INFORMATION_SECURITY_ASSESSMENT_TRANSLATION_ENGINE

US20210397831A1(19)UnitedStates(12)PatentApplicationPublication(lo)Pub.No.:US2021/0397831AlGreeteretal.(43)Pub.Date:Dec.23,2021(54)INFORMATIONSECURITYASSESSMENT(52)U.S.Cl.TRANSLATIONENGINECPC..........G06K9/00469(2013.01);H04L63/20(2013.01);H04L63/1433(2013.01)(71)Applicant:BankofAmericaCorporation,Charlotte,NC(US)ABSTRACT(72)Inventors:JasonToddGreeter,Charlotte,NC(57)(US);JoseAntonioCovaria,Charlotte,NC(US);AllanWayneAvellanet,Plano,TX(US)Asystemisconfiguredforassessinginformationsecurityin(21)Appl.No.:16/906,381anetwork.Thesystemidentifiesportionsofdocumentsthatcontaininformationthatisresponsivetoquestionsaboutan(22)Filed:Jun.19,2020entity’scompliancewithnetworkuserrequirements.ThesystemthendetermineswhethertheidentifiedinformationPublicationClassificationmeetsnetworkuserrequirements.Thesystemalsocalcu­(51)Int.Cl.latesaconfidenceintervalforitsdeterminations.AreportisG06K9/00(2006.01)generatedtodisplaythesystem’sdeterminationsandtheH04L29/06(2006.01)associatedconfidenceintervalsforthosedeterminations.100SECURITY106FRAMEWORKS108REPORTASSESSMENTS/106AUDITS108noPatentApplicationPnblicationDec.23,2021Sheet3of5US2021/0397831AlFIG.3hdreS216T3J,"S-S'1)Doestheentityrequirespasswordsthatareatleast8=hdcharactersinlengthonuserdevices?S"S's2)Aremobiledevicesencrypted?O3)Doestheentity'snetworkemployfirewalls?4)Doallcomputersontheentity'snetworkemployCZ5anti-virussoftware?CT■UoU1dvyls>ols>oFIG.4<100>PatentApplicationPnblicationDec.23,2021Sheet5of5US2021/0397831Al112500502504506A.A.A.A.REQUIREMENTSUPPORTINGCONFIDENCEQUESTIONMET?DOCUMENTSINTERVAL8-CHARACTERDOCUMENT#1;YES92%PASSWORDpg.90,line6MOBILEDEVICESYESDOCUMENT#2091%ENCRYPTEDNETWORKDOCUMENT#9;NO94%FIREWALLSpg.17,paragraph4ANTIVIRUSDOCUMENT#9;YES81%SOFTWAREpg.21,paragraph2FIG.5US2021/0397831AlDec.23,20211INEORMATIONSECURITYASSESSMENT[0005]Asdiscussedaboveinthebackgroundsection,TRANSLATIONENGINEexistingapproachestoassessingdocumentsbearingonanentity’sinformationsecurityprotocolsallowsnetworkvul­TECHNICALFIELDnerabilitiestogoundetectedforlongerperiodsoftime.Certainembodimentsofthisdisclosureprovideunique[0001]Thisdisclosurerelatesgenerallytoinformationsolutionstotechnicalproblemsoftheexistingapproachestosecurity.Morespecifically,thisdisclosurerelatestoanassessingdocumentsbearingonanentity’sinformationinformationsecurityassessmenttranslationengine.securityprotocolsbyautomaticallycompletinganinforma­tionsecurityquestionnairebasedoninformationextractedBACKGROUNDfromavarietyofnon-standarddocuments.Forexample,thedisclosedsystemprovidestechnicaladvantageswhich[0002]Entitiesreceiveproductsandservicesfromavari­include1)identificationofportionsofdocuments—someetyofvendors.Somevendorshaveaccesstosensitivecomprisingstructureddata,somecomprisingunstructuredinformationandnetworkelementsoftheorganization.Addi­data,andothercomprisingamixofboth—thatarerespon­tionally,certainvendorsaresubjecttovariousgovernmentalsivetoquestionsaboutanentity’sinformationsecurityregulationsand/orindustrystandards.Networksecuritymeasures,2)continuouslyimprovingidentificationofinfor­dependsoneachvendorcomplyingwithvariousinformationmationresponsivetoquestionsaboutanentity’sinformationsecurityprotocols.Theseprotocolsareonlyeffectiveifeachsecuritymeasuresbyuseofmappingtablesthatcanbevendorcomplieswiththem.updatedwhennewdocumenttypesareprocessed,and3)[0003]Verifyingcompliancewithinformationsecurityidentificationofthetypesofsecuritymeasuresthattheentityprotocolsentailsanalyzingdocumentsfromavarietyofshouldperformtoremedyanydeficienciesidentifiedinthesourcesthatareinavarietyofformats.Themixtureofprocesseddocuments.structuredandunstructureddatainthevariousdocuments[0006]Accordingly,thesystemdescribedhereinprovidesmakesitdifficultforcomputeranalysis.Evenwithinthoseapracticalapplicationofdeterminingwhetherthereareanydocumentscomprisedpurelyofstructureddata,differentinformationsecuritygapsinanentity’scurrentprotocolsopticalcharacterrecognitionprogramsmayproducenon-andtoidentifywaystofillthosegaps.This,inturn,reducesuniformresults.Ifdataisinaccuratelyextractedfromdocu­thepotentialweakpointsthatmaliciousactorscanusetoments,thenanydecisionsthatacomputermakesbasedonaccesstheuser’ssensitivedatathroughthirdpartiesthatthatdatamayalsobeincorrect.Thesedrawbacksresultinprovideservicesorproductstotheuser.Moreover,itreduceslimiteddocumentthroughput.Thisinturnslowsthecom­thecomputingresourcesnecessarytodetectandcounteractputer’sabilitytomakedecisions,leavingnetworkvulner­intrusionsonthenetwork.abilitiesundetectedforlongerperiodsoftime.[0007]Certainembodimentsoftheinventionmayincludenone,some,oralloftheabovetechnicaladvantages.OneorSUMMARYOFTHEDISCLOSUREmoreothertechnicaladvantagesmaybereadilyapparenttooneskilledintheartfromthefigures,descriptions,and[0004]Accordingtooneembodiment,asystemforassess­claimsincludedherein.inginformationsecurityinanetworkincludesamemoryandaprocessor.ThememorystoresalistofnetworkuserBRIEFDESCRIPTIONOFTHEDRAWINGSrequirementsthatpartiesmustcomplywithwhentheyusethenetwork.Thememoryalsostoresalistofmetricsthat[0008]Foramorecompleteunderstandingofthisdisclo­satisfyeachofthenetworkuserrequirements.Theprocessorsure,referenceisnowmadetothefollowingbriefdescrip­isgenerallyconfiguredtoanalyzeoneormoredocumentstion,takeninconnectionwiththeaccompanyingdrawingsassociatedwithanetworkuser.Theprocessoridentifiesaanddetaileddescription,whereinlikereferencenumeralsfirstportionofadocumentassociatedwiththenetworkuserrepresentlikeparts.thatcontainsinformationthatisresponsivetoafirstquestion[0009]FIG.1illustratesanexampleinformationsecurityaboutthenetworkuser’scompliancewithafirstnetworkassessmentsystem;userrequirement.Theprocessoralsoidentifiesasecond[0010]FIG.2illustratesthefunctionofatranslationportionofthedocumentthatisresponsivetoasecondengineandareportengineintheexamplesystemdepictedquestionaboutthenetworkuser’scompliancewithasecondinFIG.1;networkuserrequirement.Theprocessorthencomparesthe[0011]FIG.3illustratesoneembodimentofanoperationalinformationinthefirstandsecondportionsofthedocumentflowofthesystemdepictedinFIG.1;withthelistofmetricsthatmeetthenetworkuserrequire­[0012]FIG.4illustratestheuseofmappingtablesinthements.Basedonthiscomparison,theprocessormakesoperationalflowofFIG.3;severaldeterminations.Theprocessormakesafirstdeter­[0013]andminationthattheinformationinthefirstportionofthe[0014]FIG.5illustratesanexamplereportthatisgener­documentmeetsthefirstnetworkuserrequirement.TheatedintheexamplemethodofFIG.3.processoralsomakesaseconddeterminationthattheinfor­mationinthesecondportionofthedocumentdoesnotmeetDETAILEDDESCRIPTIONthesecondnetworkuserrequirement.Theprocessorassignsaconfidenceintervalforthefirstandseconddeterminations.SystemOverviewFinally,theprocessorgeneratesareportthatincludesthefirstandseconddeterminations,theconfidenceintervalsfor[0015]FIG.1illustratesanexampleinformationsecuritythefirstandseconddeterminations,anidentifierofthefirstassessmentsystem100.Inoneembodiment,thesystem100networkuserrequirement,andanidentifierofthesecondcomprisesacomplianceserver102andapluralityofusernetworkuserrequirement.devices104.Thecomplianceserver102isinsignalcom-US2021/0397831AlDec.23,20212municationwiththeuserdevices104throughnetwork106.executesthembydirectingthecoordinatedoperationsoftheComplianceserver102generallyusesknownmatchesALU,registersandothercomponents.Theoneormorebetweenassessmentquestionsandsecurityframeworks108processorsareconfiguredtoimplementvariousinstructions.tocreatemappingtables120whichareusedtrainamachineForexample,theoneormoreprocessorsareconfiguredtolearningalgorithmthatinturnisusedtoanalyzeassessmentexecuteinstructions138and140toimplementtranslationandauditdocuments110.Afterperformingitsanalysis,theengine124andreportengine126,respectively.Inthisway,complianceserver102generatesoneormorereports112.processor116maybeaspecialpurposecomputerdesignedAdditionaldetailsaboutthesecurityframeworks108,toimplementthefunctionsdisclosedherein.Inanembodi­assessmentandauditdocuments110,andreports112arement,thetranslationengine124andreportengine126providedinthediscussionsofFIGS.2-4.operateasdescribedinFIGS.2&4.Forexample,the[0016]Network106maybeanysuitabletypeofwirelesstranslationengine124andreportengine126maybecon­and/orwirednetworkincluding,butnotlimitedto,allorafiguredtoperformthestepsofmethod300asdescribedinportionoftheInternet,anIntranet,aprivatenetwork,aFIG.3.publicnetwork,apeer-to-peernetwork,thepublicswitched[0020]Memory118comprisesoneormoredisks,tapetelephonenetwork,acellularnetwork,alocalareanetworkdrives,orsolid-statedrives,andmaybeusedasanover-flow(LAN),ametropolitanareanetwork(MAN),awideareadatastoragedevice,tostoreprogramswhensuchprogramsnetwork(WAN),andasatellitenetwork.Thenetwork106areselectedforexecution,andtostoreinstructionsanddatamaybeconfiguredtosupportanysuitabletypeofcommu­thatarereadduringprogramexecution.Thememory118nicationprotocolaswouldbeappreciatedbyoneofordinarymaybevolatileornon-volatileandmaycompriseread-onlyskillintheart.memory(ROM),random-accessmemory(RAM),ternary[0017]Userdevices104aredevicescapableofsendingcontent-addressablememory(TCAM),dynamicrandom­datatoandreceivingdatafromcomplianceserver102.Foraccessmemory(DRAM),andstaticrandom-accessmemoryexample,theuserdevices104aand104/?sendsecurity(SRAM).Thememory118isoperabletostoremappingframeworks108andassessmentsandaudits110,respec­tables120,referencedata122,translationengine124,andtively,tothecomplianceserver102,whiletheuserdevicereportengine126.Themappingtables120,referencedata104creceivesoneormorereports112fromthecompliance122,translationengine124,andreportengine126areserver102.Theuserdevices104a-careillustratedasdescribedinmoredetailinFIGS.2-4.desktopcomputersinFIG.1,buttheuserdevices104couldbesmartphones,personaldigitalassistants,tablets,laptops,ReferenceDataoranysimilardevicesuitableforsendingandreceivingdata[0021]Thereferencedata122includesavarietyofinfor­asdescribedinthisdisclosure.mationthatisusedbythetranslationengine124andreport[0018]Complianceserver102comprisesanetworkinter­engine126.Thereferencedata