SBIR Phase II: Information Security Risk Rating

这个小型企业创新研究（SBIR）第二阶段项目建立在早期开发信息安全评级服务的工作基础之上。当企业将其网络与合作伙伴连接或与合作伙伴共享数据时，他们通常对所承担的潜在风险知之甚少。由于各种运营原因，企业与第三方建立了关系，这些合作关系几乎总是涉及共享敏感和机密数据。共享的数据可以是客户信息、知识产权、社会保险号码等。企业担心由于合作伙伴网络的漏洞而丢失数据，因为他们面临着财务、法律和监管方面的后果。现有的风险管理技术以年度审计为基础，只能提供合作伙伴安全状况的快照。然而，每天都有新的漏洞被发现，行业需要一种解决方案，使企业能够持续监控所有合作伙伴不断变化的风险状况，并主动管理假定的风险。第二阶段的研究目标是建立一个可扩展的全自动评级系统。研究将集中在识别和整合新的数据源，改进评级模型的统计特性，并使评级预测未来的行为。从历史上看，信用评分一直是一种“节省成本和时间的技术”，通过降低成本、预测未来业绩、提高信贷可及性和可负担性，为贷款人和借款人提供了巨大的价值。与信用评分不同，目前还没有行业标准的评分服务来对企业的信息安全风险进行评级。有了Saperix的评级服务，企业和政府将有可能获得与贷款机构从信用评分服务中获得的同样的时间和成本节省。如果研究成功，Saperix的解决方案将为改善安全结果提供市场激励，这将是企业如何看待安全投资的重大变化。

This Small Business Innovation Research (SBIR) Phase II project builds upon earlier work to develop an information security ratings service. When businesses connect their networks with partners or share data with them, they are often poorly informed about the potential risks they assume. Businesses have 3rd party relationships for a variety of operational reasons and these partnerships almost always involve sharing sensitive and confidential data. Data shared can be customer information, intellectual property, social security numbers etc. Businesses are worried about losing data through breaches in partner networks as they face the consequences - financial, legal, and regulatory. Existing risk management techniques are based on annual audits and only provide a snapshot of a partner's security posture. However, new vulnerabilities are discovered everyday and the industry needs a solution that enables a business to continuously monitor changing risk posture of all its partners and proactively manage assumed risks. The Phase II research objective is to build a scalable fully-automated ratings system. The research will focus on identifying and incorporating new data sources, improving the statistical properties of the ratings model, and making the ratings predictive of future behavior. Historically, credit scoring has been a "cost and time-saving technology" that has provided tremendous value to lenders and borrowers alike by reducing costs, predicting future performance, and improving credit accessibility and affordability. Unlike credit scoring, no industry standard scoring service exists to rate business with respect to their information security risk. With Saperix's ratings service, businesses and government will have the potential to reap the same time and cost savings that lenders do from credit scoring services. If the research is successful, Saperix's solution would provide market incentives for improving security outcomes, which would be a significant change in how security investments are viewed by businesses.