SBIR Phase II: Information Security Risk Rating

这个小型企业创新研究(SBIR)第二阶段项目建立在开发信息安全评级服务的早期工作的基础上。当企业将他们的网络与合作伙伴连接起来或与他们共享数据时，他们往往对自己承担的潜在风险知之甚少。出于各种运营原因，企业有第三方关系，这些合作关系几乎总是涉及共享敏感和机密数据。共享的数据可以是客户信息、知识产权、社保号等。企业担心由于合作伙伴网络的入侵而丢失数据，因为他们面临着财务、法律和监管方面的后果。现有的风险管理技术基于年度审计，仅提供合作伙伴安全状况的快照。然而，每天都会发现新的漏洞，行业需要一种解决方案，使企业能够持续监控所有合作伙伴不断变化的风险状况，并主动管理假定的风险。第二阶段的研究目标是建立一个可扩展的全自动评级系统。研究将集中在识别和纳入新的数据源，改进评级模型的统计特性，并使评级对未来行为进行预测。从历史上看，信用评分一直是一种“节省成本和时间的技术”，通过降低成本、预测未来业绩、改善信贷可获得性和可负担性，为贷款人和借款人提供了巨大的价值。与信用评分不同，没有行业标准的评分服务来根据企业的信息安全风险对其进行评级。有了SAPERIX的评级服务，企业和政府将有潜力从信用评分服务中获得与贷款人相同的时间和成本节约。如果研究成功，Sperix的解决方案将为改善安全结果提供市场激励，这将是企业看待安全投资方式的重大变化。

This Small Business Innovation Research (SBIR) Phase II project builds upon earlier work to develop an information security ratings service. When businesses connect their networks with partners or share data with them, they are often poorly informed about the potential risks they assume. Businesses have 3rd party relationships for a variety of operational reasons and these partnerships almost always involve sharing sensitive and confidential data. Data shared can be customer information, intellectual property, social security numbers etc. Businesses are worried about losing data through breaches in partner networks as they face the consequences - financial, legal, and regulatory. Existing risk management techniques are based on annual audits and only provide a snapshot of a partner's security posture. However, new vulnerabilities are discovered everyday and the industry needs a solution that enables a business to continuously monitor changing risk posture of all its partners and proactively manage assumed risks. The Phase II research objective is to build a scalable fully-automated ratings system. The research will focus on identifying and incorporating new data sources, improving the statistical properties of the ratings model, and making the ratings predictive of future behavior. Historically, credit scoring has been a "cost and time-saving technology" that has provided tremendous value to lenders and borrowers alike by reducing costs, predicting future performance, and improving credit accessibility and affordability. Unlike credit scoring, no industry standard scoring service exists to rate business with respect to their information security risk. With Saperix's ratings service, businesses and government will have the potential to reap the same time and cost savings that lenders do from credit scoring services. If the research is successful, Saperix's solution would provide market incentives for improving security outcomes, which would be a significant change in how security investments are viewed by businesses.