Method, system, and computer program product for assessing information security

Abstract

Methods and systems to assess information security based on based on a combination of user-responses to computer-selected queries and results of a testing/diagnostic application. Users may be interviewed based on areas of expertise. Information security assessment may be performed with respect to domains of an enterprise, the results of which may be rolled-up to assess information security across the enterprise. A system may include application-specific questions and vulnerabilities, industry specific questions and vulnerabilities, a repository of expert knowledge, and/or working aids. A system may include an inference engine, which may include a logic-based inference engine, a knowledge-based inference engine, and/or an artificial intelligence inference engine. A system may include an application-specific tool to configure the system to assess security of information handled by a third party application program.

1 . A computer-implemented method, comprising:
 selecting information handling questions from a database of information handling questions based on one or more of an entity type and user area of expertise, wherein the information handling questions relate to one or more of information technology (IT) infrastructure and information handling policy;   presenting the selected questions to one or more users;   receiving user responses to the selected questions;   receiving information collected from within the IT infrastructure by a computer program executing within the IT infrastructure;   evaluating the user responses in combination with the information collected from within the IT infrastructure; and   assessing information security based on results of the evaluating.   
     
     
         2 . The method of  claim 1 , wherein the information collected from within the IT infrastructure includes one or more of active network scanning information and passive network monitoring information. 
     
     
         3 . The method of  claim 1 , wherein the information collected from within the IT infrastructure includes one or more of test information and diagnostic information. 
     
     
         4 . The method of  claim 1 , wherein the selecting includes:
 selecting at least one of the questions based on the information collected from within the IT infrastructure.   
     
     
         5 . The method of  claim 1 , wherein the evaluating includes:
 identifying a vulnerability based on a combination of the user responses and the information collected from within the IT infrastructure; and   evaluating the vulnerability based on one or more of the user responses and the information collected from within the IT infrastructure.   
     
     
         6 . The method of  claim 1 , wherein the evaluating includes:
 identifying a vulnerability based on one or more of the user responses and the information collected from within the IT infrastructure; and   evaluating the vulnerability based on a combination of the user responses and the information collected from within the IT infrastructure.   
     
     
         7 . The method of  claim 1 , wherein the evaluating includes:
 evaluating the results of the computer program executed within the IT infrastructure in combination with the user responses, and independent of the user responses.   
     
     
         8 . A system, comprising:
 a database of information handling questions, wherein the questions relate to one or more of information technology (IT) infrastructure and information handling policy;   a user-interview system to select information handling questions from the database based on one or more of an entity type and an area of user expertise, present the selected questions to one or more users, and receive user responses to the selected questions;   an evaluation system to receive information collected from within the IT infrastructure by a computer program executing within the IT infrastructure, evaluate the user responses in combination with the information collected from within the IT infrastructure, and assess information security based on results of the evaluating.   
     
     
         9 . The system of  claim 8 , wherein the information collected from within the IT infrastructure includes one or more of active network scanning information and passive network monitoring information. 
     
     
         10 . The system of  claim 8 , wherein the information collected from within the IT infrastructure includes one or more of test information and diagnostic information. 
     
     
         11 . The system of  claim 8 , wherein the user interview system is implemented to:
 select at least one of the questions based on the information collected from within the IT infrastructure.   
     
     
         12 . The system of  claim 8 , wherein the evaluation system is implemented to:
 identify a vulnerability based on a combination of the user responses and the information collected from within the IT infrastructure; and   evaluate the vulnerability based on one or more of the user responses and the information collected from within the IT infrastructure.   
     
     
         13 . The system of  claim 8 , wherein the evaluation system is implemented to:
 identify a vulnerability based on one or more of the user responses and the information collected from within the IT infrastructure; and   evaluate the vulnerability based on a combination of the user responses and the information collected from within the IT infrastructure.   
     
     
         14 . The system of  claim 8 , wherein the evaluation system is implemented to:
 evaluate the results of the computer program executed within the IT infrastructure in combination with the user responses, and independent of the user responses.   
     
     
         15 . A non-transitory computer readable medium encoded with a computer program, including instructions to cause a processor to:
 select information handling questions from a database of information handling questions based on one or more of an entity type and user area of expertise, wherein the information handling questions relate to one or more of information technology (IT) infrastructure and information handling policy;   present the selected questions to one or more users;   receive user responses to the selected questions;   receive information collected from within the IT infrastructure by a computer program executing within the IT infrastructure;   evaluate the user responses in combination with the information collected from within the IT infrastructure; and   assess information security based on results of the evaluating.   
     
     
         16 . The computer readable medium of  claim 15 , wherein the information collected from within the IT infrastructure includes one or more of active network scanning information and passive network monitoring information. 
     
     
         17 . The computer readable medium of  claim 15 , wherein the information collected from within the IT infrastructure includes one or more of test information and diagnostic information. 
     
     
         18 . The computer readable medium of  claim 15 , wherein the instructions to select questions include instructions to cause the processor to:
 select at least one of the questions based on the information collected from within the IT infrastructure.   
     
     
         19 . The computer readable medium of  claim 15 , the instructions to evaluate include instructions to cause the processor to:
 identify a vulnerability based on a combination of the user responses and the information collected from within the IT infrastructure; and   evaluate the vulnerability based on one or more of the user responses and the information collected from within the IT infrastructure.   
     
     
         20 . The computer readable medium of  claim 15 , the instructions to evaluate include instructions to cause the processor to:
 identify a vulnerability based on one or more of the user responses and the information collected from within the IT infrastructure; and   evaluate the vulnerability based on a combination of the user responses and the information collected from within the IT infrastructure.