SBIR Phase I: Enterprise Cyber Security Scoring

这个小型企业创新研究(SBIR)第一阶段项目解决了从事网络相关业务关系的企业之间的风险管理挑战。当企业建立网络或其他与网络相关的连接时，他们有时对自己承担的潜在风险知之甚少。企业通常依赖成本高昂且耗时的网络安全审计来告知他们这种关系的潜在网络风险和随之而来的商业风险。目前存在的解决方案效率低下，尚未恰当地满足该行业的需求，即需要一种可靠且廉价的手段来评估通过特定业务关系产生的网络安全风险。CyberAnalytix的目标是产生一个网络安全得分。企业将使用网络安全得分为与网络相关的业务决策提供信息，例如外包、供应商IT关系和合规性。第一阶段的研究目标是开发一种可信的、可预测的、可扩展的、主要是可自动化的评分方法。CyberAnalytix预计将开发评分方法，并在一小部分业务实体上测试该方法，以评估该方法和结果评分是否符合规定的客观特征。从历史上看，信用评分一直是一种节省成本和时间的技术，通过帮助降低成本、预测未来贷款业绩以及改善信贷可获得性和可负担性，为贷款人和借款人提供了巨大的价值。与信用评分不同，没有行业标准的评分服务来根据企业的网络安全风险对其进行评级。现在有机会解决一个成本高昂、效率低下的行业痛点，并产生广泛的经济影响。随着更多的服务被网络启用、外包或通过网络“云”访问，对经济高效、高质量和可靠的企业网络安全评分的需求将继续增加。如果这一努力取得成功，企业将从信用局的信用评分服务中获得与贷款人相同的时间和成本节约。评分方法将使企业能够就网络安全和更广泛的商业背景下的商业风险做出更好、更知情的、以数据为导向的决策。

This Small Business Innovation Research (SBIR) Phase I project addresses the challenges of risk management between businesses engaged in cyber-related business relationships. When businesses establish network or other cyber-related connections, they are sometimes poorly informed about the potential risk that they assume. Businesses typically rely on costly and time consuming cyber security audits to inform them about the potential cyber and ensuing business risk of the relationship. The solutions that exist today are inefficient and have yet to properly address the industry's need for a reliable and inexpensive means of assessing the cyber security risk incurred through a particular business relationship. CyberAnalytix's objective is to produce a cyber security score. Businesses would use the cyber security score to inform cyber related business decisions such as outsourcing, vendor IT relationships, and compliance. The Phase I research objective is to develop a scoring methodology that is credible, predictive, scalable and principally automatable. CyberAnalytix anticipates developing the scoring methodology as well as testing the methodology on a small set of business entities to evaluate whether the methodology and resulting score meet the prescribed objective characteristics.Historically credit scoring has been a cost- and time-saving technology that has provided tremendous value to lenders and borrowers alike by helping to reduce cost, predict future loan performance, and to improve credit accessibility and affordability. Unlike credit scoring, no industry standard scoring service exists to rate business with respect to their cyber security risk. There is an opportunity to address a costly and inefficient industry pain point and have a broad economic impact. The need for cost effective, high-quality, and reliable business cyber security scoring will continue to increase as more services are network enabled, outsourced, or accessed through the network "cloud." If this effort were to succeed, businesses would reap the same time and cost savings that lenders do from credit scoring services from credit bureaus. The scoring methodology will enable businesses to make better, more informed, data-driven decisions about business risk in the cyber security and broader business context.