DETAILED ACTION
The objection to the specification is withdrawn based on corrections filed 06/24/2026.
The objection to the claim is withdrawn based on amendments filed 06/24/2026.
Some of the 112(b) rejections have been withdrawn based on amendments filed 06/24/2026.
Claims 1-20 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed 06/24/2026 have been fully considered.
Regarding Applicant’s argument that
Martinez fails to disclose a predetermined metric for determining non-compliant finding that is defined based on a taxonomy branch classification of a risk factor.
Martinez fails to disclose managing cyber security risk for a client entity communicating with a plurality of target entities as recited in amended Claim 1, this argument is moot in view of new grounds of rejection.
Martinez fails to disclose monitoring data sources comprising information related to cyber security risks posed to a client entity by the cyber assets of target entities.
Martinez fails to disclose issuing a finding that includes an identification of a target entity associated with the finding.
These arguments are moot in view of new grounds of rejection, necessitated by amendments.
Regarding Applicant’s argument that the rejection of Claim 4-6 and 12-15 should be withdrawn because the amended independent claim is not taught by the prior art of record, this argument is moot because the independent claim is rejected in view of new grounds of rejection, necessitated by amendments.
Allowable Subject Matter
Claim 3 is objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims. Claims 4-6, by virtue of dependence, are also objected.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Regarding claims 1 and 16, the claim recites “correlation between the information and one of the cyber asset footprints of the target entities”. It is unclear if the information is referring to “data sources comprising information” or “relevant observation comprises information”. For the purpose of examination, “the information” will be interpreted as information from a plurality of data sources. Claims 2-15 and 17-20 inherit this rejection.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim(s) 1, 2, 7-11, and 16-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Martinez et al. (US Pat. Pub. No. 20140137257), in view of Bolukbas et al. (US Pat. No. 10,949,543), and in further view of Vashistha et al. (US Pat. Pub. No. 20200265357)
Regarding claim 1, Martinez teaches a method for managing cyber security risk for a client entity communicating with a plurality of target entities, the method comprising: identifying a plurality of cyber asset footprints [corresponding to the target entities, wherein the client entity and each of the target entities are different organizations each associated with a collection of cyber assets] (Martinez [0061], e.g., Step 1 (302): The first step in system characterization 102 is to gather data from the customer…… Data for the IT control plane and OT infrastructure will be required to begin the system characterization of the energy grid; [0067], e.g., Identifying the assets for the OT control systems requires the identification of the type of communication and control system in place. These systems might be either or a combination of the following communication and control systems. Industrial Control Systems (ICS)…… Supervisory Control and Data Acquisition (SCADA) Systems…… Communications media that might be used for SCADA communications includes advanced radio data information services (ARDIS), cellular telephone data services, digital microwave, fiber optics, multiple address radio (MAS); Note the footprints are the individual systems in the OT system), wherein each cyber asset footprint comprises cyber assets associated with a different one of the target entities (Martinez [0067], e.g., Identifying the assets for the OT control systems requires the identification of the type of communication and control system in place…… These systems might be either or a combination of the following communication and control systems. Industrial Control Systems (ICS)…… Supervisory Control and Data Acquisition (SCADA) Systems…… Communications media that might be used for SCADA communications; [0081], e.g., The assets are categorized into physical assets or cyber-physical assets. Physical assets are any asset that those not have a IP address and/or support any type of communications for operation, control, monitoring, alerting, data acquisition, etc. Cyber-Physical assets are any physical asset that supports functions such as operation, control, monitoring, alerting, data acquisition, etc. Examples of these are EMS, HMI, RTUs, PLCs, and PMUs, etc.; Note each system (entity) has assets that supports functions such as operation, control, monitoring, alerting, data acquisition); monitoring a plurality of data sources comprising cyber risk information [related to cyber security risks posed to the client entity by the cyber assets of the target entities] to generate source data (Martinez [0097], e.g., Potential threat-sources are identified in block 604 using a potential threat-source list 606. The threat-source source is characterized in block 608), wherein the source data is organized based on a plurality of risk factors (Martinez [0096], e.g., Threat-sources generally include: (i) hostile cyber/physical attacks; (ii) human errors of omission or commission; or (iii) natural and man-made disasters), and wherein the risk factors (Martinez [0096], e.g., cyber and physical threats) are classified according to taxonomy branches (Martinez [0096], e.g., When identifying both cyber and physical threats for the critical asset, there are four categories to take into consideration; people, processes, physical environment and technology; [0110], e.g., a vulnerability class is used to categorize weaknesses which could adversely impact the operational technology of an energy system…… Below are the five specific areas which can make an energy system vulnerable) comprising: information technology (IT) hygiene (Martinez [0096], e.g.,(1) policy and procedure…… (5) network vulnerabilities; [0111], e.g., Policies and procedures are known to be documented methods on how the infrastructure operates. Vulnerabilities can include insufficient procedures on validation and background checks, inadequate security policies, privacy policies, patch management processes, and change and configuration management to the system; Also see [0115]); vulnerabilities (Martinez [0110], e.g., (3) platform software/firmware vulnerabilities; [0113], e.g., Software and firmware development include vulnerabilities in code quality, authentication, cryptography, general logic errors); threat activity (Martinez [0110], e.g., people; [0112], e.g., In regards to people, they are to be the ones trained to follow the policy and procedures developed for the electrical power grid. This category covers vulnerabilities on personnel security awareness training associated with implementing, maintaining and operating systems); and malicious activity (Martinez [0096], e.g., (4) platform vulnerabilities; [0114], e.g., Platform vulnerabilities regard software or hardware units that are compromised in areas of security architecture and design, inadequate malware protection from software attacks and software vulnerabilities. These vulnerabilities include categories of designs, implementation, and operational and poorly configured security equipment); identifying relevant observations in the source data (Martinez [0097], e.g., Potential threat-sources are identified in block 604 using a potential threat-source list 606), wherein each relevant observation comprises information related to a risk factor of the plurality of risk factors (Martinez [0097], e.g., The threat-source source is characterized in block 608), and is identified based on a correlation between the information and one of the cyber asset footprints [of the target entities] (Martinez [0097], e.g., An asset and threat-source pair are selected and added to the threat/asset list in block 610. If there are other threat-sources, as determined in decision block 612, the process loops back to identify potential threat-sources in block 604 and the process repeats as previously described; [0101], e.g., The goal of selecting and adding critical asset and threat-source pairs to the threat/asset pair list in block 610 is to begin pairing potential threat-sources to critical assets. Pairing threat sources and critical assets allow better mapping of specific threats to specific assets for creating specific scenarios); determining that one of the relevant observations is a non-compliant observation based on a failure to comply with a predetermined metric (Martinez [0134], e.g., With respect to determining if the risk level is high in decision block 1008, the magnitude of the risk is evaluated to determine if the risk is high on a critical asset. This consists of the consolidation of multiple risks on a critical asset), [wherein the predetermined metric is defined based on a taxonomy branch classification of a risk factor of the plurality of risk factors that is related to the non-compliant observation]; issuing a finding based on determining the relevant observation is a non-compliant observation (Martinez [0134], [0139], e.g., If risk is high, then proceed to next step for identifying and evaluating security countermeasures to mitigate risk…… After determining the type of risk management strategy to apply, the following factors should be recommended for minimizing or eliminating the risk but should not be limited to these [4]: (a) effectiveness of recommended solutions (e.g. system compatibility); (b) legislation and regulation; (c) organizational policy; (d) operational impact; and (e) safety and reliability), wherein the finding includes a criticality (Martinez [0134], e.g., With respect to determining if the risk level is high in decision block 1008, the magnitude of the risk is evaluated to determine if the risk is high on a critical asset. This consists of the consolidation of multiple risks on a critical asset) [and an identification of a target entity of the target entities associated with the finding], and wherein the criticality is based on a taxonomy branch of the risk factor related to the non-compliant observation (Martinez [0131], e.g., risk is calculated as a function of threat, vulnerability, and impact; [0096], e.g., When identifying both cyber and physical threats for the critical asset, there are four categories to take into consideration; people, processes, physical environment and technology); and transmitting an alert to the client entity based on the criticality of the finding (Martinez [0143], e.g., An extension to the VARM is the ability to alert interested parties whenever the risk is high for a set of critical assets. The software architecture supports situational response to high-risk scenarios by providing a risk mitigation system).