122mayincludeapluralityface114,aprocessor116,andamemory118.Thenetworkofnetworkuserrequirements130.Theuserofsystem100interface114isconfiguredtoenablewiredand/orwirelesscandefineanynumberofnetworkuserrequirements130communications(e.g.,vianetwork106).Thenetworkinter­thatthirdpartiesengagingwiththeuserofsystem100mustface114isconfiguredtocommunicatedatabetweenthecomply.Forexample,thenetworkuserrequirements130complianceserver102andothernetworkdevices(e.g.,usermayincludearequirementthatuserpasswordsbeofadevices104),systems,ordomain(s).Forexample,theminimumlength(e.g.,8characters),allmobiledeviceswithnetworkinterface114maycompriseaWIFIinterface,aaccesstothenetworkmustemployencryptionsoftware,andlocalareanetwork(LAN)interface,awideareanetworkallcomputerswithaccesstothenetworkmustrunanti-virus(WAN)interface,amodem,aswitch,orarouter.Thesoftware.Theseexamplesarenotlimiting,andoneofprocessor116isconfiguredtosendandreceivedatausingordinaryskillintheartwillappreciatethatawidevarietyofthenetworkinterface114.Thenetworkinterface114maybenetworkrequirementsmaybeestablishedtominimizetheconfiguredtouseanysuitabletypeofcommunicationpro­riskofnetworkintrusion.tocolaswouldbeappreciatedbyoneofordinaryskillinthe[0022]Referencedata122mayalsoinclude,foreachart.networkuserrequirement130,apluralityofmetrics132that[0019]Processor116comprisesoneormoreprocessorssatisfythatnetworkuserrequirement130.Forexample,ifoperablycoupledtonetworkinterface144andmemory118.thenetworkuserrequirement130isthatallcomputerswithTheprocessor116isanyelectroniccircuitryincluding,butaccesstothenetworkmustrunanti-virussoftware,thenotlimitedto,statemachines,oneormorecentralprocess­correspondingmetric132mayincludealistofcommoningunit(CPU)chips,logicunits,cores(e.g.amulti-coreanti-virussoftwareprograms.Thatway,compliancewithprocessor),field-programmablegatearray(FPGAs),appli­networkuserrequirement130maybeverifiedbyidentifyingcationspecificintegratedcircuits(ASICs),ordigitalsignaloneoftheanti-virussoftwareprogramslistedinmetrics132processors(DSPs).Theprocessor116maybeaprogram­intheassessmentandauditdocuments110.Asanothermablelogicdevice,amicrocontroller,amicroprocessor,orexample,themetrics132thatcorrespondstothenetworkanysuitablecombinationofthepreceding.Theoneormoreuserrequirement130thatpasswordsbeatleast8charactersprocessorsareconfiguredtoprocessdataandmaybeinlengthmaybethatanypasswordexceeding7charactersimplementedinhardwareorsoftware.Forexample,theinlengthissatisfactory.Theuserofsystem100canmodifyprocessor116maybe8-bit,16-bit,32-bit,64-bitorofanythemetrics132foreachnetworkuserrequirement130soothersuitablearchitecture.Theprocessor116mayincludethattherelevantcriteriaformeasuringcomplianceismoreanarithmeticlogicunit(ALU)forperformingarithmeticorlessstrictbasedontheneedsoftheuser.andlogicoperations,processorregistersthatsupplyoper­[0023]Referencedata122mayfurtherincludepluralityofandstotheALUandstoretheresultsofALUoperations,andpreviousresponses134toquestionnairesaboutthelevelofacontrolunitthatfetchesinstructionsfrommemoryandcompliancewithnetworkuserrequirements130byvariousUS2021/0397831AlDec.23,20213entitiesinteractingwiththeuserofsystem100.Theprevious[0027]Afterreceivingtheassessmentandauditdocu­responses134maybegroupedasresponsesthatwerements110,thetranslationengine124usesthemappingdeterminedtomeetagivennetworkuserrequirement130tables120todeterminewhichinformationinthereceivedandresponsesthatweredeterminednottomeetthatnetworkassessmentandauditdocuments110constituteanswerstouserrequirement130.Thisdatasetmaythenbeusedbyquestionsaboutwhetherentity128iscomplyingwiththereportengine126toassignaconfidenceintervaltoclassi­networkuserrequirementsdeflnedbytheuserofsystemficationsthatitmakesbasedonincomingassessmentand100.auditdocuments110.