IDENTITY AND ASSET RISK SCORE INTELLIGENCE AND THREAT MITIGATION

• US 20140279641A1
• Filed: 03/13/2014
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: AlertEnterprise Incorporated
• Original Assignee: AlertEnterprise Incorporated
• Inventors: KAKKERA, Srinivasa, SINGH, Subrat Narenda, LI, Kiu, SAKALA, Prathap
• Granted Patent: US 9,324,119 B2
• Time in Patent Office: Days
• US Class Current: 705/325
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety

Abstract

Techniques are provided that produce a risk profile consisting of a risk score and trends of risk scores across entities such as user identities and other objects. For example, an identity is assigned a risk score which is based on baseline factors such as HR attributes, such as training and screening status; access to and conflicts across physical, logical, and operational systems; historical and current usage of these systems, as well as anomalies from normal behavior patterns. Techniques herein encompass the management of a risk profile (“behavior profile”) for each entity, e.g. identity, and maintains a risk score that is correlated with behavior, e.g. an individual'"'"'s behavior, to track anomalies or irregularities in every day routines of the entity, e.g. individual.

Claims

1. A computer-implemented method for providing entity risk score intelligence, comprising the steps of:

receiving baseline scoring data at an entity warehouse, wherein the entity warehouse comprises a risk scoring and predictive analytics engine that provides entity risk score intelligence regarding an entity based in part of said baseline scoring data;

performing, at the entity warehouse, ongoing monitoring of behavior and anomaly processes and data and of changes and behaviors processes and data that impact the entity risk score intelligence; and

providing response and alerting;

wherein one or more steps are performed on at least a processor coupled to at least a memory.

2. The method of claim 1, wherein baseline scoring data comprise identity data, access data, training, screenings, and incidents data, and historical activity data.

3. The method of claim 1, wherein the entity warehouse comprises an identity profile, access information, risk score information, and behavior pattern data regarding a particular entity.

4. The method of claim 1, wherein the risk scoring and predictive analytics engine runs on Hadoop and SAP HANA.

5. The method of claim 1, wherein said behavior and anomaly processes and data monitor rules and provide predictive analytics and wherein said changes and behaviors processes and data monitor identity changes, training and screenings failures, and violations.

6. The method of claim 1, wherein providing response and alerting comprises providing reports, analytics, and alerts.

7. The method of claim 4, wherein the risk scoring and predictive analytics engine running on Hadoop and SAP HANA comprises the steps of:

reading, by a risk score job client, one or more lists of datasources from a database using an Hadoop database input formal object;

creating, by said Hadoop database input formal object, splits from the one or more lists of datasrouces;

mapping, by a mapper, each datasource as a single task assigned to a Hadoop datanode;

wherein each mapper extracts information or events from a datasource and collects the extracted information or events by userid;

wherein in case of simulation, the mapper merges the extracted information or events with previously sent simulation information or events sent and wherein the mapper collects the information or events by entity id;

performing, by an extractor, an extraction operation wherein utility class(es) extract incremental or full data from specific types of datasource and for specified users when used for simulation;

sending, by said extractor, data back to said mapper and said mapper sending data back to said risk score job client;

invoking a rule evaluation reducer that is a Hadoop reducer responsible for calculating risk score or the risk level using matched rules;

said rule evaluation reducer invoking a rule engine to call a match rule operation to determine matched rules and returns the rule matching results to said rule evaluation reducer;

said rule evaluation reducer invoking a risk score calculator to calculate one or more risk scores based on the rule matching results and return the risk score results to said rule evaluation reducer;

said rule evaluation reducer invoking the risk score calculator to calculate one or more risk levels and return the risk level results to said rule evaluation reducer;

sending, by said rule evaluation reducer, result data to said risk score job client;

requesting, by said risk score job client, an Hadoop output format object to format and return data comprising;

userid, risk score, risk level, data source names, and readable rule and data values for said matched rules;

wherein said risk score job client provides said returned data for reports, alerts, and analytics.

