SYSTEM AND METHOD FOR DYNAMICALLY ASSESSING SECURITY RISKS ATTRIBUTED TO A COMPUTER USER'S BEHAVIOR

• US 20080047017A1
• Filed: 06/25/2007
• Published: 02/21/2008
• Est. Priority Date: 06/23/2006
• Status: Abandoned Application

• Current Assignee: Cogneto Development, Inc.
• Original Assignee: Cogneto Development, Inc.
• Inventors: Renaud, Martin
• Application Number:
  US11/768,147
• Publication Number:
  US 20080047017A1
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 30/0273 Determination of fees for advertising

Abstract

Methods and systems are described for assessing computer security risks attributed to a computer user'"'"'s behavior. In accordance with these methods and systems, a user is presented on a computer with a series of questions concerning behaviors that may affect a risk or benefit to the user'"'"'s security. The computer receives input on the computer from the user responding to the questions. As responses are received to the questions, the computer dynamically assesses changes to the user'"'"'s security level as a result of additional information provided by the response. The computer then displays a visual indication of the user'"'"'s security level.

Claims

1. A method for assessing security risks attributed to a computer user'"'"'s behavior, comprising:

presenting on a computer a series of questions to a user concerning behaviors that may affect a risk to the user'"'"'s security;

receiving input on the computer from the user responding to the questions;

as responses are received to the questions, dynamically assessing changes to the user'"'"'s security level as a result of additional information provided by the response; and

displaying a visual indication of the user'"'"'s security level.

2. The method of claim 1, wherein the user'"'"'s security level is assessed using a series of weighted decision algorithms that quantify a risk or benefit associated with user behaviors indicated by the user in response to questions.

3. The method of claim 1, wherein at least a first question is presented to the user via a pop-up on a web browser.

4. The method of claim 1, wherein a user is prompted to respond to the questions with a set of choices for each question.

5. The method of claim 1, wherein the visual indication of the user'"'"'s security level is displayed graphically as a value between a minimum number and a maximum number within a scale.

6. The method of claim 1, wherein the visual indication of the user'"'"'s security level is displayed as a comparative value that compares the user'"'"'s behaviors with those of other computer users who responded to the questions.

7. A method for promoting software for enhancing a computer user'"'"'s security, comprising:

presenting via a web browser on a computer a series of questions to a user concerning behaviors that may affect a risk to the user'"'"'s security;

receiving input on the computer from the user responding to the questions;

presenting on a computer display an analysis of the likelihood of theft or a threat to the user'"'"'s security as discerned from the input from the user; and

providing an advertisement for purchasing security-related software.

8. The method of claim 7, wherein at least a first question is presented to the user via a pop-up on a web browser.

9. The method of claim 7, wherein the display compares the user'"'"'s behaviors with those of other computer users who responded to the questions.

10. The method of claim 7, wherein the computer display dynamically updates the analysis of the likelihood of theft or a threat to the user'"'"'s security as each user response is received.

11. The method of claim 7, wherein the questions presented to the user are retrieved from a queue, and certain follow-up questions in the queue are skipped based upon the user'"'"'s ongoing responses.

12. The method of claim 7, wherein the questions presented to the user concern issues commonly associated with computer security, including at least one of password sharing, token misplacement, email attachment protocols and frequency of calling a helpdesk for resets.

13. The method of claim 7, further comprising:

prompting the user to critique the analysis of the likelihood of theft or a threat to the user'"'"'s security as discerned from the input received from the user.

14. A system for assessing security risks attributed to a computer user'"'"'s behavior, comprising:

a question generator for presenting on a computer a series of questions to a user concerning behaviors that may affect a risk to the user'"'"'s security;

a rules database for dynamically assessing changes to an assessment of the user'"'"'s security level as a result of information provided in responses to the questions; and

a display generator for displaying a visual assessment of the user'"'"'s security level.

15. The system of claim 14, wherein the display generator provides a visual indication of the user'"'"'s security level displayed graphically as a value between a minimum number and a maximum number within a scale.

16. The system of claim 14, wherein the display generator provides a visual indication of the user'"'"'s security level displayed as a comparative value that compares the user'"'"'s behaviors with those of other computer users who responded to the questions.

17. The system of claim 14, further comprising a question database that stores a plurality of questions concerning issues commonly associated with computer security, including at least one of password sharing, token misplacement, email attachment protocols and frequency of calling a helpdesk for resets.

18. The system of claim 17, wherein the rules database assesses the user'"'"'s security level using a series of weighted decision algorithms that quantify a risk or benefit associated with user behaviors indicated by the user in response to questions.

19. The system of claim 18, wherein the rules database determines whether additional questions from the question database are to be asked before performing a final risk analysis to be presented to the user.

20. The system of claim 14, wherein the display generator updates a display dynamically as a user edits responses to questions to thereby enable a user to visualize an effect that a variety of potential behaviors each has on security.