[0028]Themappingtables120enablethecompliance[0024]Thereferencedata122mayalsoincludealistofserver102toidentifyinformationintheassessmentandconfidencethresholds136againstwhichreportengine126auditdocuments110thatareresponsivetoquestionsaboutmayevaluateitsperformance.Theexamineddocumentsthecomplianceofentity128withnetworkuserrequirementsmayprovideseeminglyconflictinginformation,andthesetbytheuserofsystem100.Aflrstmappingtable120maythresholdinganalysisallowsthedisclosedsystemtodistin­linkquestionsinasecurityframework108tostatutesorguishnoisegeneratedbyinaccurateopticalcharacterrec­otherregulatoryprovisions.Examplesofindustryframe­ognitionfromscenarioswheretheinformationistrulyinworks108includeframework202,NISTCSF/800-53;conflictandinneedoffurtherinvestigation.Forexample,framework204,PCIDSS;framework206,FFIECCAT;andtheuserofsystem100maysettheconfldencethreshold136framework208,ISO27001.Variousotherinformationsecu­at90%.Determinationsbyreportengine126thathavearityframeworksexistandarelikelytobedevelopedintheconfldenceintervalbelow90%maybeflaggedforaddi­future.Oneofordinaryskillwillappreciatethatanysuchtionalreviewandanalysis.Additionaldetailsabouttheroleframeworkmaybeintegratedintothedisclosedsystemsandofreferencedata122andconfldencethresholds136aremethods.providedbelowinthediscussionsofFIGS.2-5.[0029]Anothermappingtable120maylinkthestatutesorotherregulatoryprovisionstoquestionsinanetworkuserTranslationEnginequestionnaire216.Thenetworkuserquestionnaire216includesquestionsposedtodeterminecompliancewith[0025]Thetranslationengine124mayincludeorbenetworkuserrequirements130.Byreviewingthesemap­providedwithsoftwareinstructions138storedonmemorypingtables120,thecomplianceserver102maydetermine118andexecutedbyprocessor116.FIG.2illustratesthewhichportionsofasecurityframework108correspondtoafunctionofthetranslationengine124fromtheexamplegivenportionofthenetworkuserquestionnaire216.Simi­system100depictedinFIG.1.Thetranslationengine124islarly,anothermappingtable120maylinkportionsofconfiguredtoreceiveapluralityofassessmentandauditdifferenttypesofassessmentorauditdocuments110todocuments110.Generally,theassessmentandauditdocu­statutesorregulatoryprovisions.Thisallowscompliancements110provideinformationabouttheinformationsecu­server102todeterminewhichportionsofanassessmentorrityproceduresofanentity128.Theentity128maybeaauditdocument110correspondstoagivenportionofthebusinessthatprovidesproductsorservicestotheuserofnetworkuserquestionnaire216.Stillothermappingtablessystem100.Entity128mayhaveaccesstooneormore120maylinkportionsofdifferenttypesofassessmentsornetworksoftheuserofsystem100.Theentity128mayalsoauditdocuments110toportionsofasecurityframeworkhaveaccesstosensitiveinformationoftheuserofsystem108.100.Theassessmentandauditdocuments110comprisea[0030]Themappingtablesmayalsobeusedtoprocessvarietyofinformationrelevanttotheinformationsecuritynon-standarddocumentsthatcontaininformationaboutanprotocolsofentity128.Forexample