8. The method of claim 1, wherein said risk scoring and predictive analytics engines uses a risk score configuration on said baseline scoring data, wherein said risk score configuration comprises configurable baseline contributing factors;

training and screening contributing factors; and

on-going usage contributing factors.

9. The method of claim 8, wherein said risk score configuration allows:

profile attributes to be set, conditions for the profile attributes to be set, values for the profile attribute conditions to be set, and corresponding points to be assigned;

training or screening conditions to be set, conditions for the training or screening to be set, values for the training or screening conditions to be set, and corresponding points to be assigned;

on-going usage conditions to be set, conditions for the on-going usage to be set, values for the on-going usage conditions to be set, and corresponding points to be assigned; and

setting an indicator indicating that a simulation is to be run.

10. The method of claim 1, wherein said risk scoring and predictive analytics engines uses a resource reconciliation policy configuration, wherein said resource reconciliation policy configuration allows:

setting mode to incremental or full;

setting whether polling is enabled and, when yes, the time interval;

setting a particular event, selecting a particular action for the selected event, setting whether the particular event with particular action is a risk, setting whether to notify when the particular event with particular action is a risk, and setting a corresponding workflow, when available;

providing file-based reconciliation by allowing inputting a path to a file and a path to an archive location;

setting conditions when a target is inoperational or unreachable by;

setting the option to skip or continue the job and send an alert for manual intervention, providing a particular alert notification template, and providing a list of addresses to which to send the alert;

or

setting the option to wait and retry, setting the maximum number of retries, and setting a particular alert notification and providing a list of addresses to which to send the alert for when after the retries, the target is still down.

11. The method of claim 1, wherein the risk scoring and predictive analytics engine generates a risk score of the entity that is the total sum of all risk scores contributed by matching rules and generates a risk level, wherein the risk level is a mapping of the risk score to a value between 0 and 100.

12. The method of claim 11, wherein said generating a risk level uses entity groups, wherein the entity groups are entities that are grouped according to how their respective rules are related, wherein the entities satisfy rules as much as possible from a single group, and wherein each entity group is compact enough to maximize its relevance in the overall risk level determination.

13. The method of claim 12, wherein generating the risk level for any entity involves two parts, wherein the first part uses a configuration performed by an administrator to a determine maximum risk score that can used as the 100, wherein this calculation is performed once before calculating the risk level for the selected entities, wherein the second part uses the matched rules for an entity to determine the risk score per configured entity group and the maximum entity group score is used to determine the risk level.

14. The method of claim 13, wherein determining the risk level is performed as follows:

using the risk scores specified in the rules configuration, determine the Risk Level-100 by;

calculating the group score for a group G_i as;

15. A system for providing entity risk score intelligence, comprising:

at least one processor operable to execute computer program instructions; and

at least one memory operable to store computer program instructions executable by said at least one processor, for performing;

receiving baseline scoring data at an entity warehouse, wherein the entity warehouse comprises a risk scoring and predictive analytics engine that provides entity risk score intelligence regarding an entity based in part of said baseline scoring data;

performing, at the entity warehouse, ongoing monitoring of behavior and anomaly processes and data and of changes and behaviors processes and data that impact the entity risk score intelligence; and

providing response and alerting.

16. A non-transitory storage medium having stored thereon a computer program comprising a program code for performing, when the computer program is executed on a computer, a method for providing entity risk score intelligence, comprising the steps of:

receiving baseline scoring data at an entity warehouse, wherein the entity warehouse comprises a risk scoring and predictive analytics engine that provides entity risk score intelligence regarding an entity based in part of said baseline scoring data;

performing, at the entity warehouse, ongoing monitoring of behavior and anomaly processes and data and of changes and behaviors processes and data that impact the entity risk score intelligence; and

providing response and alerting.