Remedial actions based on user risk assessments

• US 10,581,896 B2
• Filed: 03/08/2017
• Issued: 03/03/2020
• Est. Priority Date: 12/30/2016
• Status: Active Grant

• Current Assignee: Chronicle LLC (Alphabet Inc.)
• Original Assignee: Chronicle LLC (Alphabet Inc.)
• Inventors: Nachenberg, Carey Stover, Lamothe-Brassard, Maxime, Yankova, Svetla Yankova
• Primary Examiner(s): Turchen, James R
• Application Number:
  US15/452,861
• Publication Number:
  US 20180191770A1
• Time in Patent Office: 1,091 Days
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

In some implementations, a method includes receiving, for each of multiple users, user activity data describing actions taken by the user by use of a user device over a period of time, determining, for each user and based on the actions taken by the user over the period of time and user responsibility data that describe responsibilities of the user, a risk assessment representative of a security risk resulting from the actions taken by the user by use of the user device, and determining, by the data processing apparatus, for each user and based on the risk assessment determined for the user, whether to implement a user-specific remedial action directed to risk mitigation.

Claims

1. A method comprising:

receiving, at a data processing apparatus and for each of a plurality of users within an organization;

(i) user activity data describing a plurality of actions taken by the user by use of a user device over a period of time and risks associated with the actions, and (ii) user responsibility data describing responsibilities of the user within the organization, wherein;

the user responsibility data comprises sensitivity assessment data characterizing a security risk associated with data to which the user has access; and

the plurality of users within the organization comprises users having access to data associated with different security risks;

processing, by the data processing apparatus and for each user;

(i) the user activity data describing the actions taken by the user by use of the user device over the period of time and the risks associated with the actions, and (ii) the user responsibility data describing the responsibilities of the user within the organization, using a risk model to generate a risk assessment representative of a security risk resulting from the actions taken by the user by use of the user device; and

determining, by the data processing apparatus, for each user and based on the risk assessment generated for the user, whether to implement a user-specific remedial action directed to risk mitigation, wherein the user-specific remedial action includes presenting a message to the user requesting that the user provide additional input before executing a current user device action being attempted by the user.

2. The method of claim 1, wherein the risk assessment comprises one or more security hygiene scores.

3. The method of claim 1, wherein the risk assessment comprises one or more security hygiene scores, and determining for each user and based on the risk assessment generated for the user, whether to implement a user-specific remedial action directed to risk mitigation comprises determining, based on a user action taken by a user by use of the user device, and the one or more security hygiene scores, whether to implement the user-specific remedial action.

4. The method of claim 1, wherein the risk model comprises a machine learning model, a rule set, or both.

5. The method of claim 1, wherein the user-specific remedial action includes presenting a message to the user, prompting the user not to take a current user device action.

6. The method of claim 1, wherein the user-specific remedial action includes presenting a message to the user, informing the user that a current user device action being attempted by the user will not be executed.

7. The method of claim 1, wherein the user-specific remedial action includes blocking one of:

a current user device action being attempted by the user, an activity related to the current user device action, or an activity related to the user'"'"'s risk assessment.

8. The method of claim 1, wherein the user-specific remedial action includes presenting a report including the user'"'"'s risk assessment to the user.

9. The method of claim 1, further comprising:

for a particular user;

comparing, by the data processing apparatus, the user'"'"'s risk assessment to risk assessments of other users within the organization;

determining, by the data processing apparatus and based on the comparing, a rank of the user among the users within the organization; and

providing, by the data processing apparatus and to the user, a message including the rank of the user.

10. The method of claim 1, wherein the user-specific remedial action comprises restricting the user'"'"'s access to a set of resources.

11. The method of claim 1, wherein the user-specific remedial action includes presenting a message including a prescriptive recommendation to the user.

12. The method of claim 11, wherein the prescriptive recommendation includes a suggested next user device action for the user to take.

13. The method of claim 1, further comprising:

receiving, at the data processing apparatus and for each of the plurality of users within the organization, historical risk assessment data comprising one or more historical risk assessments for the user, wherein each historical risk assessment was generated using the risk model at a respective previous time point;

wherein for each of the plurality of users, using the risk model to generate the risk assessment representative of the security risk resulting from the actions taken by the user by use of the user device comprises;

processing the historical risk assessment data for the user using the risk model to generate the risk assessment for the user.

14. The method of claim 1, wherein the message to the user requesting that the user provide additional input before executing a current user device action being attempted by the user comprises:

a message requesting that the user provide an explanation for the current user device action being attempted by the user.

15. The method of claim 1, wherein the message to the user requesting that the user provide additional input before executing a current user device action being attempted by the user comprises:

a message requesting that the user provide confirmation that the current user device action being attempted by the user should be executed.

16. A system comprising:

one or more user devices; and

a remote server, comprising one or more computing devices and connected to the one or more user devices over a network, that performs operations comprising;

receiving, at the remote server and for each of a plurality of users within an organization from the one or more user devices;

(i) user activity data describing a plurality of actions taken by the user by use of a user device over a period of time and risks associated with the actions, and (ii) user responsibility data describing responsibilities of the user within the organization, wherein;

the user responsibility data comprises sensitivity assessment data characterizing a security risk associated with data to which the user has access; and

the user responsibility data describes different responsibilities for different users within the organization;

processing, by the remote server and for each user;

(i) the user activity data describing the actions taken by the user by use of the user device over the period of time and the risks associated with the actions, and (ii) the user responsibility data describing the responsibilities of the user within the organization, using a risk model to generate a risk assessment representative of a security risk resulting from the actions taken by the user by use of the user device; and

determining, by the remote server, for each user and based on the risk assessment generated for the user, whether to implement a user-specific remedial action directed to risk mitigation, wherein the user-specific remedial action includes presenting a message to the user requesting that the user provide additional input before executing a current user device action being attempted by the user.

17. The system of claim 16, wherein the risk assessment comprises one or more security hygiene scores.

18. A non-transitory computer readable medium storing instructions that when executed by one or more computing devices, cause the one or more computing devices to perform operations comprising:

receiving, at the one or more computing devices and for each of a plurality of users within an organization;

(i) user activity data describing a plurality of actions taken by the user by use of a user device over a period of time and risks associated with the actions, and (ii) user responsibility data describing responsibilities of the user within the organization, wherein;

the user responsibility data comprises sensitivity assessment data characterizing a security risk associated with data to which the user has access; and

the user responsibility data describes different responsibilities for different users within the organization;

processing, by the one or more computing devices and for each user;

(i) the user activity data describing the actions taken by the user by use of the user device over the period of time and the risks associated with the actions, and (ii) the user responsibility data describing the responsibilities of the user within the organization, using a risk model to generate a risk assessment representative of a security risk resulting from the actions taken by the user by use of the user device; and

determining, by the one or more computing devices, for each user and based on the risk assessment generated for the user, whether to implement a user-specific remedial action directed to risk mitigation, wherein the user-specific remedial action includes presenting a message to the user requesting that the user provide additional input before executing a current user device action being attempted by the user.

19. The non-transitory computer readable medium of claim 18, wherein the risk assessment comprises one or more security hygiene scores.