herein. [Figure 4] FIG. 2 illustrates an exemplary, non-limiting table relating to weakness factors, according to one or more embodiments described herein. [Diagram 5] FIG. 1 is a block diagram of an exemplary, non-limiting system for facilitating automated health check risk assessment of computing assets, including environmental factors, in accordance with one or more embodiments described herein. [Figure 6] FIG. 1 illustrates an exemplary, non-limiting table relating to environmental factors, according to one or more embodiments described herein. [Figure 7] FIG. 1 is a block diagram of an exemplary, non-limiting system for facilitating automated health check risk assessment of computing assets, including criticality factors, in accordance with one or more embodiments described herein. [Figure 8]FIG. 1 is a block diagram of an exemplary, non-limiting system for facilitating automated health check risk assessment of computing assets, including maturity factors, in accordance with one or more embodiments described herein. [Figure 9] FIG. 1 is a block diagram of an exemplary, non-limiting system for facilitating automated health check risk assessment of computing assets, including a coordination component, in accordance with one or more embodiments described herein. [Figure 10] FIG. 1 is a block diagram of an exemplary, non-limiting system for facilitating automated health check risk assessment of computing assets, including an aggregation component, in accordance with one or more embodiments described herein. [Figure 11] FIG. 1 is a block diagram of an exemplary, non-limiting computing asset hierarchy according to one or more embodiments described herein. [Figure 12] 1 is a flow diagram of an exemplary, non-limiting computer-implemented method for facilitating automated health check risk assessment of computing assets, in accordance with one or more embodiments described herein. [Figure 13] FIG. 1 is a block diagram of an exemplary non-limiting operating environment capable of facilitating one or more embodiments described herein. [Figure 14] FIG. 1 illustrates an exemplary, non-limiting cloud computing environment in accordance with one or more embodiments described herein. [Figure 15] FIG. 2 illustrates exemplary, non-limiting abstraction model layers according to one or more embodiments described herein. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] The following detailed description is merely illustrative and is not intended to limit the embodiments or the application or uses of the embodiments, or combinations thereof, and is further not intended to be bound by any express or implied information presented in the Technical Field or Summary section or Detailed Description section above.

[0011] One or more embodiments will now be described with reference to the drawings, in which like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a more thorough understanding of one or more embodiments. However, it will be apparent that in various cases, the one or more embodiments may be practiced without these specific details.

[0012] A computing asset can be any suitable combination of computer hardware or computer software or both (e.g., a server, a data center, a software application, a browser, a network, a laptop computer, a mobile computing device, or any other suitable information technology system, or a combination thereof). As noted above, a computing asset can be subject to and / or governed by one or more controls, which can take the form of standards, regulations, rules, or benchmarks, or combinations thereof, designed, configured, or intended, or designed, configured and intended to enhance or protect or enhance and protect computing security or cyber security or both. For example, a control can include Center for Internet Security (CIS) benchmarks, Security Technical Implementation Guides (STIGs), industry standards, or any other suitable technical regulations, or combinations thereof, aimed at improving computing security. As an example, a computing asset can electronically store / maintain password-protected data. In such cases, a first control may specify that the password should have a minimum character length (e.g., at least 10 characters long), a second control may specify that the password should contain certain character types (e.g., numbers, letters, punctuation, other symbols), or a third control may specify that the password should be younger than a maximum age (e.g., less than 90 days), or a combination thereof. In various examples, the controls may specify any suitable technical attributes / characteristics of the computing asset (e.g., passwords, privileges / permissions, data management policies, data storage policies, authentication policies, audit policies, infrastructure) or may relate to any suitable technical attributes / characteristics of the computing asset, or both.If a computing asset complies with regulatory controls, the computing asset may be considered to minimize the vulnerability of the computing asset to security breaches or misuse, or both. However, if a computing asset does not comply with regulatory controls, the computing asset may be considered to be vulnerable or at risk with respect to data security, or both.

[0013] Health checks may be performed periodically (e.g., once every 24 hours) on computing assets to determine whether the computing assets meet the requirements of the prescribed controls. A computing system may often consist of many different computing assets, and the number of non-compliant controls may become so large that it may overwhelm an operator of the computing system (e.g., many different computing assets may be in compliance with and / or in violation of many different controls). In such cases, different non-compliant controls on different computing assets may pose different risks, and an operator of the computing system may be unsure how to triage the non-compliant controls (e.g., may be uncertain about which non-compliant controls are most urgent and / or which non-compliant controls are least urgent in order to determine which non-compliant controls should be remediated first).

[0014] Traditionally, health check risk assessments are performed to assign a severity level to non-compliant controls so that triage can be performed. For example, a health check risk score can be assigned to non-compliant controls by the Common Configuration Scoring System (CCSS). However, such traditional health check risk assessment techniques are generally manual processes performed once or twice a year by human operators. Even when traditional health check risk assessment techniques implement automation, they are based on the subjective assessment of the operator and are therefore prone to error and are not standardized (e.g., different operators may have different expertise, different experience levels, or different opinions, or a combination of these, regarding which non-compliant controls of which computing assets pose more or less severe security threats).

[0015] Moreover, such traditional health check risk assessment techniques do not consider various important aspects of computing assets and non-compliant controls. Specifically, such traditional health check risk assessment techniques only consider controls in a binary manner. That is, traditional health check risk assessment techniques only determine whether a control requirement is met or the control is violated, and do not consider the magnitude of the non-compliance. This may not be optimal because a greater magnitude of non-compliance may pose a greater security risk (e.g., a password that is six months old is a much greater security risk than a password that is one day old, a password that is many characters short is a much greater security risk than a password that is one character short, privileges shared by dozens of over-age entities are a much greater security risk than privileges shared by only one over-age entity, and audits that are performed 50% less frequently are a much greater security risk than audits that are performed 5% less frequently). Moreover, such traditional health check risk assessment techniques ignore the criticality level of the computing assets. This may not be optimal, as a more critical computing asset that violates a regulatory control by a given amount may pose a much greater security risk than a less critical computing asset that violates the same control by the same amount. (For example, consider an online shopping account and a database containing sensitive / private data. Both the online shopping account and the database may each be protected by corresponding passwords that are one month old, but the database may be considered a more critical and / or more critical computing asset compared to the online shopping account, and thus a non-compliant database may pose a much greater security risk than a non-compliant online shopping account.)Moreover, such traditional health check risk assessment techniques take prescribed controls at face value and do not compare such prescribed controls to recommended controls and / or industry best practices. This may be suboptimal because less mature (e.g., less cyber security savvy) organizations may have controls that differ significantly from industry standards (e.g., an organization may specify that data center passwords must be aged 180 days or less, while industry best practices may recommend that data center passwords must be aged 90 days or less. Thus, a data center password that is 120 days old may be considered compliant with the prescribed controls, but may nevertheless pose a significant security risk because the prescribed controls are much less stringent than the recommended controls). Moreover, such traditional health check risk assessment techniques are generally performed manually (e.g., they rely on subjective scoring by human operators and do not implement any form of artificial intelligence to enforce standardization). Thus, traditional health check risk assessment techniques have various technical challenges.

[0016] Various embodiments of the present invention may address one or more of these technical challenges. In particular, various embodiments of the present invention may provide systems and / or techniques that may facilitate automated health check risk assessment of computing assets. In other words, various embodiments of the present invention may be considered to be computerized diagnostic tools (e.g., computer-implemented software) that may monitor the compliance and / or non-compliance of a computing asset with one or more prescribed controls. In various aspects, such computerized diagnostic tools may assign baseline health check risk scores (e.g., CCSS scores) to various non-compliant controls of a computing asset and may adjust such baseline health check risk scores based on corresponding weakness factors (e.g., that may take into account the magnitude of the non-compliance), environmental factors (e.g., that may take into account the built-in security mechanisms of the computing asset), criticality factors (e.g., that may take into account the level of importance of the computing asset), or maturity factors (e.g., that may take into account the deviation of the prescribed control from best practices and / or industry standards), or combinations thereof.

[0017] In various embodiments, such computerized diagnostic tools may include a baseline component, a weakness component, an environmental component, a criticality component, or a maturity component, or combinations thereof.

[0018] In various aspects, the computerized diagnostic tool may scan and / or interrogate the computing asset to obtain status information regarding the computing asset. That is, any suitable electronic scanning, interrogation or information retrieval technique, or combination thereof, may be implemented to determine the status of the computing asset. In various examples, the status of a computing asset may be any suitable technical characteristic and / or attribute of the computing asset that is governed by and / or subject to a prescribed control. For example, the state of the computing asset can be the age of a password enforced by the computing asset and the regulatory control can specify a maximum age of the password; the state of the computing asset can be the length of a password enforced by the computing asset and the regulatory control can specify a minimum password length; the state of the computing asset can be the number of allowable sign-in attempts enforced by the computing asset and the regulatory control can specify a maximum number of allowable sign-in attempts; the state of the computing asset can be the frequency of audits enforced by the computing asset and the regulatory control can specify a minimum audit frequency; and / or the state of the computing asset can be the capacity and / or number of files of a database maintained by the computing asset and the regulatory control can specify a maximum capacity and / or number of files. In various embodiments, the computerized diagnostic tool can learn the regulatory control by any suitable technique (e.g., it can query any suitable electronically accessible data source to learn the regulatory control, it can be pre-programmed to already have or already know the regulatory control, or both, and it can receive the regulatory control as input from an operator or any suitable electronic device, or both).

[0019] In various examples, the baseline component of the computerized diagnostic tool can generate a baseline Health Check risk score based on the state of the computing assets and regulatory controls. In various cases, any suitable risk scoring and / or risk quantification techniques, such as the CCSS techniques, can be implemented to generate the baseline Health Check risk score. In various embodiments, the remaining components of the computerized diagnostic tool can adjust the baseline Health Check risk score as described herein to make the baseline Health Check risk score more accurate (e.g., to address the above-mentioned shortcomings of the CCSS techniques).

[0020] In various embodiments, the weakness component can generate a scalar, called a weakness factor, for the computing asset or the prescribed control or both. In various cases, the value of the weakness factor can be a function of the difference (e.g., calculated by subtraction) between the state of the computing asset and the prescribed control. As described above, traditional health check risk assessment techniques function in a binary manner such that one risk score is assigned when the prescribed control is in compliance and a different risk score is assigned when the prescribed control is not in compliance. In contrast, the weakness factor can be based in various embodiments on the magnitude or severity of the non-compliance or both (e.g., on how significantly or how badly the state of the computing asset does not meet the requirements of the prescribed control, or how significantly and how badly it does not meet the requirements of the prescribed control). If the computing asset's state is only slightly non-compliant with the regulatory control (e.g., if the password is only one character short, if the password is only one day old, if the data center capacity is exceeded by one file, or if only one too many entities are privileged, or a combination of these), the weakness factor value can be correspondingly smaller (e.g., indicating low risk). On the other hand, if the computing asset's state is more seriously non-compliant with the regulatory control (e.g., if the password is only a few characters short, if the password is only a few weeks old, if the data center capacity is exceeded by a few files, or if only many entities are privileged, or a combination of these), the weakness factor value can be correspondingly larger (e.g., indicating high risk). In various cases, the baseline health check risk score can be mathematically adjusted (e.g., increased or decreased, or both) based on the weakness factor. In this manner, the computerized diagnostic tool can take into account the magnitude of the computing asset's non-compliance with the regulatory control.As used herein, the term "weakness factor" may refer to a scalar (e.g., a number) whose value is based on how non-compliant a computing asset is with respect to a prescribed control. In other words, the difference between the state of the computing asset and the prescribed control may be calculated by subtraction, and the value of the weakness factor may be based on such difference. In various cases, the value of the weakness factor may be any suitable mathematical function of such difference (e.g., the weakness factor may be calculated by applying any suitable mathematical operation to the difference between the state of the computing asset and the prescribed control). The weakness factor may then be used to mathematically adjust (e.g., increase or decrease, or both) the baseline health check risk score as described herein (e.g., as described with respect to FIG. 9).

[0021] In various examples, the weakness component can generate or calculate, or generate and calculate, a weakness factor based on the values ​​of the state of the computing assets and the values ​​of the prescribed controls. In some cases, the weakness component can include a trained machine learning model that can be utilized to generate / calculate the weakness factor. In various embodiments, the trained machine learning model can be any suitable computer-implemented artificial intelligence algorithm (e.g., neural networks, linear regression, logistic regression, naive Bayes, support vector machines, random forests) that can be trained (e.g., by supervised learning, unsupervised learning, or reinforcement learning, or combinations thereof) to perform classification and / or labeling of input data. In various cases, the weakness component can be configured to electronically receive and / or retrieve one or more control documents (e.g., natural language documents) that describe various technical details of the prescribed controls from any suitable electronically accessible data structure. Such control documents can include, for example, GitHub documents, development / design documents, and / or any other similar documents that describe and / or characterize technical attributes / characteristics of the prescribed controls. In various cases, any other suitable input data characterizing the prescribed control can be implemented. In various examples, the weakness component can generate a numerical representation (e.g., vector, tensor) of one or more control documents (e.g., by applying any suitable word embedding and / or language modeling techniques). In various cases, the trained machine learning model can then receive the numerical representation of one or more control documents as input and generate a classification and / or label associated with the prescribed control as output.

