Determining an entity's cybersecurity risk and benchmarking that risk includes non-intrusively collecting one or more types of data associated with an entity. Embodiments further include calculating a security score for at least one of the one or more types of data based, at least in part, on processing of security information extracted from the at least one type of data, wherein the security information is indicative of a level of cybersecurity. Some embodiments also comprise assigning a weight to the calculated security score based on a correlation between the extracted security information and an overall security risk determined from analysis of one or more previously-breached entities in the same industry as the entity. Additional embodiments include calculating an overall cybersecurity risk score for the entity based, at least in part, on the calculated security score and the weight assigned to the calculated security score.

Determining an entity's cybersecurity risk and benchmarking that risk includes non-intrusively collecting one or more types of data associated with an entity. Embodiments further include calculating a security score for at least one of the one or more types of data based, at least in part, on processing of security information extracted from the at least one type of data, wherein the security information is indicative of a level of cybersecurity. Some embodiments also comprise assigning a weight to the calculated security score based on a correlation between the extracted security information and an overall security risk determined from analysis of one or more previously-breached entities in the same industry as the entity. Additional embodiments include calculating an overall cybersecurity risk score for the entity based, at least in part, on the calculated security score and the weight assigned to the calculated security score.

Methods and apparatuses are described herein for multicast and unicast MAC address assignment protocol (MUMAAP). A first node may transmit, to a second node, based on a unicast MAC address of the second node or a multicast MAC address associated with the second node, a discover message that may include a first MAC address or a first range of MAC addresses. The first node may receive an offer message with a second range of MAC addresses. If the first node selects a second MAC address from the received second range of MAC addresses, the first node may transmit a request message indicating that the second MAC address or the second range of MAC addresses is allocated to the first node. The first node may receive an acknowledge message indicating that the second MAC address or the second range of MAC addresses is allocated to the first node.

Methods and apparatuses are described herein for multicast and unicast MAC address assignment protocol (MUMAAP). A first node may transmit, to a second node, based on a unicast MAC address of the second node or a multicast MAC address associated with the second node, a discover message that may include a first MAC address or a first range of MAC addresses. The first node may receive an offer message with a second range of MAC addresses. If the first node selects a second MAC address from the received second range of MAC addresses, the first node may transmit a request message indicating that the second MAC address or the second range of MAC addresses is allocated to the first node. The first node may receive an acknowledge message indicating that the second MAC address or the second range of MAC addresses is allocated to the first node.

A device may include a communication component that may communicatively couple to a first network. The device may also include a processor that may transmit a first signal via the communication component to a network address translation (NAT) system, the first signal including a first request to discover a server device. The NAT system may communicatively couple to the first network and a second network, such that the first network is inaccessible to the second network. The processor may then receive location data associated with the server device and transmit a second signal addressed to the server device based on the location data. The second signal is transmitted to the NAT system, such that the second signal may include a second request for a security policy from the server device. The processor may then receive the security policy via the NAT system and adjust one or more communication operations based on the security policy.

An arrangement to direct a packet sent out from an arbitrary apparatus connected to a network to a predetermined authentication server without changing the configuration of a computer network. A packet transmitted from apparatus, such as a personal computer, newly connected to the network, is guided to an authentication server via communication control apparatus. The communication control apparatus replaces a MAC address of the destination addresses of another server, which is included in the ARP cache of the personal computer, with the MAC address of the communication control apparatus to guide the packet from the personal computer to the communication control apparatus. The communication control apparatus further transmits the received packet to a predetermined authentication server.

Systems, methods, and products for identifying IP mass hosts and determining whether they are good or bad. One embodiment is a method including selecting a first candidate IP address, identifying a set of domains hosted at the IP address, and identifying registrants of the domains. A number of unique ones of the registrants is determined and if the number of unique registrants exceeds a threshold number, the candidate IP address is deemed an IP mass host. Otherwise, the candidate IP address is deemed not to be an IP mass host. For an IP mass host, domains that have bad reputations are identified, and it is determined whether the bad domains comprise at least a threshold percentage of the total hosted domains. If the IP mass host has at least the threshold percentage of bad domains, the IP mass host is deemed a bad mass host.

Systems, methods, and products for identifying IP mass hosts and determining whether they are good or bad. One embodiment is a method including selecting a first candidate IP address, identifying a set of domains hosted at the IP address, and identifying registrants of the domains. A number of unique ones of the registrants is determined and if the number of unique registrants exceeds a threshold number, the candidate IP address is deemed an IP mass host. Otherwise, the candidate IP address is deemed not to be an IP mass host. For an IP mass host, domains that have bad reputations are identified, and it is determined whether the bad domains comprise at least a threshold percentage of the total hosted domains. If the IP mass host has at least the threshold percentage of bad domains, the IP mass host is deemed a bad mass host.

A computer performs dynamic address isolation. The computer comprises an application associated with an application address, a network interface coupled to receive incoming data packets from and transmit outgoing data packets to an external network, a network address translation engine configured to translate between the application address and a public address, and a driver for automatically forwarding the outgoing data packets to the network address translation engine to translate the application address to the public address, and for automatically forwarding the incoming data packets to the network address translation engine to translate the public address to the application address. The computer may communicate with a firewall configured to handle both network-level security and application-level security.

A computer performs dynamic address isolation. The computer comprises an application associated with an application address, a network interface coupled to receive incoming data packets from and transmit outgoing data packets to an external network, a network address translation engine configured to translate between the application address and a public address, and a driver for automatically forwarding the outgoing data packets to the network address translation engine to translate the application address to the public address, and for automatically forwarding the incoming data packets to the network address translation engine to translate the public address to the application address. The computer may communicate with a firewall configured to handle both network-level security and application-level security.