Targeted Security Implementation Through Security Loss Forecasting

Abstract

A method of selecting security actions is provided. The method comprises estimating a maximum forecast loss, identifying general, sector specific, and targeted threats. The method further comprises forecasting a security loss based on the estimated maximum forecast loss and the threats, estimating a reduction in the security loss based on a first investment on a general threat countermeasure, on a second investment on a sector specific countermeasure, and on a third investment on a targeted threat countermeasure. The method further comprises allocating at least a portion of a security investment budget among the first, the second, and the third investments to maximize the estimated reduction in security loss. An aspect disclosed comprises a method that determines rates of return on security investment and selects security investments based on the rates of return. An aspect disclosed comprises a system for forecasting a security loss based on a security investment.

1 . A method of selecting security investments, comprising:
 estimating a maximum forecast loss based on a valuation of an organization;   identifying a plurality of threats that threaten the organization, wherein each of the threats is associated with one of a plurality of threat zones;   determining a forecast loss versus security investment function based at least in part on the estimated maximum forecast loss and on the threats;   determining an operating point of the organization on the forecast loss versus security investment function based on a security investment by the organization;   determining a rate of return for incremental security investment based on the forecast loss versus security investment function and based on the operating point of the organization versus the forecast loss versus security investment function; and   adjusting the security investment based on the determined rate of return.   
     
     
         2 . The method of  claim 1 , wherein determining the forecast loss versus security investment function is further based on a current global electronic crime index. 
     
     
         3 . The method of  claim 2 , wherein determining the forecast loss versus security investment function is further based on at least one current regional electronic crime index. 
     
     
         4 . The method of  claim 1 , further comprising determining a forecast residual loss versus security investment function based at least in part on the estimated maximum loss, based on the threats, and based on mitigating one or more threats. 
     
     
         5 . The method of  claim 4 , wherein the threat zones comprise a general threat zone, a sector specific threat zone, and a targeted threat zone and where the forecast residual loss versus security investment function is based on at least one of mitigating a general threat, mitigating a sector specific threat, and mitigating a targeted threat. 
     
     
         6 . The method of  claim 5 , further comprising presenting a first graph of the forecast loss versus security investment function on a display screen and presenting a second graph of the forecast residual loss versus security investment function on the display screen. 
     
     
         7 . A system for forecasting a security loss, comprising:
 a computer system;   a memory coupled to the computer system; and   an application stored in the memory that, when executed by the computer system,
 determines a maximum forecast loss based on a valuation of an organization, 
 analyzes a plurality of threats associated with the organization, wherein each of the threats is associated with one of a plurality of threat zones, wherein the threat zones comprise a general threat zone, a sector specific threat zone, and a targeted threat zone, 
 determines a relative magnitude of threats distributed among the threat zones based on the analysis of the threats, 
 identifies deployed threat countermeasures, 
 determines a forecast loss versus security investment curve based at least in part on the deployed threat countermeasures, on the analysis of the threats, and on the maximum forecast loss, 
 presents the forecast loss versus security investment curve on a display, 
 presents a representation of the relative magnitude of threats distributed among the threat zones on the display, 
   whereby a rate of return for a security investment is visualized.   
     
     
         8 . The system of  claim 7 , wherein the application associates each of the deployed threat countermeasures with one of the general threat zone, the sector specific threat zone, and the targeted threat zone, wherein the determination of the forecast loss versus security investment curve is further based on a first countermeasure score for deployed threat countermeasures directed to threats associated with the general threat zone, based on a second countermeasures score for deployed threat countermeasures directed to threats associated with the sector specific threat zone, and based on a third countermeasure score for deployed countermeasures directed to threats associated with the targeted threat zone. 
     
     
         9 . The system of  claim 8 , wherein the application determines an operating point of the organization on the forecast loss versus security investment curve based on a security investment, determines a rate of return associated with an incremental security investment based on the operating point of the organization on the forecast loss versus security investment curve, and presents the rate of return on the display. 
     
     
         10 . The system of  claim 8 , wherein the application determines an operating point of the organization on the forecast loss versus security investment curve based on a security investment, determines a targeted threat countermeasure rate of return associated with investment in a threat countermeasure directed to a threat associated with the targeted threat zone based on the operating point of the organization on the forecast loss versus security investment curve, and presents the targeted threat countermeasure rate of return on the display. 
     
     
         11 . The system of  claim 8 , wherein the application determines an operating point of the organization on the forecast loss versus security investment curve based on a security investment, determines a sector specific threat countermeasure rate of return associated with investment in a threat countermeasure directed to a threat associated with the sector specific threat zone based on the operating point of the organization on the forecast loss versus security investment curve, and presents the sector specific threat countermeasure rate of return on the display. 
     
     
         12 . The system of  claim 8 , wherein the application determines an operating point of the organization on the forecast loss versus security investment curve based on a security investment, determines a general threat countermeasure rate of return associated with investment in a threat countermeasure directed to a threat associated with the general threat zone based on the operating point of the organization on the forecast loss versus security investment curve, and presents the general threat countermeasure rate of return on the display. 
     
     
         13 . The system of  claim 8 , wherein the threats in the targeted threat zone comprise affiliate schemes, money laundering mule networks, counterfeiting of luxury goods, mass market malware, and escrow fraud. 
     
     
         14 . The system of  claim 8 , wherein the threats in the sector specific threat zone comprise utilization of proxy botnet infrastructure to defeat anti-fraud countermeasures, adversary testing and discussion of anti-fraud countermeasures, single issue distributed denial of service attacks, and commercialization of a regional electronic crime marketplace. 
     
     
         15 . The system of  claim 8 , wherein the targeted threat zone is associated with electronic attacks directed specifically at the organization and wherein the sector specific threat zone is associated with electronic attacks directed to an industry sector in which the organization is active. 
     
     
         16 . The system of  claim 8 , wherein the analysis of the threats comprises a determination of threat scores for the threats, wherein a threat score for a corresponding threat is determined based, at least in part, on whether the corresponding threat is associated with the general threat zone, the sector specific threat zone, or the targeted threat zone, and wherein threat scores for threats associated with the general threat zone, threat scores for threats associated with the sector specific threat zone, and threat scores for threats associated with targeted threat zone are each weighted differently. 
     
     
         17 . The method of  claim 5 , wherein some of the threats are general threats and are associated with the general threat zone when the some of the threats are deemed to be directed at all users of technology. 
     
     
         18 . The method of  claim 5 , wherein some of the threats are sector specific threats and are associated with the sector specific threat zone when the some of the threats are deemed to be directed to an industry sector in which the organization is active. 
     
     
         19 . The method of  claim 5 , wherein some of the threats are targeted threats and are associated with the targeted threat zone when the some of the threats are deemed to be directed specifically to the organization. 
     
     
         20 . The method of  claim 5 , wherein determining the forecast lost versus security investment function is based further on threat scores associated with the threats, wherein a threat score for a corresponding threat is determined based, at least in part, on whether the corresponding threat is associated with the general threat zone, the sector specific threat zone, or the targeted threat zone, and wherein threat scores for threats associated with the general threat zone, threat scores for threats associated with the sector specific threat zone, and threat scores for threats associated with targeted threat zone are each weighted differently.