[0022] As described in the paragraph immediately above, these control documents can be natural language documents (e.g., written as human readable text). However, the weak component's machine learning model cannot usually take human readable text / prose as input. Instead, any suitable word embedding technique can be implemented to generate a numerical representation of the control document. The "numerical representation" of the control document can be a vector, tensor, or any other suitable collection of numerical values, or combinations thereof, that represent and / or correlate to the content of the control document (e.g., a word embedding algorithm is configured to assign numerical values ​​to human readable words and / or sentences based on the context of such human readable words and / or sentences). The weak component's machine learning model can then receive this numerical representation and generate classifications / labels as described herein. The word embedding technique can be a natural language processing algorithm configured to map human readable words or phrases in a given vocabulary to vectors and / or tensors of real numbers with any suitable dimension. More specifically, word embedding exploits the principle that words that commonly appear near each other in a document have similar meanings. Thus, word embedding can assign a particular word (or phrase, or both) in the controlled document an n-dimensional vector for any suitable integer n, where the value of the n-dimensional vector is based on the remaining words that appear near the particular word. Thus, similar words may have similar vectors, and thus different words may have different vectors. As will be appreciated by those skilled in the art, word embedding techniques can be facilitated by trained neural networks, or by dimensionality reduction of a word co-occurrence matrix corresponding to the input controlled document, or both. It should be noted that these are merely examples of word embedding techniques, and that any suitable word embedding technique can be implemented in various embodiments.Word embedding techniques and the numerical representations that they produce are known in the art and no additional details regarding word embedding techniques and the numerical representations that they produce need be discussed herein.

[0023] In various embodiments, the classification and / or label generated by the machine learning model of the weakness component can identify the weakness category to which the prescribed control belongs based on one or more control documents that describe the prescribed control. For example, the prescribed control can be classified or labeled, or classified and labeled, as relating to a passive weakness, a direct active weakness, or an indirect active weakness, or a combination thereof. In various cases, a regulatory control may be said to involve a passive weakness (e.g., be a passive control) if non-compliance with the regulatory control may enable an attacker to prevent a computing asset from performing an authorized action (e.g., prevent the computing asset from performing a security audit, prevent the computing asset from conducting a Completely Automated Public Turing tests to tell Computers and Humans Apart (CAPTCHA test), prevent the computing asset from initiating an automated security protocol, prevent the computing asset from running a system service or daemon). A passive weakness may not be actively exploited by an attacker, but may prevent the attacker from detecting unauthorized actions. In various examples, a regulatory control may relate to an active weakness (e.g., may be an active control) if, for example, non-compliance with the regulatory control may enable an attacker to perform unauthorized actions (e.g., accessing and / or reading confidential / private data, making copies of confidential / private data, editing confidential / private data, uploading and / or storing malware and / or spyware).In various cases, a prescribed control may relate to a direct active weakness (e.g., may be a direct active control) if, for example, the prescribed control relates to an active weakness and an exploit for the prescribed control is known to already exist (e.g., incorporating an old vulnerability for which a known exploit exists into a computing asset allows an attacker to immediately attack the computing asset). In contrast, a prescribed control may relate to an indirect active weakness (e.g., may be an indirect active control) if, for example, the prescribed control relates to an active weakness and an exploit for the prescribed control is not known to already exist (e.g., enforcing a weak password within a computing asset does not necessarily allow an attacker to immediately attack the computing asset, but may present an opportunity for the attacker to exploit). In various aspects, the trained machine learning model may determine which weakness category the prescribed control belongs to (e.g., may determine whether the prescribed control is a passive control, a direct active control, or an indirect active control), and then assign a weakness factor based on the weakness category. For example, if the prescribed control belongs to a passive weakness category, the weakness factor may have a low value (e.g., a passive weakness may be considered not very weak). If the prescribed control belongs to a direct active weakness category, the weakness factor may have a high value (e.g., a direct active weakness may be considered unacceptably weak). If the prescribed control belongs to an indirect active weakness category, the weakness factor may have a value that depends on the magnitude of non-compliance (e.g., the value of the weakness factor may be proportional to how much the state of the computing asset violates the prescribed control, with a lower bound being a value associated with a passive weakness and an upper bound being a value associated with a direct active weakness). In various embodiments, any other suitable weakness categories may be implemented.In other words, the weakness component can receive technical documentation describing attributes of the regulatory controls, and the trained machine learning model can classify the regulatory controls into weakness categories based on the technical documentation, and the values ​​of the weakness factors can be different for different weakness categories, and the values ​​of the weakness factors for some weakness categories can be based on how non-compliant the computing asset is with respect to the regulatory controls.

[0024] As described in the paragraph immediately above, the machine learning model of the weakness component can determine the weakness category of the prescribed control, and then assign a value to the weakness factor based on the type of weakness category determined. Although the above-mentioned embodiments refer only to passive weaknesses, direct active weaknesses, and indirect active weaknesses, these are merely examples and are not intended to be limiting. In various embodiments, any other suitable weakness category can be implemented. The paragraph immediately above defines "passive weaknesses," "direct active weaknesses," and "indirect active weaknesses." In one or more embodiments, a passive weakness (or passive control) can be defined as a weakness or control whose non-compliance allows an attacker to prevent an authorized operation by the system (e.g., an automated security audit). In one or more embodiments, an active weakness (or active control) can be defined as a weakness or control whose non-compliance allows an attacker to perform an unauthorized operation (e.g., reading / editing data). In one or more embodiments, a "direct active weakness" may be defined as an active weakness for which an exploit (e.g., malicious computer software that takes advantage of a computer bug or vulnerability) is already known in the industry / sector to exist (e.g., immediately exploitable). In some aspects, the weakness component may be pre-programmed to have a list of exploits known in the industry / sector to exist at any suitable time (or may otherwise have any suitable form of access to such a list of exploits, or both). In one or more embodiments, an "indirect active weakness" may be defined as an active weakness for which an exploit is not yet known in the industry / sector to exist (e.g., not necessarily immediately exploitable).

[0025] In various examples, the environmental components can generate scalars, referred to as environmental factors, for computing assets and / or regulatory controls. In various cases, the value of the environmental factor can be a function of various security mechanisms and / or protocols implemented by the computing asset to guard against security threats. For example, if the computing asset implements advanced or stringent protection mechanisms or advanced and stringent protection mechanisms (e.g., data masking / encryption instead of automatic data discovery / classification, anomaly prevention / blocking instead of anomaly detection, internal-only access instead of public access), the value of the environmental factor can be correspondingly smaller (e.g., indicating lower risk). On the other hand, if the computing asset implements less advanced or less stringent protection mechanisms or less advanced and less stringent protection mechanisms (e.g., automatic data discovery / classification instead of data masking / encryption, anomaly detection instead of anomaly prevention / blocking, public access instead of internal-only access), the value of the environmental factor can be correspondingly larger (e.g., indicating higher risk). In various cases, the baseline health check risk score can be mathematically adjusted (e.g., increased or decreased, or both) based on the environmental factor. In this way, the computerized diagnostic tool can take into account the built-in security mechanisms of the computing asset that can make the computing asset inherently less susceptible to security attacks. As used herein, the term "environmental factor" can mean a scalar (e.g., a number) whose value is based on attributes of the computing asset (e.g., based on how many security mechanisms are implemented by the computing asset, or what type of security mechanisms are implemented by the computing asset, or both). In various cases, the value of the environmental factor can be any suitable mathematical function of such attributes of the computing asset.This environmental factor can then be used to mathematically adjust (e.g., make it higher, lower, or both) the baseline Health Check Risk Score as described herein (e.g., as described with respect to FIG. 9).

[0026] In various examples, the environmental component can generate or calculate, or generate and calculate, environmental factors based on various security / privacy policies implemented by the computing asset. In some cases, the environmental component can include a trained machine learning model that can be utilized to generate / calculate the environmental factors. As described above, the trained machine learning model can be any suitable computer-implemented artificial intelligence algorithm that can be trained to perform classification and / or labeling of input data. In various cases, the environmental component can be configured to electronically receive and / or retrieve one or more asset documents (e.g., natural language documents) that describe various technical details of the computing asset from any suitable electronically accessible data structure. Such asset documents can include, for example, GitHub documents, development / design documents, and / or any other similar documents that describe and / or characterize the technical attributes / characteristics of the computing asset. In various cases, any other suitable input data that characterizes the technical attributes of the computing asset can be implemented. Similar to the weakness component, the environmental component can generate a numerical representation (e.g., vector, tensor) of one or more asset documents (e.g., by word embeddings and / or language modeling). In various cases, the trained machine learning model of the environmental component can then receive as input the numerical representation of one or more asset documents and generate as output various decisions related to the computing asset.

[0027] As described in the paragraph immediately above, these asset documents can be natural language documents (e.g., written as human readable text). However, the machine learning models of the environment components are typically not able to receive human readable text / prose as input. Instead, any suitable word embedding technique can be implemented to generate a numerical representation of the asset document. The "numerical representation" of the asset document can be a vector, tensor, or any other suitable collection of numerical values, or combinations thereof, that represent and / or correlate to the content of the asset document (e.g., a word embedding algorithm is configured to assign numerical values ​​to human readable words and / or sentences based on the context of such human readable words and / or sentences). The machine learning models of the environment components can then receive this numerical representation and generate various decisions as described herein. The word embedding technique can be a natural language processing algorithm configured to map human readable words or phrases in a given vocabulary to vectors and / or tensors of real numbers with any suitable dimension. More specifically, word embedding exploits the principle that words that commonly appear near each other in a document have similar meanings. Thus, word embedding can assign a particular word (or phrase, or both) in an asset document an n-dimensional vector for any suitable integer n, where the value of this n-dimensional vector is based on the remaining words that appear near the particular word. Thus, similar words may have similar vectors, and thus different words may have different vectors. As will be appreciated by those skilled in the art, word embedding techniques can be facilitated by trained neural networks, or by dimensionality reduction of a word co-occurrence matrix corresponding to the input asset document, or both. It should be noted that these are merely examples of word embedding techniques, and that any suitable word embedding technique may be implemented in various embodiments.Word embedding techniques and the numerical representations that they produce are known in the art and no additional details regarding word embedding techniques and the numerical representations that they produce need be discussed herein.

[0028] In various aspects, these determinations of the machine learning model of the environment components may identify various technical aspects and / or attributes of the computing asset based on one or more asset documents describing the computing asset. In some cases, these determinations may identify the type of access protocol implemented by the computing asset (e.g., determining whether the computing asset is only internally accessible (less risky) or whether the computing asset is publicly accessible (more risky)). In some cases, these determinations may identify the type of modification paradigm implemented by the computing asset (e.g., determining whether the computing asset is immutable (less risky) or whether the computing asset is mutable / ephemeral (more risky)). In some cases, these determinations may identify the type of instantiation paradigm implemented by the computing asset (e.g., determining whether the computing asset is isolated (less risky) or whether the computing asset is configured as multi-tenancy (more risky)). In some cases, these decisions may identify a type of service availability associated with the computing asset (e.g., whether service or maintenance or both are still available for the computing asset (less risky) or whether service / maintenance is no longer available for the computing asset (more risky)).In some cases, these decisions may identify the data protection protocols implemented by the computing asset (e.g., determining whether the computing asset automatically implements data masking / encryption even for signed-in entities (less risky) or whether the computing asset automatically implements data discovery / classification for signed-in entities (more risky)). In some cases, these decisions may identify the type of compliance enforcement implemented by the computing asset (e.g., determining whether controls are periodically inspected and remediated (less risky) or whether controls are merely periodically inspected (more risky)). In some cases, these decisions may identify the type of anomaly detection implemented by the computing asset (e.g., determining whether the computing asset automatically prevents or prevents or prevents and prevents unusual behavior (less risky) or whether the computing asset only notifies when unusual behavior is detected (more risky)). In some cases, these decisions may identify any other suitable characteristic of the computing asset. In various cases, the trained machine learning models of the environmental components can assign values ​​to the environmental factors based on these determinations. Specifically, the environmental factors can be lower when the trained machine learning classifier determines that the computing asset includes more stringent or more advanced security mechanisms or both more stringent and more advanced security mechanisms (e.g., in such cases, the computing asset can be considered a hardened target that is more resistant to exploitation despite non-compliance with regulatory controls and thus may pose a lower security risk).On the other hand, when the trained machine learning classifier determines that the computing asset includes less stringent or less evolved security mechanisms or less stringent and less evolved security mechanisms, the environmental factor can be made higher (e.g., in such cases, the computing asset can be considered a softened target that is less resistant to exploitation and thus can be considered to be particularly at risk in the presence of non-compliant controls). In other words, the environmental component can receive technical documentation describing the attributes of the computing asset, and the trained machine learning model of the environmental component can determine which security mechanisms are implemented by the computing asset based on the technical documentation, and the value of the environmental factor can be based on such security mechanisms / protocols.

[0029] In various examples, the criticality component can generate a scalar, called a criticality factor, for a computing asset or regulatory control or both. In various cases, the value of the criticality factor can be a function of the level of importance of the computing asset to the entity that owns and / or operates the computing asset. For example, if the computing asset is highly important to the entity that owns / operates the computing asset (e.g., a financial institution may have computing applications that electronically transfer funds to and from customer accounts, or computing applications that electronically transfer funds to and from customer accounts, and such computing applications are critically important to the financial institution), the value of the criticality factor can be correspondingly large (e.g., indicating a high risk). On the other hand, if the computing asset is less important to the entity that owns / operates the computing asset (e.g., a financial institution may have a website dedicated to advertising and / or outreach that is not critically important to the financial institution), the criticality factor value may be correspondingly lower (e.g., indicating lower risk). In various cases, the baseline Health Check risk score may be mathematically adjusted (e.g., made higher and / or lower) based on the criticality factor. In this manner, the computerized diagnostic tool may take into account how important the computing asset is to the entity that owns / operates the computing asset. As used herein, the term "criticality factor" may mean a scalar (e.g., a number) whose value is based on the criticality level of the computing asset.In various cases, the value of the criticality factor may be any suitable mathematical function of such criticality level of the computing asset (e.g., the criticality factor may be calculated by applying any suitable mathematical operation to the criticality level of the computing asset). This criticality factor may then be used to mathematically adjust (e.g., increase or decrease, or both) the baseline health check risk score as described herein (e.g., as described with respect to FIG. 9).

