Raytheon Company

William Tin Wun Shih

William P Posey

Douglas Edward Lapp

Mark Youhanaie

A method for implementing an object based vulnerability model includes identifying each component in an information system and annotating such component in a database; decomposing each component into major functional objects and annotating each object in a database; identifying actions an attacker could take to modify a behavior of the functional objects in the information system and annotating such actions in a database; capturing a trust score and a trustworthiness score for each object and annotating the trust score and the trustworthiness score in the database; assessing each action on the structure, state, and inputs of each functional object to determine if an interaction exists and annotating the interaction existence in the database; and applying preventive and reactive countermeasures accordingly.

Method for objectively and completely indentifying system residual vulnerabilities

A method for developing an information system specification includes: performing, from a design specification for an information system having a functional and structural component, an information assurance component and an anti-tamper component, a trust analysis identifying which components of the information system the information system must trust to enforce a security policy and providing a trust score; performing for each system element in the information system a trustworthiness assessment and providing a trustworthiness score; performing mitigation to reduce a trust gap as determined from the trust score and the trustworthiness score; performing a vulnerability assessment to identify residual vulnerabilities determined from the vulnerability assessment; mitigating the residual vulnerabilities by designing preventive and reactive countermeasures to reduce the number of residual vulnerabilities; designing and applying anti-tamper techniques to cyber RCPI to ensure countermeasure effectiveness; assessing the countermeasures applied to the information system; assessing the security risk associated with the remaining residual vulnerabilities to determine if such residual vulnerabilities are acceptable to protect critical data and technology in the information system; and changing and updating system requirements for the information system as required by the designing preventive and reactive countermeasures step and the designing and applying anti-tamper techniques step.

Growing community of inventors

Whittier, CA, United States of America

William Tin Wun Shih