Martinez does not explicitly teach, but Bolukbas teaches identifying a plurality of cyber asset footprints corresponding to the target entities, wherein the client entity and each of the target entities are different organizations each associated with a collection of cyber assets (Bolukbas Col. 6, lines 6-48, e.g., FIG. 1B also includes risk quantification request system 130 where users request risk quantification results for a single entity or multiple entities. It should be understood that the entity whose cyber risk is requested can be the entity of the user or a third party with whom that user's entity engage… users can request cyber risk quantification for a single entity, or multiple entities, by giving the domain name(s) of the entity/entities as input(s)… The domain names of an entity provided by the user in the user request are forwarded to an asset discovery engine 140 that determines the internet-facing assets of an entity using non-invasive techniques that require no human intervention. A determined description of all or nearly all of the internet-facing assets of an entity is referred to herein as a digital footprint. One skilled in the art will appreciate that the term “asset” as used herein generally refers to internet metrics such as domains, Internet Protocol (IP) addresses, blocks of IP addresses, subdomains, Domain Name Server (DNS) records, websites, Autonomous System Numbers (ASN), which is a unique number assigned to an autonomous system by the Internet Assigned Numbers Authority (IANA), web services, social media accounts, e-mail addresses, and/or other internet-facing element that belongs to digital footprint of an entity); monitoring a plurality of data sources comprising cyber risk information related to cyber security risks posed to the client entity by the cyber assets of the target entities to generate source data (Bolukbas Col. 7, 8, lines 60-67, 1-27, e.g., At least some of the databases in the cyber intelligence database system 150 communicate with a cyber intelligence scanner system 160. For example, one or more of the vulnerability database 155, the cyber events database 154, the IP and domain reputation database 153 and/or the knowledge database 152 may communicate with the scanner system. The cyber intelligence scanner system 160 is also in communication with the asset discovery engine 140. The cyber intelligence scanner system 160 scans the information in the databases of the cyber intelligence database system 150 with respect to the outputs generated by the asset discovery engine 140. For example, a reputation scanner 161 searches for related reputation data in the IP and domain reputation database 153 for the assets discovered by asset discovery engine 140… Also, a threat intelligence scanner 162 searches for related threat data in cyber events database 154 for the assets discovered by asset discovery engine 140… A passive vulnerability scanner 163 searches for related vulnerability data in vulnerability database 155 for the assets discovered by asset discovery engine 140).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to have modified the teachings of Martinez and with the teachings of Bolukbas with reasonable expectation of success. One of ordinary skill in the art would have been motivated to make the modification for the benefit of providing a scalable risk quantification system that enables organizations to better assess the cyber risk against their third parties (Bolukbas Col. 2, 3, lines 34-67, 1-16, e.g., The problem of cyber risk assessment is a multi-dimensional problem that includes complex technical, financial, and compliance-related issues… For many applications, these new systems and methods need to be non-intrusive, simple to use, cost effective, standards compliant and scalable to large third-party ecosystems… One feature of the apparatus and method of the present teaching is that it addresses the challenges in providing cyber risk assessment for an organization's cyber systems, especially those that include third-party systems… For example, for third-party risk management (TPRM), knowing the probable financial impact of a data breach caused by a third party enables organizations to better assess the cyber risk against their third parties, prioritize third parties with respect to the probable loss, plan how to remediate the risks, and provide off- or on-site audits… One aspect of the present teaching is the use of risk quantification techniques that are scalable for a high number of entities because they rely on technical data gathered non-intrusively to significantly lower the cost of third-party risk management requirements. Thus, in some embodiments, methods and apparatus of the present teaching provide non-intrusive data gathering for the collection of inputs required for scalable cyber risk quantification, calculation of cyber risk quantification with collected data, and graphical user interfaces to present the results).
Martinez and Bolukbas do not explicitly teach, but Vashistha teaches wherein the predetermined metric is defined based on a taxonomy branch classification of a risk factor of the plurality of risk factors that is related to the non-compliant observation (Vashistha [0143], e.g., A user may also be allowed to customize the process for generating risk scores. For example, as shown in FIG. 2, the risk scores generated (208) for risk sub-categories are based in part on the weight percentages assigned (206) to the risk parameters. Also, the risk scores generated (212) for risk categories are based in part on the weight percentages assigned (210) to sub-categories. The composite risk scores are also generated (216) based in part on weight percentages assigned (214) to the risk categories); and an identification of a target entity of the target entities associated with the finding (Vashistha [0023], e.g., The machine not only identifies any event that has the potential to impact (positively or negatively) ongoing vendor operations and/or business, but can also analyze the event for its level of severity and provide the appropriate & relevant guidance to either mitigate potential risks or leverage potential opportunities).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to have modified the combined teachings of Martinez and Bolukbas with the teachings of Vashistha with reasonable expectation of success. One of ordinary skill in the art would have been motivated to make the modification for the benefit of enabling the user to run different risk scenarios by allowing the user to arrive at different risk scores by changing weights assigned to different categories (Vashistha [0042], [0043], e.g., Referring to FIG. 7, the machine enables the user to run different risk scenarios by allowing the user to arrive at different risk scores by changing weights assigned to different categories. By giving the user the ability to control and change these weights, different “what-if” scenarios can be run based on the risk categories that are most important for a user. For example, a location's Geo-Political Risk may be the most important risk category for an insurance company, and its relevant stakeholder may choose to give additional weight to this particular risk category as compared to the others. Similarly, a third party entity's Cybersecurity Risk could be a key risk category for an Information Security user who may choose to give this category relatively higher weight when compared to other risk categories).