[0030] In various examples, the criticality component can generate or calculate, or generate and calculate, the criticality factor based on electronic input received by the entity that owns / operates the computing asset. In other cases, the criticality component can include a trained machine learning model that can be utilized to generate / calculate the criticality factor. As discussed above, the trained machine learning model can be any suitable computer-implemented artificial intelligence algorithm that can be trained to classify and / or label input data. In various cases, the criticality component can be configured to electronically receive and / or retrieve one or more documents (e.g., natural language documents) that describe various details of the computing asset and / or various goals / objectives of the entity that owns / operates the computing asset from any suitable electronically accessible data structure. Such documents may include, for example, advertisements, business plans / presentations, mission statements, non-technical descriptions, and / or any other similar documents describing / characterizing the goals of the entity that owns / operates the computing asset and / or how the computing asset is utilized by the entity that owns / operates the computing asset. In various cases, any other suitable input data that characterizes the computing asset and / or the goals / activities of the entity that owns / operates the computing asset may be implemented. Similar to the weakness component and / or environment component, the criticality component may generate a numerical representation (e.g., vectors, tensors) of one or more documents (e.g., by word embeddings and / or language modeling). In various cases, the trained machine learning model of the criticality component may then receive as input the numerical representation of one or more documents and generate as output a classification and / or label associated with the computing asset.In various aspects, the classification and / or label can identify how important the computing asset is to an entity that owns / operates the computing asset (e.g., how critical the computing asset is to the entity's commercial activities and / or objectives). For example, the classification and / or label can be non-critical (e.g., may indicate that the computing asset is not an incredibly important aspect of the activities / goals of the entity that owns / operates the computing asset), the classification and / or label can be critical (e.g., may indicate that the computing asset is an important aspect of the activities / goals of the entity that owns / operates the computing asset), and / or the classification and / or label can be hyper-critical (e.g., may indicate that the computing asset is an incredibly important aspect of the activities / goals of the entity that owns / operates the computing asset).

[0031] As described in the paragraph immediately above, these documents may be natural language documents (e.g., written as human readable text). However, the machine learning models of the criticality component are typically not capable of receiving human readable text / prose as input. Instead, any suitable word embedding technique may be implemented to generate a numerical representation of the document. The "numerical representation" of the document may be a vector, tensor, or any other suitable collection of numerical values, or combinations thereof, that represent and / or correlate to the content of the document (e.g., a word embedding algorithm may be configured to assign numerical values ​​to human readable words and / or sentences based on the context of such human readable words and / or sentences). The machine learning models of the criticality component may then receive the numerical representation and generate classifications / labels as described herein. The word embedding technique may be a natural language processing algorithm configured to map human readable words or phrases in a given vocabulary to vectors and / or tensors of real numbers with any suitable dimension. More specifically, word embedding exploits the principle that words that commonly appear near each other in a document have similar meanings. Thus, word embedding can assign a particular word (or phrase, or both) in a document an n-dimensional vector for any suitable integer n, where the value of this n-dimensional vector is based on the remaining words that appear near the particular word. Thus, similar words may have similar vectors, and thus different words may have different vectors. As will be appreciated by those skilled in the art, word embedding techniques can be facilitated by trained neural networks, or by dimensionality reduction of a word co-occurrence matrix corresponding to the input document, or both. It should be noted that these are merely examples of word embedding techniques, and that any suitable word embedding technique can be implemented in various embodiments.Word embedding techniques and the numerical representations that they produce are known in the art and no additional details regarding word embedding techniques and the numerical representations that they produce need be discussed herein.

[0032] In various cases, the trained machine learning model of the criticality component can assign a value to the criticality factor based on the classification and / or label. Specifically, the criticality factor can be low when the trained machine learning classifier determines that the computing asset is not critical (e.g., the computing asset is not very important and therefore non-compliance with the prescribed controls may pose a low security risk), the criticality factor can be higher when the trained machine learning classifier determines that the computing asset is critical (e.g., the computing asset is important and therefore non-compliance with the prescribed controls may pose a medium security risk), and the criticality factor can be highest when the trained machine learning classifier determines that the computing asset is super-critical (e.g., the computing asset is very important and therefore non-compliance with the prescribed controls may pose a high security risk). In other words, the criticality component can receive documentation describing the attributes of the computing asset or documentation describing the goals / objectives of the entity that owns / operates the computing asset, or both, and the criticality component's trained machine learning model can determine the importance level and / or criticality to assign to the computing asset based on this documentation, and the value of the criticality factor can be based on such importance level and / or criticality.

[0033] In various examples, the maturity component can generate a scalar, called a maturity factor, for a computing asset and / or a regulatory control. In various cases, the value of the maturity factor can be a function of the difference or deviation (e.g., calculated by subtraction) between the regulatory control and an industry standard / best practice. For example, an entity that owns / operates a computing asset may establish regulatory controls for the computing asset that are looser or less strict, or looser and less strict than the recommended industry standard and / or best practice. In such cases, the entity that owns / operates the computing asset may be considered less mature from a cybersecurity perspective. Thus, in various aspects, a computing asset may be compliant with a regulatory control and still pose a security risk because the regulatory control is looser or less secure, or looser and less secure than the industry standard and / or recommendation. Furthermore, a computing asset may only be marginally non-compliant with a regulatory control and still pose a substantial security risk because the regulatory control is less stringent or less secure than, or both less stringent and secure than, industry standards and / or recommendations. As an example, assume that a regulatory control specifies that passwords within a computing asset be at least four characters long, and assume that an industry standard and / or industry best practice specifies that passwords within such computing asset be at least ten characters long. In such a case, a six-character long password may be deemed to be compliant with the regulatory control, but may still pose a security threat because the regulatory control is much less stringent than the industry standard (e.g., a four-character password is inherently less secure than a ten-character password). Furthermore, if a computing asset's password is only three characters long, then the password may be considered to be only marginally non-compliant with the regulatory control.Nevertheless, such a three-character password may pose a significant security threat because the prescribed controls are much less stringent than the industry standard. Thus, in various embodiments, the maturity component may generate a value for the maturity factor based on how different the prescribed controls are compared to the recommended controls, best practices, or industry standards, or a combination thereof. In various cases, the baseline health check risk score may be mathematically adjusted (e.g., increased or decreased, or both) based on the maturity factor. In this manner, the computerized diagnostic tool may take into account how mature the entity that owns / operates the computing asset is in a cybersecurity sense. As used herein, the term "maturity factor" may mean a scalar (e.g., a number) whose value is based on the difference (e.g., calculated by subtraction) between the prescribed controls and the recommended controls (e.g., best practices). In various cases, the value of the maturity factor may be any suitable mathematical function of such difference (e.g., the maturity factor may be calculated by applying any suitable mathematical operation to the difference between the prescribed controls and the recommended controls). This maturity factor can then be used to mathematically adjust (e.g., make it higher, lower, or both) the baseline Health Check Risk Score as described herein (e.g., as described with respect to FIG. 9).

[0034] In various examples, the maturity component may generate or calculate, or generate and calculate, the maturity factor based on electronic input received by the entity that owns / operates the computing asset. In other cases, the maturity component may query any suitable data structure electronically accessible to the maturity component to learn best practices, industry standards, or recommendations, or combinations thereof, associated with the regulatory control. In such cases, the maturity component may then compare the retrieved values ​​specified by the best practices, industry standards, or recommendations, or combinations thereof, with values ​​specified by the regulatory control to determine how lenient and / or how less stringent / secure the regulatory control is compared to the best practices, industry standards, or recommendations, or combinations thereof. In various cases, this may set the value of the maturity factor accordingly. In particular, the maturity factor may be lowered if the maturity component determines that the prescribed controls are consistent with the recommended controls (e.g., within a predetermined margin of the recommended controls), lowered even more if the maturity component determines that the prescribed controls are stricter than the recommended controls, increased if the maturity component determines that the prescribed controls are a certain percentage less strict or more strict than the recommended controls, and increased even more if the maturity component determines that the prescribed controls are a greater percentage less strict or more strict than the recommended controls. In other words, the maturity component may be informed of the recommended controls associated with the computing asset, and the maturity component may determine the difference and / or deviation between the prescribed and recommended controls, and the value of the maturity factor may be based on such level difference and / or deviation.

[0035] As described above, the computerized diagnostic tool may generate a baseline Health Check risk score, a weakness factor, an environmental factor, a criticality factor, or a maturity factor, or a combination thereof, based on the state of the computing asset and the prescribed controls. In various cases, the computerized diagnostic tool may adjust the baseline Health Check risk score based on the weakness factor, the environmental factor, the criticality factor, or a maturity factor, or a combination thereof. In some cases, the computerized diagnostic tool may multiply the baseline Health Check risk score by the environmental factor to provide a first product, may add the weakness factor to the first product to provide a first sum, may multiply the criticality factor by the first sum to provide a second product, and may multiply the maturity factor by the second product to provide an adjusted Health Check risk score for the computing asset based on the prescribed controls. This is merely one example of how an adjusted Health Check risk score for the computing asset may be calculated based on the baseline Health Check risk score, a weakness factor, an environmental factor, a criticality factor, or a maturity factor, or a combination thereof. In other cases, any other suitable formula, formula, or mathematical operation, or combination thereof, may be performed on the baseline Health Check risk score, weakness factors, environmental factors, criticality factors, or maturity factors, or combinations thereof, to calculate the adjusted Health Check risk score for the computing asset (e.g., environmental factors may be added rather than multiplied by environmental factors, weakness factors may be multiplied rather than added, criticality factors may be added rather than multiplied by criticality factors, and maturity factors may be added rather than multiplied by maturity factors). In various cases, the adjusted Health Check risk score may quantify a level of security risk associated with the computing asset and attributable to the computing asset's non-compliance with regulatory controls.As described above, a Health Check risk score adjusted by weakness factors (e.g., which may take into account the magnitude of non-compliance of a computing asset), environmental factors (e.g., which may take into account the built-in security mechanisms of a computing asset), criticality factors (e.g., which may take into account the level of importance of a computing asset), and maturity factors (e.g., which may take into account the difference between prescribed controls and best practices) can be more accurate than a baseline Health Check risk score (e.g., generated by CCSS techniques).

[0036] In various examples, a single computing asset may be subject to or governed by many different regulatory controls, or both. Thus, in various embodiments, the computerized diagnostic tool may generate many different adjusted health check risk scores for a single computing asset based on the many different regulatory controls governing the single computing asset (e.g., one adjusted health check risk score for each regulatory control governing the computing asset). In various cases, the computerized diagnostic tool may include an aggregation component that may aggregate these many different adjusted health check risk scores together (e.g., by weighted average or max-function or both) to provide an adjusted aggregated health check risk score for the computing asset (e.g., one score for the computing asset aggregated across all the many different regulatory controls governing the computing asset). Similarly, a computing system may be made up of many different computing assets. Thus, the aggregation component can generate adjusted, aggregated Health Check risk scores for each computing asset, which can be aggregated together (e.g., by a weighted average or max function, or both) to provide a final adjusted Health Check risk score for the entire computing system. In this manner, the computerized diagnostic tool can quantify the risk level associated with the computing system, can quantify the separate risk levels of each computing asset of the computing system, or can quantify even more granular risk levels for each regulatory control of each computing asset of the computing system, or can perform a combination of these.Thus, triage between computing assets, or between regulatory controls of a single computing asset, or both, can be accurately performed.

[0037] In various embodiments, the computerized diagnostic tool can generate any appropriate electronic notification and / or alert based on the generated adjusted Health Check risk score (e.g., the adjusted Health Check risk score can be notified and / or alerted to an entity that owns / operates the computing asset of the adjusted Health Check risk score and / or the adjusted Health Check risk score can be displayed on an electronic screen / monitor). In various examples, the computerized diagnostic tool can take any appropriate form of remedial action based on the adjusted Health Check risk score (e.g., the computing asset can be automatically locked or blocked or blocked and blocked until non-compliant controls for which the adjusted Health Check risk score is greater than a predetermined threshold are corrected, service / maintenance of the computing asset can be automatically scheduled and / or service / maintenance of the computing asset can be automatically accomplished to correct non-compliant controls for which the adjusted Health Check risk score is greater than a predetermined threshold).

[0038] Various embodiments of the invention can be used using hardware or software or both to solve problems that are highly technical in nature (e.g., facilitating automated health check risk assessment of computing assets), are not abstract, and cannot be performed as a set of mental acts by a human being. Additionally, some of the processes (e.g., a process for generating, by a device operatively coupled to the processor, a baseline health-check risk score corresponding to non-compliance of the computing asset with a prescribed control; a process for adjusting, by the device, the baseline health-check risk score based on a weakness factor of the prescribed control, the weakness factor being based on an extent to which a state of the computing asset deviates from the prescribed control; a process for adjusting, by the device, the baseline health-check risk score based on an environmental factor of the computing asset, the environmental factor being based on a security mechanism or security protocol associated with the computing asset; a process for adjusting, by the device, the baseline health-check risk score based on a criticality factor of the computing asset, the criticality factor being based on an importance level associated with the computing asset; and a process for adjusting, by the device, the baseline health-check risk score based on a maturity factor of the computing asset, the maturity factor being based on a difference between the prescribed control and the recommended control) may be performed by a dedicated computer. Such defined tasks are typically not performed manually by a human.Further, neither a human intellect nor a person with pen and paper can scan and / or interrogate a computing asset for state information, generate a baseline Health Check risk score for a computing asset based on state information and regulatory controls, generate weakness factors, environmental factors, criticality factors, or maturity factors, or combinations thereof, for a computing asset, and adjust a baseline Health Check risk score based on weakness factors, environmental factors, criticality factors, or maturity factors, or combinations thereof. Additionally, as described herein, various embodiments of the present invention may utilize machine learning models to aid in such generation and / or adjustment, and neither a human intellect nor a person with pen and paper can execute machine learning models electronically. Instead, various embodiments of the present invention are inherently and inseparably tied to computer technology and cannot be practiced outside of a computing environment (e.g., a computing asset is inherently a computerized device that could not exist outside of a computing system, and similarly, a computerized diagnostic tool that automatically monitors a computing asset for compliance with regulatory controls is also inherently a computerized device that could not exist outside of a computing system).