,theassessmentandentity’scompliancewithnetworkuserrequirements.Forauditdocuments110mayincludeinformationaboutthesuchunstructureddocuments,thetranslationengine124isphysicalsecuritymeasuresthatentity128takestosecureconflguredtousenaturallanguageprocessingtoidentifydataatitsofficesandonthedevicesofitsemployees.Therelevantkeywordsandphrasesthatmightbearonanentity’sassessmentandauditdocuments110mayalsoincludecompliancewithnetworkuserrequirements.Oneormoreofinformationaboutthedigitalsecuritymeasures,suchasthemappingtables120areconflguredtolinktherelevantsecuritysoftwareusedanduserloginsecurityprotocols,thatwordsandphrasestoindividualsectionsofthenetworkuserentity128takestosecureaccesstodataonitsownnetworks.questionnaire216.Forexample,thetranslationengine124Whiletheinformationsecuritycompliancequestionnairesinmayreceiveanassessmentdocument110thatisunstruc­thisdisclosurearereferredtoasnetworkuserquestion­tured,anditmayidentifytheword“password”somewherenaires,theentity128isnotnecessarilyusingthenetworkofinthedocument.Thetranslationengine124mayfurtherusetheuserofsystem100.Networkusermorebroadlyencom­thecontextofthephrase“password”toextractthelongerpassesanyentitiesthatexchangesdigitalinformationwithphrase“userloginpasswordsoncompanycomputersmusttheuserofsystem100.beatleast6charactersinlengthandcontainatleastone[0026]Theassessmentandauditdocuments110maybespecialcharacter.”Amappingtable126maymapthereceivedinavarietyofformats.Assessmentandauditkeyword“password”toquestiononeofanetworkuserdocuments110maycomprisestructureddata,unstructuredquestionnaire216,thataskstheentity128whetheritdata,semi-structureddata,oranycombinationofsuchdata.requirespasswordsoncompanydevicestobeatleast8Theassessmentandauditdocuments110maybegeneratedcharactersinlength.bytheentity128orathirdpartythatreviewstheinformation[0031]Themappingtables120maybeupdatedasnewsecurityprofileoftheentity128.Forexample,theassess­documenttypesarereceived.Forexample,ifanassessmentmentandauditdocuments110mayincludeanassessmentdocument110isreceivedandisofatypethatthecompli­utilityformatdocument210,aSIGorSIGLitedocumentanceserver102doesnotrecognize,thecomplianceserver212,andaSOC-2document214.102mayidentifyportionsoftheassessmentdocument110US2021/0397831AlDec.23,20214andpredictwhichquestioninthenetworkuserquestionnairedeterminationwouldbegivenalowerconfidenceintervalif216towhichtheinformationisresponsive.Theuseroftheanswerexhibitedgreatersimilaritywiththeprevioussystem100mayreviewthesedeterminationsandeitherresponses134classifiedasnotcomplyingwiththenetworkconfirmtheiraccuracyorcorrectlyclassifytheinformationuserrequirements130thanthepreviousresponses134sothatthecomplianceserver102willcorrectlyrecognizeclassifiedascomplyingwiththenetworkuserrequirementthattypeofdocumentinthefuture.130.Reportengine126thencomparesthecalculatedcon­[0032]Additionaldetailsabouttheoperationoftransla­fidenceintervaltoathreshold136.Theuserofsystem100tionengine124areprovidedinconjunctionwiththedis­mayconfigureadifferentthreshold136foreachquestionincussionofFIGS.3&4.theuserquestionnaire216orconfigureasinglethreshold136toapplytoeveryquestion.QuestionsforwhichtheReportEnginethresholdisnotexceededmaybeflaggedforfurtheranaly­sis.[0033]Thereportengine126mayincludeorbeprovided[0037]Insomeembodiments,thereportengine126iswithsoftwareinstructions140storedonmemory118andconfiguredtod