Regarding claim 2, most of the limitations of this claim have been noted in the rejection of claim 1. Martinez further teaches initiating a remediation action for the target entity associated with the finding in response to issuing the finding (Martinez [0129], e.g., If the risk level is high, as determined in decision block 1108, risk management strategies are identified and evaluated in block 1010).
Regarding claim 7, most of the limitations of this claim have been noted in the rejection of claim 1. Martinez further teaches classifying the risk factors according to risk categories (Martinez [0110], e.g., Using the NISTIR 7826 Vols. 1-3 document as a guide, a vulnerability class is used to categorize weaknesses which could adversely impact the operational technology of an energy system; [0096], e.g., When identifying both cyber and physical threats for the critical asset, there are four categories to take into consideration; people, processes, physical environment and technology); and classifying the risk categories according to the taxonomy branches (Martinez [0096], e.g., four areas of cyber/physical security categories: (1) people (e.g., inside, hacker/cracker, terrorists, social engineering, etc.); (2) processes (e.g., software development, purchasing, hiring, operation, etc.); (3) technology (e.g., hardware, firmware, communications/interfaces, security practices, etc.); and (4) physical environment (e.g., data centers, communication lines, internal/external, power, etc.); [0110], e.g., a vulnerability class is used to categorize weaknesses which could adversely impact the operational technology of an energy system…… Below are the five specific areas which can make an energy system vulnerable).
The motivation to combine is the same as that of claim 1.
Regarding claim 8, most of the limitations of this claim have been noted in the rejection of claim 7. Martinez teach wherein the risk categories classified in the IT hygiene taxonomy branch comprise at least one of: an attack surface-related risk factor; an email security-related risk factor; a configuration-related risk factor; an application security-related risk factor; a DNS security-related risk factor; a non-business application-related risk factor; or a vendor dependency-related risk factor (Martinez [0111], e.g., Policies and procedures are known to be documented methods on how the infrastructure operates. Vulnerabilities can include insufficient procedures on validation and background checks, inadequate security policies, privacy policies, patch management processes, and change and configuration management to the system. The risk management process is part of this class and is to have a well-documented defense system for potential vulnerabilities).
Regarding claim 9, most of the limitations of this claim have been noted in the rejection of claim 7. Martinez further teaches wherein the risk categories classified in the vulnerabilities taxonomy branch comprise at least one of: a software vulnerability-related risk factor; or a data encryption-related risk factor (Martinez [0113], e.g., Software and firmware design, development and deployment can have vulnerabilities and of course, result in attacks. Software and firmware development include vulnerabilities in code quality, authentication, cryptography, general logic errors and password management. Common Vulnerability and Exposures (CVE) specification are used to establish a common identifier for vulnerability as well as some other descriptions from the Common Weakness Enumeration (CWE) and vulnerability categories defined by the Open Web Application Security Project (OWASP)).
Regarding claim 10, most of the limitations of this claim have been noted in the rejection of claim 7. Martinez further teaches wherein the risk categories classified in the threat activity taxonomy branch comprise at least one of: an inbound adversarial probing-related risk factor; a phish targeting-related risk factor; a credential targeting-related risk factor; or a Dark Web-related risk factor (Martinez [0112], e.g., In regards to people, they are to be the ones trained to follow the policy and procedures developed for the electrical power grid. This category covers vulnerabilities on personnel security awareness training associated with implementing, maintaining and operating systems. Some examples include: (a) employee information; (b) password posting; and (c) poor security notification of inappropriate or suspicious use of network cables or devices).
Regarding claim 11, most of the limitations of this claim have been noted in the rejection of claim 7. Martinez further teaches wherein the risk categories classified in the malicious activity taxonomy branch comprise at least one of: an outbound adversarial interaction-related risk factor; a phish exploitation-related risk factor; a blacklisted asset-related risk factor; an external traffic abnormality-related risk factor; a breach-related risk factor; or a credential exploitation-related risk factor (Martinez [0114], e.g., Platform vulnerabilities regard software or hardware units that are compromised in areas of security architecture and design, inadequate malware protection from software attacks and software vulnerabilities. These vulnerabilities include categories of designs, implementation, and operational and poorly configured security equipment. Some examples include: (a) inadequate security architectures and designs by untrained engineers; (b) lack of understating due to poor peer reviews for security designs; and (c) inadequate malware protection).