[0039] In various examples, embodiments of the present invention can integrate the disclosed teachings regarding automated health check risk assessment of computing assets into practical applications. Indeed, various embodiments of the present invention, which may take the form of a system or computer-implemented method or both as described herein, can be viewed as a computerized diagnostic tool that evaluates control information of a computing asset and assigns an adjusted health check risk score to the computing asset based on such control information. More specifically, embodiments of the present invention can assign a health check risk score to the computing asset, which quantifies how much of a security threat the computing asset poses. Such quantification is no doubt a useful and practical application of computers, at least because such quantification allows an operator to triage and / or prioritize different non-compliant controls of different computing assets and / or a single computing asset (e.g., without such health check risk scores, an operator would not know which non-compliant control to address / remediate first). Moreover, as discussed above, conventional techniques for assigning such Health Check risk scores completely ignore the magnitude of non-compliance, the criticality of a given computing asset, and the deviation between regulatory controls and industry standards / best practices. As described herein, various embodiments of the present invention can address these shortcomings through weakness factors, environmental factors, criticality factors, or maturity factors, or combinations thereof, such that an adjusted baseline Health Check risk score generated by embodiments of the present invention can be more accurate than a baseline Health Check risk score generated by conventional techniques.A system or technique, or both, that is capable of generating a Health Check risk score that is more accurate than a baseline Health Check risk score generated by traditional techniques would clearly constitute a concrete, tangible technological improvement in the field of automated Health Check risk assessment of computing assets.

[0040] Additionally, various embodiments of the present invention may control tangible, hardware-based, or software-based devices, or combinations thereof, based on the disclosed teachings. For example, embodiments of the present invention may generate an adjusted health check risk score that quantifies a security risk associated with a tangible computing asset (e.g., a server, a data center) that is not in compliance with a regulatory control. In some cases, embodiments of the present invention may generate an electronic notification and / or alert based on such adjusted health check risk score (e.g., such electronic notification / alert may be sent to other tangible devices, such electronic notification / alert may be displayed on a tangible electronic screen / monitor). In some cases, various embodiments of the present invention may operate based on such adjusted health check risk score. For example, embodiments of the present invention may lock and / or power down a tangible computing asset (e.g., by sending a lock instruction / command and / or a power down instruction / command to the tangible computing asset) when the adjusted health check risk score exceeds a predetermined threshold. As another example, embodiments of the present invention may schedule or effectuate, or schedule and effect, service / maintenance on a tangible computing asset (e.g., by electronically contacting a tangible computing device associated with a service / maintenance entity) when the adjusted health check risk score exceeds a predetermined threshold. As another example, embodiments of the present invention may issue any appropriate visual and / or audible alarms (e.g., by sending appropriate instructions / commands to a tangible alarm device capable of generating visual and / or audible alarms) when the adjusted health check risk score exceeds a predetermined threshold.In various aspects, embodiments of the present invention may initiate or take, or both initiate and take, any other suitable type of protective and / or preventative action to protect a computing asset when the adjusted Health Check risk score exceeds a predetermined threshold. Accordingly, embodiments of the present invention constitute concrete, tangible technical improvements in the field of automated Health Check risk assessment of computing assets.

[0041] It should be understood that the figures and disclosure herein describe non-limiting examples of various embodiments of the invention.

[0042] 1 illustrates a block diagram of an exemplary, non-limiting system 100 that can facilitate automated health check risk assessment of a computing asset 104, according to one or more embodiments described herein. As shown, a health check risk assessment system 102 can have any suitable form of electronic communication (e.g., wired or wireless or both) with a computing asset 104.

[0043] In various cases, the computing assets 104 can be any suitable combination of computer hardware or computing software or both. For example, the computing assets 104 can be a computer, a software application, a website, a database, a file, a mobile device, or any other suitable information technology system. In various examples, the computing assets 104 can include a state 106 and can be governed by or subject to a prescribed control 108, or both. In various aspects, the state 106 can be any suitable technical attribute / characteristic of the computing assets 104, and the prescribed control 108 can be any suitable rule, regulation, benchmark, or standard, or combination thereof, that the state 106 must meet. As some non-limiting examples, the state 106 can be a password length (e.g., the actual character length of a password actually implemented by the computing asset 104) and the regulatory control 108 can be an acceptable minimum password length; the state 106 can be a password age (e.g., the actual age of a password actually implemented by the computing asset 104) and the regulatory control 108 can be an acceptable maximum password age; the state 106 can be a database file count (e.g., the actual number of files stored in a database actually maintained by the computing asset 104) and the regulatory control 108 can be an acceptable maximum number of database files; or the state 106 can be an audit frequency (e.g., the actual audit frequency actually implemented by the computing asset 104) and the regulatory control 108 can be an acceptable minimum audit frequency, or combinations thereof.

[0044] While Figure 1 illustrates the regulatory controls 108 as being within the computing asset 104, this is a non-limiting example provided for ease of explanation. In various cases, the computing asset 104 may be unaware of or may not have access to the regulatory controls 108, or both. Although Figure 1 illustrates the computing asset 104 as having only one state 106 and being governed by only one regulatory control 108, this is a non-limiting example. In various aspects, the computing asset 104 may have any suitable number of states and be governed by any suitable number of regulatory controls.

[0045] In various examples, a condition 106 may violate a prescribed control 108, may be non-compliant with a prescribed control 108, or may be both. As will be described below, in various cases, the Health Check risk assessment system 102 may quantify a security level risk associated with such non-compliance.

[0046] In various embodiments, the Health Check risk assessment system 102 can include a processor 110 (e.g., a computer processing unit, microprocessor) and a computer-readable memory 112 operatively connected to the processor 110. The memory 112 can store computer-executable instructions that, when executed by the processor 110, cause the processor 110 or other components of the Health Check risk assessment system 102 (e.g., the baseline component 114, the weakness component 116, the environment component 118, the criticality component 120, the maturity component 122), or both, to perform one or more operations. In various embodiments, the memory 112 can store and the processor 110 can execute the computer-executable components (e.g., the baseline component 114, the weakness component 116, the environment component 118, the criticality component 120, the maturity component 122).

[0047] In various embodiments, the Health Check risk assessment system 102 can scan and / or query the computing assets 104 for the states 106 via any suitable technique. That is, the Health Check risk assessment system 102 can electronically retrieve the states 106 (e.g., the values ​​of the states 106) from the computing assets 104. In various embodiments, the Health Check risk assessment system 102 can learn the prescribed controls 108 via any suitable technique. For example, the Health Check risk assessment system 102 can electronically retrieve the prescribed controls 108 from any suitable data structure and / or data source accessible to the Health Check risk assessment system 102 (e.g., again, while FIG. 1 depicts the prescribed controls 108 as being within the computing assets 104, this is not intended to be limiting and in some cases the prescribed controls 108 can be stored in a data structure (not shown) remote from the computing assets 104). In some cases, the Health Check risk assessment system 102 may be preprogrammed to already know the prescribed controls 108, or the Health Check risk assessment system 102 may receive the prescribed controls 108 electronically as input from an operator, or both. In either case, the Health Check risk assessment system 102 may know both the conditions 106 and the prescribed controls 108.

[0048] In various embodiments, the Health Check risk assessment system 102 can include a baseline component 114. In various aspects, the baseline component 114 can generate a baseline Health Check risk score based on the conditions 106 and / or the prescribed controls 108. In various aspects, the baseline component 114 can implement any suitable risk quantification technique, such as a CCSS technique (e.g., including attack vector, access complexity, authentication metric, confidentiality impact, integrity impact, or availability impact, or a combination thereof) to generate the baseline Health Check risk score. However, as discussed above, such risk quantification techniques are less than optimal because they cannot take into account various details such as the magnitude of non-compliance, the criticality of the computing asset 104, or the deviation between the prescribed controls 108 and the corresponding recommended controls (e.g., industry standards and / or best practices), or a combination thereof. The Health Check risk assessment system 102 can address these concerns by mathematically adjusting the baseline Health Check risk score according to weakness factors, environmental factors, criticality factors, or maturity factors, or a combination thereof.

[0049] In various embodiments, the health check risk assessment system 102 can include a weakness component 116. In various aspects, the weakness component 116 can generate or calculate, or generate and calculate, a weakness factor, which can be based on the magnitude to which the state 106 violates the prescribed control 108. For example, assume the state 106 is password age and the prescribed control 108 is a maximum allowable password age. If the state 106 is only slightly non-compliant with the prescribed control 108 (e.g., if the state 106 is 91 days and the prescribed control 108 is 90 days), the weakness factor can be numerically smaller (e.g., proportional to the percentage difference between the state 106 and the prescribed control 108 or another function of the percentage difference between the state 106 and the prescribed control 108, or both), which can indicate a lower security risk. On the other hand, if the non-compliance of the state 106 with the prescribed control 108 is severe (e.g., state 106 is 150 days and prescribed control 108 is 90 days), the weakness factor can be numerically larger (e.g., proportional to the percentage difference between state 106 and prescribed control 108), which can indicate a high security risk. As described further herein, in some cases, the weakness component 116 can generate the weakness factor through machine learning techniques.

[0050] In various embodiments, the health check risk assessment system 102 can include an environmental component 118. In various aspects, the environmental component 118 can generate or calculate, or generate and calculate, environmental factors, which can be based on built-in security mechanisms implemented by the computing asset 104. For example, if the computing asset 104 implements effective or stringent security / privacy mechanisms, or effective and stringent security / privacy mechanisms (e.g., data masking / encryption for signed-in entities, automatic blocking of anomalous behavior, locking of the computing asset 104 after a maximum number of sign-in attempts, internal-only accessibility), the environmental factors can be numerically smaller (indicating, for example, that the computing asset 104 is a hardened target that is resistant to misuse despite not complying with regulatory controls 108). On the other hand, if the computing asset 104 implements ineffective or non-stringent security / privacy mechanisms, or ineffective and non-stringent security / privacy mechanisms (e.g., automated data discovery / classification, mere notification of anomalous behavior for signed-in entities, public accessibility), the environmental factors may be numerically increased (e.g., indicating that the computing asset 104 is a softened target that is less resistant to abuse, which increases the security risks associated with non-compliance with regulatory controls 108). As described further herein, in some cases, the environmental components 118 may generate the environmental factors through machine learning techniques.

[0051] In various embodiments, the Health Check risk assessment system 102 can include a criticality component 120. In various aspects, the criticality component 120 can generate or calculate, or generate and calculate, a criticality factor, which can be based on the importance level of the computing asset 104. Assume that the computing asset 104 is a software application used by a financial institution to electronically facilitate the actual purchase and / or sale of stocks on the market. Such a software application may be critical to the objectives / goals / activities of the financial institution, and thus the criticality factor may be increased (e.g., the software application is so important to the financial institution that non-compliance with the prescribed controls 108 may pose a particularly high security risk). On the other hand, assume that the computing asset 104 is a website used by the financial institution to display advertising materials. Such a website may not be critical to the objectives / goals / activities of the financial institution, and thus the criticality factor may be decreased (e.g., the website is not so important to the financial institution that non-compliance with the prescribed controls 108 may not be of particular concern). As described further herein, in some cases, the criticality component 120 can generate the criticality factor through machine learning techniques.

[0052] In various embodiments, the health check risk assessment system 102 can include a maturity component 122. In various aspects, the maturity component 122 can generate or calculate, or generate and calculate, a maturity factor, which can be based on a difference or deviation or both between the prescribed controls 108 and the recommended controls (e.g., best practices and / or industry standards). For example, assume that the prescribed controls 108 specify a maximum acceptable password age of 90 days and the recommended controls specify a maximum acceptable password age of 60 days. In such a case, the prescribed controls 108 are less stringent and / or stricter than the recommended controls. Thus, even if the state 106 complies with the prescribed controls 108, the state 106 may pose a significant security risk. For example, if the actual password age in state 106 is 80 days, state 106 may be objectively insecure because although state 106 meets the requirements of regulatory control 108, which specifies a maximum allowable password age of 90 days, state 106 is inconsistent with recommended control, which specifies a maximum allowable password age of 60 days.

[0053] In various cases, the Health Check risk assessment system 102 can include an adjustment component 124. In various embodiments, the adjustment component 124 can mathematically adjust the baseline Health Check risk score using weakness factors, environmental factors, criticality factors, or maturity factors, or a combination thereof, thereby providing an adjusted Health Check risk score that is more accurate than the baseline Health Check risk score.

[0054] 2 illustrates a block diagram of an exemplary, non-limiting system 200 that can facilitate automated health check risk assessment of computing assets, including a baseline health check risk score, in accordance with one or more embodiments described herein. As shown, in some cases, system 200 can include the same components as system 100 and can further include a baseline health check risk score 202.

[0055] As described above, the baseline component 114 may generate or calculate, or generate and calculate, a baseline health-check risk score 202 by any suitable health-check risk assessment technique (e.g., CCSS technique) based on the conditions 106 and / or the prescribed controls 108. In various embodiments, as described above, the baseline health-check risk score 202 may quantify a risk level associated with non-compliance of the conditions 106 with the prescribed controls 108 (e.g., a high value of the baseline health-check risk score 202 may indicate a high risk level). However, the baseline health-check risk score 202 may be less than optimal, or may not be sufficiently accurate, or both. This is because, at least, the CCSS techniques fail to consider the magnitude of non-compliance (e.g., the CCSS techniques consider whether a condition 106 violates a prescribed control 108 in an either / or manner without considering the severity or amount or both of the violation), the CCSS techniques fail to consider the criticality level of the computing asset 104 (e.g., the CCSS techniques consider two different computing assets to pose an equal level of risk if they violate the same prescribed control without considering how critical each asset is), and the CCSS techniques fail to consider the difference between a prescribed control 108 and a recommended control (e.g., the CCSS techniques take a prescribed control 108 at face value even if the prescribed control 108 is significantly less stringent than the industry standard). As described herein, the Health Check risk assessment system 102 can adjust the baseline Health Check risk score 202 to address these shortcomings.

