Security Risk Scoring from License and Configuration Status
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional deception technology solutions require on-premises appliances, which do not scale and necessitate infrastructure in the customer network, and security teams struggle to separate signal from noise in detecting advanced cyber threats.
Innovation Solution
Integration of deception technology with a cloud-based security system that deploys breadcrumbs/honeypots without on-premises appliances, enabling dynamic risk scoring based on user type and logging only malicious activity, along with assessing license and configuration status to calculate a security risk score.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional deception technology with on-premises appliances is used, then threat detection capability is provided, but scalability is limited and infrastructure complexity increases
Solution Approach 1:
The patent extracts the deception technology from on-premises appliances and relocates it to a cloud-based platform. The system removes the need for customer on-premises infrastructure by implementing deception technology as a cloud service that can be accessed remotely, thereby eliminating scalability limitations and reducing infrastructure complexity while maintaining threat detection capability.
Solution Approach 2:
The patent introduces a cloud-based intermediary platform that mediates between the deception technology and the customer network. This intermediary enables threat detection without requiring direct on-premises deployment, allowing the system to scale dynamically and reducing the burden of maintaining physical infrastructure while providing continuous security monitoring.
2Reliability
If conventional deception technology with on-premises appliances is used, then threat detection capability is provided, but infrastructure complexity and deployment time increase
Solution Approach 1:
The patent extracts the infrastructure complexity from the customer environment by implementing deception technology as a cloud-based service. All infrastructure management, appliance deployment, and system maintenance are handled by the cloud provider, eliminating the need for customers to maintain on-premises hardware while preserving full threat detection functionality.
Solution Approach 2:
The patent implements self-service capabilities where the cloud-based system automatically handles infrastructure provisioning, configuration, and management. The system self-deploys deception technology components, self-configures security policies, and self-maintains without requiring manual on-premises intervention, thereby reducing infrastructure complexity and deployment time.
3Difficulty of detecting and measuring
If all network activity is monitored to detect threats, then detection coverage is maximized, but signal-to-noise ratio deteriorates
Solution Approach 1:
The patent applies local quality by deploying deception technology specifically at critical network locations where threats are most likely to manifest. Instead of uniformly monitoring all network traffic, the system places targeted deception elements (honeypots, decoys) at strategic points to detect specific threat behaviors, thereby maintaining high detection coverage for relevant threats while filtering out irrelevant noise.
Solution Approach 2:
The patent converts the potentially harmful effect of deploying deception technology into a beneficial detection mechanism. By placing decoys and honeypots in the network, the system creates artificial targets that attract attacker attention, allowing detection of malicious activity through the very interactions that would otherwise be noise. This transforms what could be considered false alerts into valuable threat intelligence.
Data Source
AI summary
Systems and methods are provided for calculating a security risk score. In one implementation, a method includes the step of analyzing a network to assess a license status of the network, where the license status is related to one or more security licenses procured for providing security protection to the network. The method also includes the step of analyzing the network to assess a configuration status of the network, where the configuration status is related to configurations settings of one or more security policies currently operating with respect to the network. Based on the assessed license status and configuration status, the method further includes the step of calculating a security risk score indicating a current level of risk that the network faces against threats, intrusions, cyber-attacks, breaches, and/or data loss.