Regarding claim 16, Martinez teaches a method for managing cyber security risk for a client entity communicating with a plurality of target entities, the method comprising: identifying a plurality of cyber asset footprints corresponding to the target entities (Martinez [0061], e.g., Step 1 (302): The first step in system characterization 102 is to gather data from the customer…… Data for the IT control plane and OT infrastructure will be required to begin the system characterization of the energy grid; [0067], e.g., Identifying the assets for the OT control systems requires the identification of the type of communication and control system in place. These systems might be either or a combination of the following communication and control systems. Industrial Control Systems (ICS)…… Supervisory Control and Data Acquisition (SCADA) Systems…… Communications media that might be used for SCADA communications includes advanced radio data information services (ARDIS), cellular telephone data services, digital microwave, fiber optics, multiple address radio (MAS); Note the footprints are the individual systems in the OT system), [wherein the client entity and each of the target entities are different organizations each associated with a collection of cyber assets, and] wherein each cyber asset footprint comprises cyber assets associated with a different one of the target entities (Martinez [0067], e.g., Identifying the assets for the OT control systems requires the identification of the type of communication and control system in place…… These systems might be either or a combination of the following communication and control systems. Industrial Control Systems (ICS)…… Supervisory Control and Data Acquisition (SCADA) Systems…… Communications media that might be used for SCADA communications; [0081], e.g., The assets are categorized into physical assets or cyber-physical assets. Physical assets are any asset that those not have a IP address and/or support any type of communications for operation, control, monitoring, alerting, data acquisition, etc. Cyber-Physical assets are any physical asset that supports functions such as operation, control, monitoring, alerting, data acquisition, etc. Examples of these are EMS, HMI, RTUs, PLCs, and PMUs, etc.; Note each system (entity) has assets that supports functions such as operation, control, monitoring, alerting, data acquisition); monitoring a plurality of data sources comprising information [related to cyber security risks posed to the client entity by the cyber assets of the target entities] to generate source data (Martinez [0097], e.g., Potential threat-sources are identified in block 604 using a potential threat-source list 606. The threat-source source is characterized in block 608), wherein the source data is organized based on a plurality of risk factors (Martinez [0096], e.g., Threat-sources generally include: (i) hostile cyber/physical attacks; (ii) human errors of omission or commission; or (iii) natural and man-made disasters), and wherein the risk factors (Martinez [0096], e.g., cyber and physical threats) are classified according to a cyber security risk taxonomy (Martinez [0096], e.g., When identifying both cyber and physical threats for the critical asset, there are four categories to take into consideration; people, processes, physical environment and technology; [0110], e.g., a vulnerability class is used to categorize weaknesses which could adversely impact the operational technology of an energy system…… Below are the five specific areas which can make an energy system vulnerable…… (1) policy and procedure; (2) people; (3) platform software/firmware vulnerabilities; (4) platform vulnerabilities; and (5) network vulnerabilities); identifying relevant observations in the source data (Martinez [0097], e.g., Potential threat-sources are identified in block 604 using a potential threat-source list 606), wherein each relevant observation comprises information related to a risk factor of the plurality of risk factors (Martinez [0097], e.g., The threat-source source is characterized in block 608) and is identified based on a correlation between the information and one of the cyber asset footprints of the target entities (Martinez [0097], e.g., An asset and threat-source pair are selected and added to the threat/asset list in block 610. If there are other threat-sources, as determined in decision block 612, the process loops back to identify potential threat-sources in block 604 and the process repeats as previously described; [0101], e.g., The goal of selecting and adding critical asset and threat-source pairs to the threat/asset pair list in block 610 is to begin pairing potential threat-sources to critical assets. Pairing threat sources and critical assets allow better mapping of specific threats to specific assets for creating specific scenarios); determining that one of the relevant observations is a non-compliant observation based on a failure to comply with a predetermined metric (Martinez [0134], [0139], e.g., If risk is high, then proceed to next step for identifying and evaluating security countermeasures to mitigate risk…… After determining the type of risk management strategy to apply, the following factors should be recommended for minimizing or eliminating the risk but should not be limited to these [4]: (a) effectiveness of recommended solutions (e.g. system compatibility); (b) legislation and regulation; (c) organizational policy; (d) operational impact; and (e) safety and reliability), [wherein the predetermined metric is based on a cyber risk taxonomy classification of a risk factor of the plurality of risk factors that is related to the non-compliant observation]; and issuing a finding based on determining the relevant observation is a non-compliant observation (Martinez [0134], [0139], e.g., If risk is high, then proceed to next step for identifying and evaluating security countermeasures to mitigate risk…… After determining the type of risk management strategy to apply, the following factors should be recommended for minimizing or eliminating the risk but should not be limited to these [4]: (a) effectiveness of recommended solutions (e.g. system compatibility); (b) legislation and regulation; (c) organizational policy; (d) operational impact; and (e) safety and reliability), wherein the finding includes a criticality (Martinez [0134], e.g., With respect to determining if the risk level is high in decision block 1008, the magnitude of the risk is evaluated to determine if the risk is high on a critical asset. This consists of the consolidation of multiple risks on a critical asset), wherein the finding includes a criticality (Martinez [0134], e.g., With respect to determining if the risk level is high in decision block 1008, the magnitude of the risk is evaluated to determine if the risk is high on a critical asset. This consists of the consolidation of multiple risks on a critical asset) [and an identification of a target entity of the target of entities associated with the finding], and wherein the criticality is based on the cyber risk taxonomy classification of the risk factor related to the non-compliant observation (Martinez [0131], e.g., risk is calculated as a function of threat, vulnerability, and impact; [0096], e.g., When identifying both cyber and physical threats for the critical asset, there are four categories to take into consideration; people, processes, physical environment and technology).