[0056] 3 illustrates a block diagram of an exemplary, non-limiting system 300 that can facilitate automated health check risk assessment of computing assets, including weakness factors, in accordance with one or more embodiments described herein. As shown, in some cases, system 300 can include the same components as system 200 and can further include a machine learning classifier 302 and weakness factors 304.

[0057] In various embodiments, the machine learning classifier 302 may be any suitable computer-implemented artificial intelligence algorithm that may be trained to receive input information regarding the prescribed control 108 and generate as an output the weakness category to which the prescribed control 108 belongs. That is, the machine learning classifier 302 may determine whether the prescribed control 108 is associated with a passive weakness (e.g., whether the prescribed control 108 may be labeled as a passive control), a direct active weakness (e.g., whether the prescribed control 108 may be labeled as a direct active control), or an indirect active weakness (e.g., whether the prescribed control 108 may be labeled as an indirect active control). Although not shown in the figures, in some aspects the weakness component 116 may electronically receive and / or retrieve one or more control documents as input from any suitable electronically accessible data source. In various cases, the one or more control documents can be technical documentation (e.g., GitHub documents, design / development documents) that describes and / or characterizes the attributes, purpose, and / or details of the prescribed control 108. In various embodiments, the one or more control documents can be written in any suitable natural language (e.g., any suitable human-readable text). In various examples, the weakness component 116 can generate the numerical representation of the one or more control documents described herein by any suitable technique, such as word embeddings and / or language modeling. In various cases, the machine learning classifier 302 can be trained to receive as input the numerical representation of the one or more control documents that describe the prescribed control 108 (the numerical representation can be thought of as an input feature vector, for example) and determine as output the weakness category to which the prescribed control 108 belongs. In various embodiments, the weakness component 116 can then generate the weakness factor 304 based on the weakness category determined by the machine learning classifier 302.

[0058] FIG. 4 illustrates an exemplary, non-limiting table 400 associated with weakness factors, according to one or more embodiments described herein. In other words, the table 400 illustrates a short description of various, non-limiting weakness categories with which the machine learning classifier 302 can be trained to label the prescribed controls 108. As illustrated, the prescribed controls 108 can be classified as relating to passive or active weaknesses. In various cases, a prescribed control 108 can be associated with a passive weakness if non-compliance with the prescribed control 108 poses a risk that allows an attacker to prevent the computing asset 104 from performing an authorized operation, such as preventing the execution of a particular component or software application, or both, or preventing the generation of an audit log record. In various aspects, a prescribed control 108 can be associated with an active weakness if non-compliance with the prescribed control 108 poses a risk that allows an attacker to perform an unauthorized operation, such as accessing, copying, or editing sensitive data, or a combination thereof. Additionally, in some cases, active weaknesses can be further classified into direct active weaknesses and indirect active weaknesses. In various examples, if a prescribed control 108 is associated with an active weakness and an exploit of the prescribed control 108 is known to already exist, the prescribed control 108 can be associated with a direct active weakness. On the other hand, if a prescribed control 108 is associated with an active weakness and an exploit of the prescribed control 108 is not known to already exist, the prescribed control 108 can be associated with an indirect active weakness. One skilled in the art will appreciate that passive weaknesses, direct active weaknesses, and indirect active weaknesses are based on the Common Configuration Scoring System established by the National Institute of Standards and Technology. In various embodiments, any other suitable weakness categories and / or subcategories can be implemented.

[0059] The machine learning classifier 302 can receive as input a numerical representation as described herein of technical documentation describing / characterizing the prescribed control 108 and can determine as output a weakness category associated with the prescribed control 108 (e.g., can determine whether the prescribed control 108 is associated with a passive weakness, a direct active weakness, or an indirect active weakness). In various aspects, the weakness component 116 can generate or calculate, or generate and calculate, the weakness factor 302 based on the determined weakness category. For example, if the machine learning classifier 302 determines that the prescribed control 108 is associated with a passive weakness, the weakness component 116 can determine that the non-compliance of the state 106 with the prescribed control 108 is not particularly serious (e.g., a passive weakness can be considered not particularly serious because it is not associated with the performance of unauthorized actions, but instead with the disruption of authorized actions; it is self-evident in the art that the performance of unauthorized actions is a more pernicious threat than the disruption of authorized actions). Thus, the weakness factor 304 may be set to a correspondingly low value (e.g., 0, as shown in FIG. 4). Alternatively, if the machine learning classifier 302 determines that the prescribed control 108 is associated with a direct active weakness, the weakness component 116 may determine that the state 106's non-compliance with the prescribed control 108 is particularly severe (e.g., a direct active weakness may be considered particularly severe because a known exploit already exists). Thus, the weakness factor 304 may be set to a correspondingly high value (e.g., 3, as shown in FIG. 4). In various cases, if the machine learning classifier 302 determines that the prescribed control 108 is associated with an indirect active weakness, the weakness component 116 may determine that the state 106's non-compliance with the prescribed control 108 depends on the magnitude of the non-compliance (e.g., an indirect active weakness may be considered to have a variable severity depending on the severity of the non-compliance because, although it is associated with the execution of a disallowed action, a known exploit does not yet exist).Thus, the vulnerability factor 304 can be a function of the difference (e.g., percentage or absolute difference, or both) between the state 106 and the prescribed control 108. In various cases, when the prescribed control 108 relates to an indirect active vulnerability, the value of the vulnerability factor 304 can be lower bounded by a value set for the passive vulnerability and upper bounded by a value set for the direct active vulnerability. For example, the weakness factor 304 may be 0 if the condition 106 complies with the prescribed control 108, a correspondingly higher value (e.g., 1) if the condition 106 violates the prescribed control 108 by a first predetermined margin / percentage (e.g., if the condition 106 is 50% high / low), and an even higher value (e.g., 2) if the condition 106 violates the prescribed control 108 by a second predetermined margin / percentage that is greater than the first predetermined margin / percentage (e.g., if the condition 106 is 75% high / low). In any event, when the prescribed control 108 relates to an indirect active weakness, the weakness factor 304 may be any suitable function of the difference between the condition 106 and the prescribed control 108. As discussed above, conventional health check risk assessment techniques ignore such differences.

[0060] In various embodiments, the machine learning classifier 302 may be trained using any suitable training technique (e.g., supervised learning, unsupervised learning, reinforcement learning). Additionally, in some cases, the machine learning classifier 302 may undergo active learning. That is, in various embodiments, the weakness component 116 may receive real-time feedback from any suitable operator (not shown) regarding the output weakness category classifications generated by the machine learning classifier 302. In various embodiments, based on such feedback, the parameters of the machine learning classifier 302 may be updated or retrained (e.g., by backpropagation), or updated and retrained.

[0061] To facilitate some of the above-mentioned machine learning aspects of various embodiments of the present invention, consider the following discussion of artificial intelligence. Various embodiments of the present invention described herein may facilitate automating one or more features of the present invention using artificial intelligence (AI). Components may employ various AI-based schemes to perform various embodiments / examples disclosed herein. To provide or aid in the many determinations of the present invention (e.g., determining, ascertaining, inferring, calculating, predicting, foreseeing, estimating, deriving, forecasting, detecting, calculating), components of the present invention may examine the entirety or a subset of data to which they have access, and may provide inferences regarding or determine the state of the system, environment, or both from a set of observations captured via events and / or data. The determinations may be used to identify specific contexts or actions, or may generate, for example, a probability distribution of states. The determinations may be probabilistic, i.e., the calculation of a probability distribution of states of interest based on a consideration of data and events. The determinations may also refer to techniques used to compose higher level events from a set of events and / or data.

[0062] Such a determination may result in constructing new events or actions from a set of observed events and / or stored event data, whether the events are closely correlated in time and whether the events and data are from one or multiple event and data sources. The components disclosed herein may use a variety of classification schemes and / or systems (explicitly trained (e.g., by training data) and implicitly trained (e.g., by observing behaviors, preferences, historical information, receiving external information)) in conjunction with performing automated and / or determined actions related to the claimed subject matter (e.g., support vector machines, neural networks, expert systems, Bayesian belief networks, fuzzy logic, data fusion engines). Thus, the classification schemes and / or systems may be used to automatically learn and perform certain functions, actions or decisions, or combinations thereof.

[0063] A classifier can map an input attribute vector z = (z1,z2,z3,z4,zn) to the confidence that this input belongs to a class by f(z) = confidence(class). Such classification can use a probability-based analysis (e.g., taking into account analysis utility and cost) or a statistics-based analysis or both to determine the action to be taken automatically. A support vector machine (SVM) can be an example of a classifier that can be used. SVM works by finding a hyper-surface in the universe of possible inputs, where the hyper-surface attempts to separate triggering criteria from non-triggering events. Intuitively, this makes this classification suitable for testing data that is close to, but not exactly the same as, the training data. Other directed and undirected model classification approaches include, for example, Naive Bayes, Bayesian networks, decision trees, neural networks, fuzzy logic models or probabilistic classification models that provide different patterns of independence, or combinations of these, any of which can be used. Classification as used herein also is inclusive of statistical regression that is utilized to develop models of priority.

[0064] 5 illustrates a block diagram of an exemplary, non-limiting system 500 that can facilitate automated health check risk assessment of computing assets, including environmental factors, in accordance with one or more embodiments described herein. As shown, in some cases, system 500 can include the same components as system 300 and can further include a machine learning classifier 502 and environmental factors 504.

[0065] In various embodiments, the machine learning classifier 502 may be any suitable computer-implemented artificial intelligence algorithm that may be trained to receive input information regarding the computing asset 104 and generate as output a decision regarding the computing asset 104. Although not shown in the figures, in some aspects, the environment component 118 may electronically receive and / or retrieve one or more asset documents as input from any suitable electronically accessible data source. In various cases, the one or more asset documents may be technical documentation (e.g., GitHub documents, design / development documents) that describes and / or characterizes the attributes, purpose and / or details of the computing asset 104. In various aspects, the one or more asset documents may be written in any suitable natural language (e.g., any suitable human-readable text), and the environment component 118 may generate the numerical representation of the one or more asset documents as described herein by any suitable technique, such as word embeddings and / or language modeling. In various cases, the machine learning classifier 502 can be trained to receive as input a numerical representation (which may be thought of as, for example, an input feature vector) of one or more asset documents describing the computing asset 104, and determine as output which built-in security mechanisms the computing asset 104 uses. In various cases, various artificial intelligence details discussed above can be applied to the machine learning classifier 502. In various aspects, the environmental component 118 can then generate environmental factors 504 based on the security mechanisms detected by the machine learning classifier 502.

[0066] 6 illustrates an exemplary, non-limiting table 600 associated with environmental factors, according to one or more embodiments described herein. In other words, table 600 illustrates various non-limiting security mechanisms that may be implemented by the computing asset 104 and detected by the machine learning classifier 502. Additionally, table 600 illustrates various non-limiting weights that may be assigned to each security mechanism. For example, the machine learning classifier 502 may determine what type of access is implemented by the computing asset 104 (e.g., internal access only (more protection) vs. public access (less protection)), what type of change paradigm is implemented by the computing asset 104 (e.g., immutable (more protection) vs. mutable / transient (less protection)), what type of instantiation paradigm is implemented by the computing asset 104 (e.g., isolated (more protection) vs. multi-tenancy (less protection)), whether services are still available for the computing asset 104, and so on. The computing asset 104 may determine whether a security mechanism is available (e.g., available (more protection) vs. unavailable (less protection)), what type of data protection protocol is implemented by the computing asset 104 (e.g., auto-discovery (less protection) vs. masking / encryption (more protection)), what type of compliance enforcement is implemented by the computing asset 104 (e.g., inspection only (less protection) vs. remediation (more protection)), or what type of anomaly detection is implemented by the computing asset 104 (e.g., notification only (less protection) vs. prevention / blocking (more protection)), or a combination thereof. It should be understood that FIG. 6 is a non-limiting example, and that any other suitable security mechanisms may be detectable by the machine learning classifier 502.

[0067] As shown, the environmental component 118 can assign different values / weights to different security mechanisms, and the environmental factor 504 can be any suitable function (e.g., maximum, average) of the values / weights of the different security mechanisms implemented by the computing asset 104. For example, if the computing asset 104 is only internally accessible (0.2), mutable / transient (0.6), and only provides notifications (0.8), then the environmental factor 504 can be the maximum of 0.2, 0.6, and 0.8, i.e., 0.8. In another embodiment, the environmental factor 504 can be the average of 0.2, 0.6, and 0.8.

[0068] 7 illustrates a block diagram of an exemplary, non-limiting system 700 that can facilitate automated health check risk assessment of computing assets, including criticality factors, in accordance with one or more embodiments described herein. As shown, in some cases, system 700 can include the same components as system 500 and can further include a machine learning classifier 702 and a criticality factor 704.

[0069] In various embodiments, the machine learning classifier 702 can be any suitable computer-implemented artificial intelligence algorithm that can be trained to receive input information about the computing asset 104 and generate as output a decision about the computing asset 104. Although not shown in the figures, in some aspects the criticality component 120 can electronically receive and / or retrieve one or more documents as input from any suitable electronically accessible data source. In various cases, the one or more documents can describe and / or characterize the attributes, objectives, goals and / or details (e.g., advertisements, mission statements, business plans / presentations) of the computing asset 104 and / or the entity that owns / operates the computing asset 104. In various aspects, the one or more documents can be written in any suitable natural language (e.g., any suitable text that is human readable), and the criticality component 120 can generate a numerical representation of the one or more documents as described herein by any suitable technique, such as word embeddings and / or language modeling. In various cases, the machine learning classifier 702 can be trained to receive as input a numerical representation (which may be thought of as, for example, an input feature vector) of one or more documents describing the computing asset 104 and the entity that owns / operates the computing asset 104, and to determine as output a level of importance of the computing asset 104 to the goals / purposes / activities of the entity that owns / operates the computing asset 104. In various examples, the importance level of the computing asset 104 can be based on an entire application cluster associated with the computing asset 104 (e.g., the importance of a server can be based not only on the server itself, but also on the applications running on the server, and / or on data stored, maintained, retrieved, compiled by the server, and / or otherwise interacted with the server).In various cases, various of the above-mentioned artificial intelligence details can be applied to the machine learning classifier 702. In various aspects, the criticality component 120 can then generate a criticality factor 704 based on the importance level determined by the machine learning classifier 702.

