BACKGROUND OF THE INVENTION

Technical Field

This invention relates generally to the field of computer-related methodologies for handling complex risk and security challenges of systems of an enterprise. More specifically, this invention relates to systems, structures, and processes for interconnected devices and risk management.

Description of the Related Art

Insider threat is always present and manifests itself in many ways. A malicious insider has the potential to cause more damage to an organization and has many advantages over an outside attacker. For example, they have legitimate and often privileged access to facilities and information, have knowledge of the organization and its processes, and know the location of critical or valuable assets. Insiders may know how, when, and where to attack and how to cover their tracks. For instance, an individual who was given two weeks' notice before being terminated and who is disgruntled can access a facility during off hours. Today, a disgruntled employee, i.e. an insider threat, can wreak havoc on IT systems, financial system, physical facilities, etc., because not all insider threats are monitored correctly, if at all.

In the past few years a new paradigm has emerged referred to as the Internet Of Things (“IOT”). IOT has received massive attention and adoption. IOT is combination of the interconnection of devices and sensors, etc. (things) and their data exchange (referred to as machine to machine (M2M)). M2M also includes but is not limited to remote control capability. An IOT environment enables devices to become smart. Usage of IOT is in many different industries such as energy and utility, healthcare, manufacturing, smart cities, wearable, and automotive to name a few. As per some estimates, by 2020 there will be 20 to 30 billion interconnected devices.

SUMMARY OF THE INVENTION

Techniques are provided that produce a risk profile consisting of a risk score and trends of risk scores across devices and sensors in a machine-to-machine (M2M) or Internet of things (IOT) environment. For example, a device is assigned a risk score which is based on baseline factors such as expected network packets between two devices, normal network packets, access to critical devices, authorized access requests from one device to another device, normal communications to a device, and the critical ports of a device; access to and conflicts across physical, logical, and operational systems; historical and current usage of these systems, and anomalies from normal behavior patterns. Techniques encompass risk management by computing a risk score in a timely fashion in accordance with an architecture that enables achieving the required scaling necessitated by the huge number of devices in the machine-to-machine (M2M) or Internet of things (IOT) environment.

The identity and asset risk scoring framework provides an excellent foundational mechanism for an IOT risk management mechanism. However, because IOT includes machine-to-machine communication between a fairly large number of devices, the data volume requirement is huge and requires a scalable, high throughput and robust mechanism. Thus, in an embodiment additional risk contributing factors for IOT are incorporated into the existing identity and asset risk scoring contributing factors.