Martinez does not explicitly teach, but Bolukbas teaches identifying a plurality of cyber asset footprints corresponding to the target entities, wherein the client entity and each of the target entities are different organizations each associated with a collection of cyber assets (Bolukbas Col. 6, lines 6-48, e.g., FIG. 1B also includes risk quantification request system 130 where users request risk quantification results for a single entity or multiple entities. It should be understood that the entity whose cyber risk is requested can be the entity of the user or a third party with whom that user's entity engage… users can request cyber risk quantification for a single entity, or multiple entities, by giving the domain name(s) of the entity/entities as input(s)… The domain names of an entity provided by the user in the user request are forwarded to an asset discovery engine 140 that determines the internet-facing assets of an entity using non-invasive techniques that require no human intervention. A determined description of all or nearly all of the internet-facing assets of an entity is referred to herein as a digital footprint. One skilled in the art will appreciate that the term “asset” as used herein generally refers to internet metrics such as domains, Internet Protocol (IP) addresses, blocks of IP addresses, subdomains, Domain Name Server (DNS) records, websites, Autonomous System Numbers (ASN), which is a unique number assigned to an autonomous system by the Internet Assigned Numbers Authority (IANA), web services, social media accounts, e-mail addresses, and/or other internet-facing element that belongs to digital footprint of an entity); monitoring a plurality of data sources comprising cyber risk information related to cyber security risks posed to the client entity by the cyber assets of the target entities to generate source data (Bolukbas Col. 7, 8, lines 60-67, 1-27, e.g., At least some of the databases in the cyber intelligence database system 150 communicate with a cyber intelligence scanner system 160. For example, one or more of the vulnerability database 155, the cyber events database 154, the IP and domain reputation database 153 and/or the knowledge database 152 may communicate with the scanner system. The cyber intelligence scanner system 160 is also in communication with the asset discovery engine 140. The cyber intelligence scanner system 160 scans the information in the databases of the cyber intelligence database system 150 with respect to the outputs generated by the asset discovery engine 140. For example, a reputation scanner 161 searches for related reputation data in the IP and domain reputation database 153 for the assets discovered by asset discovery engine 140… Also, a threat intelligence scanner 162 searches for related threat data in cyber events database 154 for the assets discovered by asset discovery engine 140… A passive vulnerability scanner 163 searches for related vulnerability data in vulnerability database 155 for the assets discovered by asset discovery engine 140).
The motivation to combine Bolukbas is the same as that of claim 1.
Martinez and Bolukbas do not explicitly teach, but Vashistha teaches wherein the predetermined metric is based on a cyber risk taxonomy classification of a risk factor of the plurality of risk factors that is related to the non-compliant observation (Vashistha [0143], e.g., A user may also be allowed to customize the process for generating risk scores. For example, as shown in FIG. 2, the risk scores generated (208) for risk sub-categories are based in part on the weight percentages assigned (206) to the risk parameters. Also, the risk scores generated (212) for risk categories are based in part on the weight percentages assigned (210) to sub-categories. The composite risk scores are also generated (216) based in part on weight percentages assigned (214) to the risk categories); and an identification of a target entity of the target of entities associated with the finding (Vashistha [0023], e.g., The machine not only identifies any event that has the potential to impact (positively or negatively) ongoing vendor operations and/or business, but can also analyze the event for its level of severity and provide the appropriate & relevant guidance to either mitigate potential risks or leverage potential opportunities).
The motivation to combine Vashistha is the same as that of claim 1.
Regarding claim 17, most of the limitations of this claim have been noted in the rejection of claim 16. Martinez further teaches wherein the cyber security risk taxonomy comprises taxonomy branches, and wherein the taxonomy branches include at least one of: email; information technology (IT) hygiene; vulnerabilities; threat activity; or malicious activity (Martinez [0096], e.g., When identifying both cyber and physical threats for the critical asset, there are four categories to take into consideration; people, processes, physical environment and technology; [0110], e.g., a vulnerability class is used to categorize weaknesses which could adversely impact the operational technology of an energy system…… Below are the five specific areas which can make an energy system vulnerable…… (1) policy and procedure; (2) people; (3) platform software/firmware vulnerabilities; (4) platform vulnerabilities; and (5) network vulnerabilities; [0113], e.g., Software and firmware design, development and deployment can have vulnerabilities and of course, result in attacks. Software and firmware development include vulnerabilities in code quality, authentication, cryptography, general logic errors and password management. Common Vulnerability and Exposures (CVE) specification are used to establish a common identifier for vulnerability as well as some other descriptions from the Common Weakness Enumeration (CWE) and vulnerability categories defined by the Open Web Application Security Project (OWASP)).