[0070] For example, if the machine learning classifier 702 determines that the computing asset 104 is not very important to the goals / objectives / activities of the entity that owns / operates the computing asset 104, the criticality component 704 may be assigned a low value (e.g., a financial institution may utilize a website for advertising purposes, which is not very important to the financial institution's goals / objectives / activities, and therefore the criticality factor 704 for that website may be 0). If the machine learning classifier 702 determines that the computing asset 104 is important to the goals / objectives / activities of the entity that owns / operates the computing asset 104, the criticality component 704 may be assigned a medium value (e.g., a financial institution may utilize a database for storing sensitive customer information, which is important to the financial institution's goals / objectives / activities, and therefore the criticality factor 704 for that database may be 1.3). If the machine learning classifier 702 determines that the computing asset 104 is highly critical to the goals / objectives / activities of the entity that owns / operates the computing asset 104, the criticality component 704 may be increased (e.g., a financial institution may utilize a software application to electronically transfer funds to and from customer accounts, and the software application may have a criticality factor 704 of 4.3 because the software application is highly critical to the financial institution's goals / objectives / activities). In various aspects, any number of suitable criticality levels / gradations (e.g., non-critical, critical, super-critical, or any other intermediate levels or combinations thereof) may be implemented. In some embodiments, the entity that owns / operates the computing asset 104 may manually configure the criticality factor 704 as desired. As discussed above, conventional health check risk assessment techniques ignore the criticality level of the computing asset.

[0071] 8 illustrates a block diagram of an exemplary, non-limiting system 800 that can facilitate automated health check risk assessment of computing assets, including maturity factors, in accordance with one or more embodiments described herein. As shown, in some cases, system 800 can include the same components as system 700 and can further include a maturity factor 802.

[0072] Although not shown in the figures, in various embodiments, the maturity component 122 can electronically receive and / or retrieve recommended controls corresponding to the prescribed controls 108 from any suitable electronically accessible data source. In various aspects, as discussed above, the prescribed controls 108 can be considered rules, regulations, standards, or benchmarks, or combinations thereof, established by the entity that owns / operates the computing asset 104, with which the state 106 must conform. However, in various examples, the recommended controls can be best practices implemented in the relevant industry, and the prescribed controls 108 may not match or be inconsistent with the recommended controls, or both. Thus, in some cases, the state 106 may conform to the prescribed controls 108, but nevertheless indicate a serious security threat because the prescribed controls 108 are looser and / or less stringent than the recommended controls. For example, assume that the prescribed controls 108 specify a maximum allowable password age of 60 days and the recommended controls specify a maximum allowable password age of 30 days. If the actual password age of state 106 is 50 days, state 106 may be considered compliant with prescribed controls 108, but state 106 may nevertheless pose a significant security threat because state 106 does not comply with the recommended controls (e.g., prescribed controls 108 are much less stringent and / or secure than the recommended controls). Thus, in various aspects, the value of maturity factor 802 may be any suitable function of the difference or deviation or both between prescribed controls 108 and the recommended controls (e.g., proportional to a percentage difference or absolute difference or both). As discussed above, conventional health check risk assessment techniques ignore such differences / deviations.

[0073] In some cases, as will be further described below, a computing asset 104 may be governed by and / or subject to many different regulatory controls. In such cases, the maturity factor 802 may be based on the average difference and / or average deviation between such different regulatory controls and their corresponding best practice values. If the average difference / deviation is greater than a predetermined first predetermined threshold, the maturity factor 802 may take a first value. If the average difference / deviation is greater than a predetermined second threshold, the maturity factor 802 may take a second value. Any suitable number of predetermined thresholds and / or values ​​may be implemented.

[0074] 9 illustrates a block diagram of an exemplary, non-limiting system 900 that can facilitate automated health check risk assessment of computing assets, including a reconciliation component, in accordance with one or more embodiments described herein. As shown, in some cases, system 900 can include the same components as system 800 and can further include a reconciliation component 124.

[0075] In various embodiments, the adjustment component 124 can adjust the baseline health check risk score 202 based on the weakness factor 304, the environmental factor 504, the criticality factor 704, or the maturity factor 802, or a combination thereof. Specifically, the adjustment component 124 can multiply the baseline health check risk score 202 by the environmental factor 504, thereby providing a first product. In various aspects, the adjustment component 124 can add the weakness factor 304 to this first product, thereby providing a first sum. In various examples, the adjustment component 124 can multiply the first sum by the criticality component 704, thereby providing a second product. In various cases, the adjustment component 124 can multiply the second product by the maturity factor 802, thereby providing an adjusted health check risk score 902. In other words, the adjusted health check risk score 902 can be given by the following formula: ARS = (BRS x EF + WF) x CF x MF In the above equation, ARS represents the adjusted health check risk score 902, BRS represents the baseline health check risk score 202, EF represents the environmental factor 504, WF represents the weakness factor 304, CF represents the criticality factor 704, and MF represents the maturity factor 802. In various embodiments, the above equation showing how ARS can be a function of BRS, EF, WF, CF, and MF are non-limiting examples of equations that can be used to generate the adjusted health check risk score 902, and other equations are possible. For example, the adjusted health check risk score 902 can be any other suitable mathematical function of the weakness factors 304, environmental factors 504, criticality factors 704, or maturity factors 802, or combinations thereof (e.g., EF can be added rather than multiplied, WF can be multiplied rather than added, CF can be added rather than multiplied, and MF can be added rather than multiplied). That is, in various embodiments, any other suitable formulas and / or mathematical operations can be applied to the BRS, EF, WF, CF, and MF, in any suitable permutations and / or combinations, to generate the ARS. Because the adjusted health check risk score 902 takes into account the severity / magnitude of the non-compliance (e.g., weakness factor 304), the built-in security mechanisms of the computing asset 104 (e.g., environmental factor 504), the importance of the computing asset 104 (e.g., criticality factor 704), or the difference between the prescribed control 108 and best practices (e.g., maturity factor 802), or a combination thereof, in various cases, the adjusted health check risk score 902 can more accurately quantify the risk level associated with the non-compliance of the condition 106 against the prescribed control 108.

[0076] In various embodiments, the health-check risk assessment system 102 can take any appropriate action based on the adjusted health-check risk score 902. For example, the health-check risk assessment system 102 can generate, transmit, or display on a computer monitor / screen an electronic alert / alert based on the adjusted health-check risk score 902, or a combination thereof (e.g., the health-check risk assessment system 102 can generate or display, or generate and display, an appropriate alert / alert if the adjusted health-check risk score 902 is greater than a predetermined threshold). In some cases, the health-check risk assessment system 102 can automatically schedule, request, or effect service / maintenance on the computing asset 104 based on the adjusted health-check risk score 902, or a combination thereof (e.g., the health-check risk assessment system 102 can automatically electronically contact a service / maintenance entity if the adjusted health-check risk score 902 is greater than a predetermined threshold).

[0077] 10 illustrates a block diagram of an exemplary, non-limiting system 1000 that can facilitate automated health check risk assessment of computing assets, including an aggregation component, in accordance with one or more embodiments described herein. As shown, in some cases, system 1000 can include the same components as system 900 and can further include an aggregation component 1002.

[0078] The above description primarily describes how the health check risk assessment system 102 may generate an adjusted health check risk score 902 for a computing asset 104 based on the regulatory controls 108. However, in various embodiments, the computing asset 104 may be governed by multiple regulatory controls (as shown in FIG. 11). In such cases, the health check risk assessment system 102 may generate / calculate a separate adjusted health check risk score for each of the multiple regulatory controls governing the computing asset 104, and the aggregation component 1002 may aggregate such adjusted health check risk scores together by any suitable technique (e.g., by a weighted average function, a maximum function), thereby providing an aggregated health check risk score for the computing asset 104. Additionally, in some cases, the health check risk assessment system 102 may be electronically coupled to the multiple computing assets (as shown in FIG. 11). In various embodiments, the health check risk assessment system 102 can calculate a separate aggregated health check risk score for each of the multiple computing assets, and the aggregation component 1002 can aggregate such aggregated health check risk scores together by any suitable technique (e.g., by a weighted average function or a maximum function or both).

[0079] FIG. 11 illustrates a block diagram of an exemplary, non-limiting computing asset hierarchy 1100 in accordance with one or more embodiments described herein. As shown, a computing account 1102 can include multiple computing groups 1104. Additionally, in some cases, the multiple computing groups 1104 can include multiple computing assets 1106 that can be governed by and / or subordinate to multiple regulatory controls 1108. Specifically, the multiple computing groups 1104 can include computing group 1 through computing group N, for any suitable number N. Additionally, as shown, computing group 1 can itself correspond to multiple computing assets (e.g., computing asset 1_1 through computing asset 1_M, for any suitable number M). Similarly, computing group N can correspond to multiple computing assets (e.g., computing asset N_1 through computing asset N_M, for any suitable number M). Although computing group 1 and computing group N are shown as having the same number of computing assets, this is a non-limiting example. In various cases, the computing groups can have different numbers of computing assets. In various aspects, computing asset 1_1 can be governed by and / or subordinate to multiple regulatory controls (e.g., control 1_1_1 through control 1_1_P for any suitable number P). Similarly, computing asset N_M can be governed by and / or subordinate to multiple regulatory controls (e.g., control N_M_1 through control N_M_P for any suitable number P). Although computing asset 1_1 and computing asset N_M are shown as being subordinate to the same number of regulatory controls, this is a non-limiting example.In various cases, these computing assets may be subject to a different number of regulatory controls.

[0080] As described above, the health check risk assessment system 102 may generate an adjusted health check risk score for each of the plurality of prescribed controls 1108 (e.g., a baseline health check risk score for each prescribed control, a weakness factor for each prescribed control, an environmental factor for each prescribed control, a criticality factor for each prescribed control, or a maturity factor for each prescribed control, or a combination thereof, may be calculated, which may be combined together by the adjustment component 124 to calculate an adjusted health check risk score for each prescribed control, thereby providing a total of N×M×P adjusted health check risk scores). In various examples, the aggregation component 1002 may, for each of the plurality of computing assets 1106, aggregate all of the adjusted health check risk scores related to that computing asset together (e.g., by a weighted average or a max function, or both) to form an aggregated asset health check risk score for the computing asset (e.g., the adjusted health check risk scores related to computing asset 1_1 may be aggregated to generate an aggregated asset health check risk score for computing asset 1_1; the adjusted health check risk scores related to computing asset 1_M may be aggregated to generate an aggregated asset health check risk score for computing asset 1_M; the adjusted health check risk scores related to computing asset N_1 may be aggregated to generate an aggregated asset health check risk score for computing asset N_1; and the adjusted health check risk scores related to computing asset N_M may be aggregated to generate an aggregated asset health check risk score for computing asset N_M, thereby providing a total of N×M aggregated asset health check risk scores).In various embodiments, for each of the plurality of computing groups 1104, the aggregation component 1002 can aggregate together (e.g., by a weighted average or a max function, or both) all of the aggregated asset health check risk scores related to that computing group to form an aggregated group health check risk score for the computing group (e.g., the aggregated asset health check risk scores related to computing group 1 can be aggregated to generate an aggregated group health check risk score for computing group 1, and the aggregated asset health check risk scores related to computing group N can be aggregated to generate an aggregated group health check risk score for computing group N, thereby providing a total of N aggregated group health check risk scores). Finally, in various aspects, the aggregation component 1002 can aggregate together (e.g., by a weighted average or a max function, or both) all of the aggregated group health check risk scores to generate an aggregated account health check risk score. In this manner, accurate Health Check risk scores can be generated at any appropriate level of granularity (e.g., per regulatory control, per computing asset, per computing group, or per computing account, or a combination thereof). Thus, the Health Check risk assessment system 102 can make it easier for an operator to accurately triage different non-compliant controls, different computing assets, different computing groups, or different computing accounts, or a combination thereof, which constitutes a useful and practical use of the computer.In other words, management, servicing and / or maintenance of computing assets may be prioritized according to the adjusted or aggregated Health Check Risk Score, or the adjusted and aggregated Health Check Risk Score (e.g., computing assets / groups / accounts with higher Health Check Risk Score may be considered more urgent and therefore may be serviced first, and computing assets / groups / accounts with lower Health Check Risk Score may be considered less urgent and therefore may be serviced later).

[0081] Although the above discussion states that the Health Check risk scores can be aggregated to a higher level using a weighted average or max function or both (e.g., computing assets can be aggregated into computing groups, and computing groups can be aggregated into computing accounts), this is a non-limiting example. In various embodiments, any other suitable aggregation algorithm can be implemented. For example, the total risk of a computing group can be determined by counting the number of high-risk computing assets in the computing group (e.g., the computing asset can be high risk if the aggregated asset Health Check risk score exceeds a high threshold), by counting the number of medium-risk computing assets (e.g., the computing asset can be medium risk if the aggregated asset Health Check risk score exceeds a medium threshold), or by counting the number of low-risk computing assets (e.g., the computing asset can be low risk if the aggregated asset Health Check risk score exceeds a low threshold), or a combination thereof. For example, a computing group may be deemed high risk if it has greater than 1% high risk computing assets or greater than 20% medium risk computing assets; a computing group may be deemed medium risk if it has less than 1% high risk computing assets, less than 20% medium risk computing assets, or greater than 50% low risk computing assets; otherwise, a computing group may be deemed low risk.