The motivation to combine is the same as that of claim 1.
Regarding claim 18, most of the limitations of this claim have been noted in the rejection of claim 16. Martinez further teaches initiating a remediation action based on the criticality of the finding (Martinez [0129], e.g., If the risk level is high, as determined in decision block 1108, risk management strategies are identified and evaluated in block 1010).
Regarding claim 19, most of the limitations of this claim have been noted in the rejection of claim 16. Martinez further teaches generating an alert based on the finding (Martinez [0143], e.g., An extension to the VARM is the ability to alert interested parties whenever the risk is high for a set of critical assets. The software architecture supports situational response to high-risk scenarios by providing a risk mitigation system).
Regarding claim 20, most of the limitations of this claim have been noted in the rejection of claim 19. Martinez further teaches at least one of: transmitting the alert to the target entity associated with the finding; and transmitting the alert to the client entity (Martinez [0143], e.g., An extension to the VARM is the ability to alert interested parties whenever the risk is high for a set of critical assets. The software architecture supports situational response to high-risk scenarios by providing a risk mitigation system).
Claim(s) 12-15 is/are rejected under 35 U.S.C. 103 as being unpatentable over Martinez in view of Bolukbas and Vashistha, and in further view of Kliger et al. (US Pat. Pub. No. 20200044911).
Regarding claim 12, most of the limitations of this claim have been noted in the rejection of claim 1. Martinez, Bolukbas, and Vashistha do not explicitly teach, but Kliger teaches wherein the alert is transmitted based on the risk factor [associated with the finding being classified in the vulnerabilities taxonomy branch] (Kliger [0025], e.g., the computing system identifies a plurality of different types of alerts, wherein each identified alert of the plurality of different types of alerts is associated with a corresponding plurality of different client systems that each triggered or detected the identified alert (act 110); [0028], e.g., Upon identifying the alert(s), the computing system generates a plurality of different client remediation process sets for each of the alerts or types of alerts (act 120); Note different types of alerts implies that there are different types of risk events), the method further comprising: initiating a remediation action for the target entity associated with the finding based on the alert (Kliger [0038], e.g., In some instances, the process of determining which processes are related to the identified alert (act 122) is performed to identify the specific processes a client performs in remediation of a detected alert condition), wherein the initiating the remediation action for the target entity comprises at least one of: instructing the target entity to upgrade an application to a patched version; and instructing the target entity to delete an application (Kliger [0038], e.g., disabling a particular component or application).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to have modified the teachings of Martinez, Bolukbas, and Vashistha with the teachings of Kliger with reasonable expectation of success. One of ordinary skill in the art would have been motivated to make the modification for the benefit efficiently generating remediation files for systems experiencing threat conditions (Kliger [0063], e.g., the current embodiments enable a computing system to more efficiently, than existing techniques, generate and provide composite remediation files that are relevant for target systems experiencing threat conditions and which may be used to remediate those threat conditions).
Kliger does not explicitly teach, but Martinez teaches risk factor associated with the finding being classified in the vulnerabilities taxonomy branch (Martinez [0113], e.g., Software and firmware design, development and deployment can have vulnerabilities and of course, result in attacks. Software and firmware development include vulnerabilities in code quality, authentication, cryptography, general logic errors and password management. Common Vulnerability and Exposures (CVE) specification are used to establish a common identifier for vulnerability as well as some other descriptions from the Common Weakness Enumeration (CWE) and vulnerability categories defined by the Open Web Application Security Project (OWASP)).
Regarding claim 13, most of the limitations of this claim have been noted in the rejection of claim 1. Martinez, Bolukbas, and Vashistha do not explicitly teach, Kliger teaches wherein the alert is transmitted based on the risk factor [associated with the finding being classified in the threat activity taxonomy branch] (Kliger [0025], e.g., the computing system identifies a plurality of different types of alerts, wherein each identified alert of the plurality of different types of alerts is associated with a corresponding plurality of different client systems that each triggered or detected the identified alert (act 110); [0028], e.g., Upon identifying the alert(s), the computing system generates a plurality of different client remediation process sets for each of the alerts or types of alerts (act 120); Note different types of alerts implies that there are different types of risk events), and wherein the alert comprises instructions to the client entity that the target entity is subject to malicious activity (Kliger [0038], e.g., identify the specific processes a client performs in remediation of a detected alert condition…… the processes can include such things…… generating a notification for an administrator or a third party).