[0082] 12 illustrates a flow diagram of an exemplary, non-limiting computer-implemented method 1200 that can facilitate automated health check risk assessment of computing assets in accordance with one or more embodiments described herein. It should be noted that the operations performed in FIG. 12 are non-limiting examples and can be performed in any suitable order (e.g., not limited to the order shown in FIG. 12).

[0083] In various embodiments, the operation 1202 may include generating, by a device (e.g., 114) operably coupled to the processor, a baseline health check risk score (e.g., 202) corresponding to non-compliance of the computing asset (e.g., 104) with a regulatory control (e.g., 108).

[0084] In various embodiments, operation 1204 can include adjusting, by the device (e.g., 116), the baseline health check risk score based on a weakness factor (e.g., 304) of the prescribed control, where the weakness factor can be based on the extent to which the condition of the computing asset (e.g., 106) deviates from the prescribed control.

[0085] In various embodiments, operation 1206 may include adjusting, by the device (e.g., 118), the baseline health check risk score based on environmental factors (e.g., 504) of the computing asset, which may be based on security mechanisms or security protocols associated with the computing asset.

[0086] In various embodiments, operation 1208 can include adjusting, by a device (e.g., 120), the baseline health check risk score based on a criticality factor (e.g., 704) of the computing asset, where the criticality factor can be based on an importance level of the computing asset.

[0087] In various embodiments, operation 1210 can include adjusting, by a device (e.g., 122), a baseline health check risk score based on a maturity factor (e.g., 802) of the computing asset, where the maturity factor can be based on a difference between the prescribed controls and the recommended controls.

[0088] It should be understood that the numerical values, percentages or thresholds or combinations thereof disclosed herein are non-limiting examples, and in various embodiments, any other suitable values, percentages or thresholds or combinations thereof can be implemented.

[0089] As a non-limiting example, the description herein describes that an artificial intelligence paradigm may be utilized to generate / calculate the weakness factors 304, environmental factors 504, criticality factors 704, or maturity factors 802, or combinations thereof. In various embodiments, such factors may be generated / calculated by any suitable technique, whether or not machine learning is implemented.

[0090] Much of the above discussion uses password age and / or password length as examples to clarify the above teachings. Such examples are understood to be non-limiting. In various cases, the teachings herein may be applied to any suitable state, characteristic or technical attribute or combination of computing assets.

[0091] Various embodiments of the present invention comprise a computerized diagnostic tool that can monitor one or more computing assets for compliance and / or non-compliance with one or more regulatory controls, and can thereby generate / calculate an adjusted Health Check risk score that quantifies the security risk associated with such compliance and / or non-compliance. This can enable an operating entity to prioritize (e.g., triage) which non-compliant issues / assets should be serviced first. Furthermore, as described above, various embodiments of the present invention can take into account the magnitude of the non-compliance, the criticality of the asset, or the maturity of the control, or a combination thereof, so that the adjusted Health Check risk score described herein can be more accurate than a baseline Health Check risk score previously known.

[0092] To provide additional context for the various embodiments described herein, Figure 13 and the following discussion are intended to provide a brief, general description of a suitable computing environment 1300 in which various embodiments of the embodiments described herein may be implemented. Although the embodiments have been described above in the general context of computer-executable instructions that may be executed on one or more computers, those skilled in the art will recognize that the embodiments may also be implemented in combination with other program modules, or as a combination of hardware and software, or both.

[0093] Generally, program modules include routines, programs, components, data structures, etc. that perform particular tasks or implement particular abstract data types. Furthermore, those skilled in the art will recognize that the methods of the present invention may also be practiced with other computer system configurations, including single-processor or multi-processor computer systems, minicomputers, mainframe computers, Internet of Things (IoT) devices, distributed computing systems, personal computers, handheld computing devices, microprocessor-based or programmable consumer electronic devices, etc. Each of these computer system configurations may be operatively coupled to one or more associated devices.

[0094] The illustrated embodiments of the present disclosure may also be practiced in distributed computing environments where certain tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

[0095] A computing device typically includes various media, which may include computer-readable storage media, machine-readable storage media, or communication media, or a combination thereof. In this specification, these two terms are used differently from each other as follows. A computer-readable storage medium or machine-readable storage medium can be any available storage medium that can be accessed by a computer, and includes both volatile and non-volatile media, removable and non-removable media. By way of example, and not limitation, a computer-readable storage medium or machine-readable storage medium can be implemented in relation to any method or technology for storing information, such as computer-readable or machine-readable instructions, program modules, structured or unstructured data, etc.

[0096] A computer-readable storage medium may include, but is not limited to, random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD), Blu-ray disk (BD) or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device, solid state drive or other solid state storage device, or other tangible or non-transitory medium or tangible and non-transitory medium that can be used for the purpose of storing the desired information. In this regard, the terms "tangible" or "non-transitory" as used herein with respect to storage, memory or computer-readable medium, as modifiers, are understood to exclude propagating-only ephemeral signals per se and not to waive any rights to all standard storage, memory or computer-readable medium that is not itself a propagating-only ephemeral signal.

[0097] The computer-readable storage medium may be accessed by one or more local or remote computing devices for various operations on the information stored by the medium, e.g., via access requests, queries or other data retrieval protocols.

[0098] Communication media typically embodies computer-readable instructions, data structures, program modules, or other structured or unstructured data in a data signal, such as a modulated data signal, e.g., a carrier wave or other transport mechanism, and includes any information delivery or transport media. The term "modulated data signal" refers to a signal that has one or more of the characteristics of a data signal that has been set or changed in such a manner as to encode information in the signal or signals. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media.

[0099] 13, an exemplary environment 1300 for implementing various embodiments of the aspects described herein includes a computer 1302 including a processing unit 1304, a system memory 1306, and a system bus 1308. The system bus 1308 couples system components including, but not limited to, the system memory 1306 to the processing unit 1304. The processing unit 1304 can be any of a variety of processors commercially available. Dual microprocessors and other multi-processor architectures can also be used as the processing unit 1304.

[0100] The system bus 1308 can be any of several types of bus structures that can be further interconnected with a memory bus (with or without a memory controller), a peripheral bus, and a local bus using any of a variety of commercially available bus architectures. The system memory 1306 includes a ROM 1310 and a RAM 1312. A basic input / output system (BIOS) can be stored in a non-volatile memory, such as a ROM, erasable programmable read-only memory (EPROM), or EEPROM, and includes basic routines that help transfer information between elements within the computer 1302, such as during start-up. The RAM 1312 can also include a high-speed RAM, such as a static RAM, for caching data.

[0101] The computer 1302 further includes an internal hard disk drive (HDD) 1314 (e.g., EIDE, SATA), one or more external storage devices 1316 (e.g., a magnetic floppy disk drive (FDD) 1316, a memory stick or flash drive reader, a memory card reader, etc.), and a drive 1320, e.g., a solid state drive, optical disk drive, etc., that can read from or write to a disk 1322, such as a CD-ROM disk, DVD, BD, etc. Alternatively, if a solid state drive is included, the disk 1322 would not be included unless it is separate. Although the internal HDD 1314 is shown as being located within the computer 1302, the internal HDD 1314 can also be configured for external use within a suitable chassis (not shown). Additionally, although not shown in the environment 1300, a solid state drive (SSD) can be used in addition to or in place of the HDD 1314. The HDD 1314, external storage device 1316, and drive 1320 can be connected to the system bus 1308 by a HDD interface 1324, an external storage interface 1326, and a drive interface 1328, respectively. The interface 1324 for external drive implementations can include at least one or both of Universal Serial Bus (USB) and Institute of Electrical and Electronics Engineers (IEEE) 1394 interface technologies. Other external drive connection technologies are contemplated by the embodiments described herein.

[0102] These drives and their associated computer-readable storage media provide non-volatile storage of data, data structures, computer-executable instructions, and the like. With respect to computer 1302, these drives and storage media accommodate the storage of data in a suitable digital format. Although the above description of computer-readable storage media refers to respective types of storage devices, those skilled in the art should appreciate that other types of computer-readable storage media, whether currently existing or developed in the future, may also be used in this exemplary operating environment, and further, that such storage media may include computer-executable instructions for performing the methods described herein.

[0103] A number of program modules may be stored in these drives and RAM 1312, including an operating system 1330, one or more application programs 1332, other program modules 1334, and program data 1336. All or portions of the operating system, applications, modules or data, or any combination thereof, may also be cached in RAM 1312. The systems and methods described herein may be implemented using various commercially available operating systems or combinations of operating systems.

[0104] Optionally, computer 1302 may include emulation technology. For example, the hardware environment of operating system 1330 may be emulated by a hypervisor (not shown) or other intermediary, and optionally the emulated hardware may differ from the hardware shown in FIG. 13. In such an embodiment, operating system 1330 may include one virtual machine (VM) of multiple VMs hosted on computer 1302. Additionally, operating system 1330 may provide a runtime environment, such as the Java® runtime environment or the .NET framework, for application 1332. The runtime environment is a coherent execution environment that allows application 1332 to run on any operating system that includes the runtime environment. Similarly, operating system 1330 may support containers, and application 1332 may take the form of a container, which is a lightweight, self-contained executable package of software that includes, for example, code, runtime, system tools, system libraries, and settings for the application.

[0105] Additionally, computer 1302 can be enabled with a security module, such as a Trusted Platform Module (TPM). For example, with a TPM, a boot component may hash the next boot component in time and wait for a resulting match with a secure value before loading the next boot component. This process can occur at any layer in the code execution stack of computer 1302, for example, applied at the application execution level or at the operating system (OS) kernel level, thereby enabling security at any level of code execution.

[0106] A user may enter commands and information into the computer 1302 through one or more wired / wireless input devices, such as a keyboard 1338, a touch screen 1340, and a pointing device, such as a mouse 1342. Other input devices (not shown) may include a microphone, an infrared (IR) remote control, a radio frequency (RF) remote control or other remote control, a joystick, a virtual reality controller or headset, or both, a game pad, a stylus pen, an image input device, such as a camera, a gesture sensor input device, a visual motion sensor input device, an emotion or face detection device, a biometric input device, such as a fingerprint or iris scanner, etc. These and other input devices are often connected to the processing unit 1304 through an input device interface 1344 that may be coupled to the system bus 1308, although the input devices may also be connected by other interfaces, such as a parallel port, an IEEE 1394 serial port, a game port, a USB port, an IR interface, a BLUETOOTH® interface, etc.

[0107] A monitor 1346 or other type of display device can also be connected to the system bus 1308 via an interface, such as a video adapter 1348. In addition to the monitor 1346, a computer typically includes other peripheral output devices (not shown), such as speakers, printers, etc.

[0108] The computer 1302 can operate in a networked environment using logical connections via wired and / or wireless communications to one or several remote computers, such as a remote computer 1350. The remote computer 1350 can be a workstation, a server computer, a router, a personal computer, a portable computer, a microprocessor-based entertainment device, a peer device or other common network node, and typically includes many or all of the elements described relative to the computer 1302, although for purposes of brevity, only a memory / storage device 1352 is shown. The logical connections depicted include wired / wireless connectivity to a local area network (LAN) 1354 or to a larger network, such as a wide area network (WAN) 1356, or both. Such LAN and WAN networking environments are commonplace in offices and companies and facilitate enterprise computer networks, such as intranets, all of which may be connected to a global communications network, such as the Internet.

[0109] When used in a LAN networking environment, the computer 1302 can be connected to the local network 1354 through a wired and / or wireless communication network interface or adapter 1358. The adapter 1358 can facilitate wired or wireless communication to the LAN 1354, and the LAN 1354 can further include a wireless access point (AP) disposed on the LAN 1354 for communicating with the adapter 1358 in a wireless mode.

[0110] When used in a WAN networking environment, the computer 1302 may include a modem 1360 or may be connected to a communications server on the WAN 1356 via other means for establishing communications over the WAN 1356, e.g., via the Internet. The modem 1360 may be an internal or external wired or wireless device and may be connected to the system bus 1308 via the input device interface 1344. In a networked environment, program modules depicted relative to the computer 1302, or portions thereof, may be stored in the remote memory / storage device 1352. It will be appreciated that the network connections shown are examples and other means of establishing a communications link between the computers may be used.

[0111] When used in a LAN or WAN networking environment, the computer 1302 may access a cloud storage system or other network-based storage system, such as, but not limited to, a network virtual machine that provides one or more aspects of storing or processing information, in addition to or in place of the external storage device 1316 described above. Generally, a connection between the computer 1302 and the cloud storage system may be established over the LAN 1354 or WAN 1356, for example, by an adapter 1358 or modem 1360, respectively. Upon connecting the computer 1302 to an associated cloud storage system, the external storage interface 1326, with the aid of the adapter 1358 or modem 1360, or both, may manage the storage provided by the cloud storage system in the same manner as any other type of external storage. For example, the external storage interface 1326 may be configured to provide access to the cloud storage sources as if the cloud storage sources were physically connected to the computer 1302.

[0112] The computer 1302 may be operable to communicate with any wireless device or entity operably arranged to communicate wirelessly, such as a printer, a scanner, a desktop or portable computer or both, a portable data assistant, a communications satellite, any equipment or location associated with a wirelessly detectable tag (e.g., a kiosk, a newsagent, a store shelf, etc.), and a telephone. This may include Wireless Fidelity (Wi-Fi) and BLUETOOTH® wireless technologies. Thus, this communication may be in a predefined structure similar to a conventional network, or an ad-hoc communication between at least two devices.