The motivation to combine is the same as that of claim 12.
Kliger does not explicitly teach, but Martinez teaches risk factor associated with the finding being classified in the threat activity taxonomy branch (Martinez [0112], e.g., In regards to people, they are to be the ones trained to follow the policy and procedures developed for the electrical power grid. This category covers vulnerabilities on personnel security awareness training associated with implementing, maintaining and operating systems. Some examples include: (a) employee information; (b) password posting; and (c) poor security notification of inappropriate or suspicious use of network cables or devices).
Regarding claim 14, most of the limitations of this claim have been noted in the rejection of claim 1. Martinez, Bolukbas, and Vashistha do not explicitly teach, but Kliger teaches wherein the alert is transmitted based on the risk factor [associated with the finding being classified in the malicious activity taxonomy branch] (Kliger [0025], e.g., the computing system identifies a plurality of different types of alerts, wherein each identified alert of the plurality of different types of alerts is associated with a corresponding plurality of different client systems that each triggered or detected the identified alert (act 110); [0028], e.g., Upon identifying the alert(s), the computing system generates a plurality of different client remediation process sets for each of the alerts or types of alerts (act 120); Note different types of alerts implies that there are different types of risk events), the method further comprising: initiating, based on the alert, a remediation action for the target entity associated with the finding (Kliger [0038], e.g., In some instances, the process of determining which processes are related to the identified alert (act 122) is performed to identify the specific processes a client performs in remediation of a detected alert condition), wherein the initiating the remediation action for the target entity comprises at least one of: instructing the target entity to investigate an attack; and instructing the target entity to stop an attack (Kliger [0038], e.g., identify the specific processes a client performs in remediation of a detected alert condition…… the processes can include such things…… turning on a firewall, turning off a port, changing passwords, turning off a service).
The motivation to combine is the same as that of claim 12.
Kliger does not explicitly teach, but Martinez teaches risk factor associated with the finding being classified in the malicious activity taxonomy branch (Martinez [0114], e.g., Platform vulnerabilities regard software or hardware units that are compromised in areas of security architecture and design, inadequate malware protection from software attacks and software vulnerabilities. These vulnerabilities include categories of designs, implementation, and operational and poorly configured security equipment. Some examples include: (a) inadequate security architectures and designs by untrained engineers; (b) lack of understating due to poor peer reviews for security designs; and (c) inadequate malware protection).
Regarding claim 15, most of the limitations of this claim have been noted in the rejection of claim 1. Martinez, Bolukbas, and Vashistha do not explicitly teach, but Kliger teaches wherein the alert is transmitted based on the risk factor [associated with the finding being classified in the IT hygiene taxonomy branch] (Kliger [0025], e.g., the computing system identifies a plurality of different types of alerts, wherein each identified alert of the plurality of different types of alerts is associated with a corresponding plurality of different client systems that each triggered or detected the identified alert (act 110); [0028], e.g., Upon identifying the alert(s), the computing system generates a plurality of different client remediation process sets for each of the alerts or types of alerts (act 120); Note different types of alerts implies that there are different types of risk events), the method further comprising: initiating, based on the alert, a remediation action for the target entity associated with the finding (Kliger [0038], e.g., In some instances, the process of determining which processes are related to the identified alert (act 122) is performed to identify the specific processes a client performs in remediation of a detected alert condition), wherein the initiating the remediation action for the target entity comprises instructing the target entity to update its infrastructure (Kliger [0038], e.g., identify the specific processes a client performs in remediation of a detected alert condition…… the processes can include such things…… rebalancing network traffic, instantiating a new session or functionality, spinning up or recruiting a new resource into a distributed network, creating a copy or backup of data, turning off or rebooting a system/component).
The motivation to combine is the same as that of claim 12.
Kliger does not explicitly teach, but Martinez teaches risk factor associated with the finding being classified in the IT hygiene taxonomy branch (Martinez [0111], e.g., Policies and procedures are known to be documented methods on how the infrastructure operates. Vulnerabilities can include insufficient procedures on validation and background checks, inadequate security policies, privacy policies, patch management processes, and change and configuration management to the system. The risk management process is part of this class and is to have a well-documented defense system for potential vulnerabilities).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Contact Information
Any inquiry concerning this communication or earlier communications from the examiner should be directed to LAWRENCE TRUONG whose telephone number is (571)272-6973. The examiner can normally be reached Monday - Friday, 8:00 am - 4 pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ali Shayanfar can be reached at (571) 270-1050. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/LAWRENCE TRUONG/Examiner, Art Unit 2434
/ALI SHAYANFAR/Supervisory Patent Examiner, Art Unit 2434