[0113] 14, an exemplary cloud computing environment 1400 is shown. As shown, the cloud computing environment 1400 includes one or more cloud computing nodes 1402 with which local computing devices used by cloud consumers, such as personal digital assistants (PDAs) or mobile phones 1404, desktop computers 1406, laptop computers 1408, or automotive computer systems 1410, or combinations thereof, can communicate. The nodes 1402 can communicate with each other. The nodes may be physically or virtually grouped into one or more networks, such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or combinations thereof (not shown). This allows the cloud computing environment 1400 to provide infrastructure, platform, or software, or combinations thereof, as a service, so that cloud consumers do not need to maintain resources on their local computing devices. It will be understood that the types of computing devices 1404-1410 illustrated in FIG. 14 are intended to be examples only, and that the computing nodes 1402 and cloud computing environment 1400 can communicate with any type of computerized device over any type of network or addressable network connection, or both (e.g., using a web browser).

[0114] Referring now to FIG. 15, a set of functional abstraction layers provided by cloud computing environment 1400 (FIG. 14) is shown. For the sake of brevity, repeated descriptions of the same elements used in other embodiments described herein will be omitted. It should be understood in advance that the components, layers, and functions shown in FIG. 15 are intended to be merely examples, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0115] Hardware and software layer 1502 includes hardware and software components. Examples of hardware components include mainframe 1504, reduced instruction set computer (RISC) architecture based servers 1506, servers 1508, blade servers 1510, storage devices 1512, and networks and networking components 1514. In some embodiments, software components include network application server software 1516 and database software 1518.

[0116] The virtualization layer 1515 provides an abstraction layer that can provide the following instances of virtual entities: virtual servers 1522, virtual storage 1524, virtual networks including virtual private networks 1526, virtual applications and operating systems 1528, and virtual clients 1530.

[0117] In one example, the management layer 1532 may provide the following functions: Resource provisioning 1534 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 1536 provides cost tracking as resources are utilized within the cloud computing environment and charging or billing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification of cloud consumers and tasks and protection of data and other resources. User portal 1538 provides consumers and system administrators with access to the cloud computing environment. Service level management 1540 provides allocation and management of cloud computing resources such that required service levels are achieved. Service Level Agreement (SLA) planning and fulfillment 1542 provides proactive coordination and procurement of anticipated future needs for cloud computing resources according to SLAs.

[0118] Workload tier 1544 provides examples of functionality that may utilize a cloud computing environment. Examples of workloads and functionality that may be provided from this tier include mapping and navigation 1546, software development and lifecycle management 1548, virtual classroom instructional delivery 1550, data analytics processing 1552, transaction processing 1554, and differential privacy federated learning processing 1556. Various embodiments of the present invention may utilize the cloud computing environment described with reference to Figures 14 and 15 to perform one or more differential privacy federated learning processes according to various embodiments described herein.

[0119] The present invention may be a system, method, apparatus, or computer program product, or combinations thereof, at any level of technical detail capable of integration. The computer program product may include a computer readable storage medium having computer readable program instructions thereon for causing a processor to execute aspects of the present invention. The computer readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer readable storage media may further include portable computer diskettes, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices such as punch cards or raised structures in grooves on which instructions are recorded, and any suitable combinations of these. As used herein, computer readable storage media should not be construed as being themselves ephemeral signals, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating in wave guides or other transmission bodies (e.g., light pulses traveling in fiber optic cables), or electrical signals transmitted through electrical wires.

[0120] The computer readable program instructions described herein may be downloaded from a computer readable storage medium into the respective computing / processing device or may be downloaded to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer readable program instructions from the network and transfers the computer readable program instructions for storage in a computer readable storage medium in the respective computing / processing device. The computer readable program instructions for carrying out the operations of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, or configuration data for an integrated circuit, or may be source or object code written in any combination of one or more programming languages, including object oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the “C” programming language or the like. The computer readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or remote server.In the last scenario above, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry, including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry to perform aspects of the invention.

[0121] Aspects of the present invention are described herein with reference to flowchart and / or block diagram illustrations of methods, apparatus (systems) and computer program products according to embodiments of the present invention. It will be understood that each block of those flowchart and / or block diagram illustrations, and combinations of blocks in those flowchart and / or block diagram illustrations, can be implemented by computer readable program instructions. These computer readable program instructions can be provided to a processor of a general purpose computer, a special purpose computer or other programmable data processing apparatus forming a machine such that the instructions executed by the processor of the computer or other programmable data processing apparatus generate means for performing the functions / operations specified in one or more blocks of the flowchart and / or block diagram illustrations. These computer readable program instructions can further be stored on a computer readable storage medium that can direct a computer, programmable data processing apparatus or other device or combination thereof to function in a particular manner such that the computer readable storage medium having instructions stored therein comprises a product including instructions for performing aspects of the functions / operations specified in one or more blocks of the flowchart and / or block diagram illustrations. These computer readable program instructions can further be loaded into a computer, other programmable data processing apparatus or other device to generate a computer-implemented process such that the instructions, executed on the computer, other programmable apparatus or other device, perform the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams, and can cause a series of operations to be performed on the computer, other programmable apparatus or other device.

[0122] The flowcharts and block diagrams in the accompanying figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing specified logical functions. In some alternative implementations, the functions shown in the blocks may be implemented in an order different from that shown in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may be executed in the reverse order depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowcharts, as well as combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that executes the specified functions or operations or executes a combination of dedicated hardware and computer instructions.

[0123] Although the subject matter has been described above in the general context of computer-executable instructions for a computer program product executing on one or more computers, or both, those skilled in the art will recognize that the disclosure may also be implemented in combination with other program modules. Generally, program modules include routines, programs, components, data structures, etc., that perform particular tasks and / or implement particular abstract data types. Furthermore, those skilled in the art will recognize that the computer-implemented methods of the present invention may also be implemented with other computer system configurations, including single-processor or multi-processor computer systems, minicomputing devices, mainframe computers, computers, handheld computing devices (e.g., PDAs, telephones), microprocessor-based or programmable home or industrial electronic devices, and the like. The illustrated aspects may also be implemented in distributed computing environments where tasks are performed by remote processing devices linked through a communications network. However, some, if not all, aspects of the disclosure may also be implemented on stand-alone computers. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

[0124] As used in this application, the terms "component," "system," "platform," "interface," and the like, may refer to or include a computer-related or operational machine-related entity having one or more particular functions. The entities disclosed herein may be hardware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, or a computer, or combinations thereof. As an example, both an application running on a server and the server may be a component. Within a process or thread of execution, or both, one or more components may be localized on one computer or distributed between two or more computers, or both. In another example, each component may be executed from various computer-readable media having various data structures stored thereon. Components may communicate via local or remote processes or both, e.g., according to signals having one or more data packets (e.g., data from one component interacting with another component via signals, whether within a local system, within a distributed system, or with other systems over a network such as the Internet, or a combination thereof). As another example, a component may be a device having a particular function provided by mechanical parts operated by electrical or electronic circuitry, which is operated by a software or firmware application executed by a processor. In such cases, the processor may be located within or outside the device and may execute at least a portion of the software or firmware application.As another example, a component may be a device that provides a particular functionality through electronic components that do not include mechanical parts, and those electronic components may include a processor or other means for executing software or firmware that provides at least part of the functionality of the electronic component. In one aspect, a component may emulate an electronic component through a virtual machine, for example, in a cloud computing system.

[0125] Furthermore, the term "or" is intended to mean an inclusive "or" rather than an exclusive "or". That is, unless otherwise stated or clear from the context, "X uses A or B" is intended to mean any of the natural inclusive permutations. That is, if X uses A, if X uses B, or if X uses both A and B, "X uses A or B" is satisfied under any of the above cases. Furthermore, unless otherwise stated or clear from the context to indicate the singular form, the articles "a" and "an" used in this specification and the accompanying drawings should generally be construed to mean "one or more". As used herein, the terms "example" and / or "exemplary" are utilized to mean serving as an example, instance, or illustration. For the avoidance of doubt, the subject matter disclosed herein is not limited by such examples. Moreover, any aspect or design described herein as "example" and / or "exemplary" is not necessarily to be construed as preferred or advantageous over other aspects or designs, or to be meant to exclude equivalent exemplary structures and techniques known to those skilled in the art.

[0126] As used herein, the term "processor" may refer to virtually any computing processing unit or device, including, but not limited to, a single-core processor, a single-core processor with software multithreaded execution capabilities, a multi-core processor, a multi-core processor with software multithreaded execution capabilities, a multi-core processor with hardware multithreading techniques, a parallel platform, and a parallel platform with distributed shared memory. Additionally, a processor may refer to an integrated circuit designed to perform the functions described herein, an application specific integrated circuit (ASIC), a digital signal processor (DSP), a field programmable gate array (FPGA), a programmable logic controller (PLC), a complex programmable logic device (CPLD), discrete gate or transistor logic, discrete hardware components, or any combination thereof. Additionally, a processor may utilize nanoscale architectures, such as, but not limited to, molecular-based and quantum dot-based transistors, switches, and gates, to optimize space usage or enhance the performance of a user device. A processor may also be implemented as a combination of computing processing units. In this disclosure, terms such as "store," "storage," "data store," "data storage," "database," and substantially any other information storage component associated with the operation and functionality of the component are utilized to refer to a "memory component" that is an entity embodied as a "memory" or a component that includes memory. It should be appreciated that the memory and / or memory components described herein can be volatile or non-volatile memory, or can include both volatile and non-volatile memory.By way of example, non-volatile memory may include, but is not limited to, read only memory (ROM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, or non-volatile random access memory (RAM) (e.g., ferroelectric RAM (FeRAM)). Volatile memory may include RAM, which may function, for example, as external cache memory. By way of example, and not limitation, static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), SyncLink DRAM (SLDRAM), direct Rambus RAM (DRRAM), direct Rambus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM). Additionally, the disclosed memory components of the systems or computer-implemented methods herein are intended to include, but are not limited to, these and other suitable types of memory.

[0127] What has been described above includes merely examples of systems and computer-implemented methods. Of course, it is not possible to describe every conceivable combination of components or computer-implemented methods in order to describe the present disclosure, but one of ordinary skill in the art can appreciate that many other combinations and permutations of the present disclosure are possible. Furthermore, to the extent that the terms "includes," "has," "possesses," and the like are used in the detailed description, claims, appendices, and drawings, such terms are intended to be inclusive in the same manner as the term "comprising" is interpreted when used as a transitional word in the claims.

[0128] The above description of various embodiments is provided for illustrative purposes, and is not intended to be exhaustive or to be limited to only the disclosed embodiments. Many modifications and variations that do not depart from the scope of the described embodiments will be apparent to those skilled in the art. The terms used in this specification have been selected to best explain the principles of the embodiments, practical applications, or technical improvements over commercially available technology, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. 1. A system comprising: A processor that executes computer-executable components stored in memory the computer executable components comprising: a baseline component that generates a baseline health check risk score that corresponds to non-compliance of computing assets with regulatory controls; an adjustment component that adjusts the baseline Health Check risk score based on weakness factors of the prescribed controls, the vulnerability factor is based on the extent to which the state of the computing asset deviates from the prescribed control; adjusting the baseline health check risk score based on environmental factors of the computing asset, the environmental factors being based on a security mechanism or security protocol associated with the computing asset; adjusting the baseline health check risk score based on a criticality factor of the computing asset, the criticality factor being based on a level of importance associated with the computing asset; The adjustment component further adjusts the baseline health check risk score based on a maturity factor of the computing asset, the maturity factor being based on a difference between the prescribed controls and the recommended controls; the adjustment component multiplying the baseline healthcheck risk score by the environmental factor, thereby obtaining a first amount; adding the weakness factor to the first amount, thereby obtaining a second amount; multiplying the criticality factor by the second amount, thereby obtaining a third amount; and multiplying the maturity factor by the third amount, thereby obtaining an adjusted healthcheck risk score corresponding to non-compliance of the computing asset with the regulatory control; Including, the system.

2. A weakness component that uses a machine learning model to generate the weakness factors. The system of claim 1 further comprising:

3. an aggregation component that aggregates the adjusted health-check risk score with a plurality of other adjusted health-check risk scores by applying a weighted average or maximum function to the adjusted health-check risk score and a plurality of other adjusted health-check risk scores corresponding to a plurality of other regulatory controls. The system of claim 1 further comprising:

4. 1. A computer-implemented method, comprising: generating, by a device operatively coupled to the processor, a baseline health check risk score corresponding to non-compliance of the computing assets with regulatory controls; adjusting, by the device, the baseline Health Check risk score based on weakness factors of the prescribed controls; the vulnerability factor is based on the extent to which the state of the computing asset deviates from the prescribed control; adjusting the baseline health check risk score based on environmental factors of the computing asset, the environmental factors being based on a security mechanism or security protocol associated with the computing asset; adjusting the baseline health check risk score based on a criticality factor of the computing asset, the criticality factor being based on a level of importance associated with the computing asset; adjusting the baseline health check risk score based on a maturity factor of the computing asset, the maturity factor being based on a difference between the prescribed controls and the recommended controls; said adjusting including multiplying said baseline healthcheck risk score by said environmental factor, thereby obtaining a first amount; adding said weakness factor to said first amount, thereby obtaining a second amount; multiplying said criticality factor by said second amount, thereby obtaining a third amount; and multiplying said maturity factor by said third amount, thereby obtaining an adjusted healthcheck risk score corresponding to non-compliance of said computing asset with said regulatory control.

23. A computer-implemented method comprising:

5. generating, by the device, at least one of the weakness factor, the environmental factor, the criticality factor, or the maturity factor using a machine learning model; The computer-implemented method of claim 4 , further comprising:

6. aggregating, by the device, the adjusted health-check risk score with the other adjusted health-check risk scores corresponding to other regulatory controls by applying a weighted average or maximum function to the adjusted health-check risk score and the other adjusted health-check risk scores corresponding to other regulatory controls. The computer-implemented method of claim 4 , further comprising:

7. A computer program causing a computer to execute the method according to any one of claims 4 to 6.

8. A computer readable storage medium having the computer program according to claim 7 recorded thereon.

Images