CLOUD SERVICE USAGE RISK ASSESSMENT USING DARKNET INTELLIGENCE

• US 20150215332A1
• Filed: 02/10/2015
• Published: 07/30/2015
• Est. Priority Date: 01/30/2013
• Status: Active Grant

• Current Assignee: Skyhigh Security LLC
• Original Assignee: Skyhigh Networks Incorporated (McAfee, LLC)
• Inventors: Gupta, Rajiv, Narayan, Kaushik, Curcic, Dejan, Somasamudram, Prasad Raghavendra, Sarukkai, Sekhar
• Granted Patent: US 9,674,211 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of assessing a risk level of an enterprise using cloud-based services from one or more cloud service providers includes assessing provider risk scores associated with the one or more cloud service providers and in view of darknet intelligence data; assessing cloud service usage behavior and pattern of the enterprise; and generating a risk score for the enterprise based on the provider risk scores and on the cloud service usage behavior and pattern of the enterprise. The risk score is indicative of the risk of the enterprise relating to the use of the cloud-based services from the one or more cloud service providers.

Claims

1. A method of assessing a risk level of an enterprise using cloud-based services from one or more cloud service providers, the method comprising:

assessing, using a processor, provider risk scores associated with the one or more cloud service providers and in view of darknet intelligence data;

assessing, using a processor, cloud service usage behavior and pattern of the enterprise; and

generating, using a processor, a risk score for the enterprise based on the provider risk scores and on the cloud service usage behavior and pattern of the enterprise, the risk score being indicative of the risk of the enterprise relating to the use of the cloud-based services from the one or more cloud service providers.

2. The method of claim 1, wherein assessing provider risk scores associated with the one or more cloud service providers comprises:

receiving cloud service provider information characterized by a plurality of attributes, each attribute being associated with a plurality of attribute values, each attribute value being associated with a point value;

receiving cloud service provider information characterized by an attribute related to darknet intelligence data;

for each cloud service provider, assessing the attribute point value for each attribute based on the cloud service provider information;

aggregating the attribute point values for all of the plurality of attributes associated with a cloud service provider; and

generating a provider risk score for the cloud service provider based on the aggregated attribute point values associated with the cloud service provider.

3. The method of claim 2, further comprising:

assigning attribute weight values to each of the plurality of attributes, the attribute weight values being applied to adjust the relative contribution of an attribute to the provider risk score; and

for each cloud service provider, assessing the attribute point value for each attribute based on the cloud service provider information, the attribute point value being adjusted by the respective attribute weight value.

4. The method of claim 2, wherein receiving cloud service provider information characterized by a plurality of attributes comprises:

receiving cloud service provider information characterized by the plurality of attributes, the plurality of attributes belonging to one or more risk categories, the risk categories including one or more of a cloud service risk, a data risk, a user/device risk, and a business risk, the cloud service risk being related to the inherent risk of the cloud service provider, the data risk being related to handling of data at the cloud service provider, the user/device risk being related to users and devices accessing the cloud-based service of the cloud service providers, and the business risk being related to business practices of the cloud service providers,

wherein receiving cloud service provider information characterized by an attribute related to darknet intelligence data comprises receiving cloud service provider information characterized by a first plurality of attributes belonging to the cloud service risk category, the first plurality of attributes comprising an attribute related to darknet intelligence data.

5. The method of claim 1, wherein assessing cloud service usage behavior and pattern of the enterprise comprises:

receiving network event data from a data network associated with the enterprise, the network event data relating to network data traffic between the data network and the one or more cloud service providers;

correlating network event data to the one or more cloud service providers; and

generating one or more cloud service usage analytics based on the network event data and the cloud service provider information.

6. The method of claim 5, wherein generating one or more cloud service usage analytics based on the network event data and the cloud service provider information comprises:

generating service usage analytics relating to one or more of identification of cloud service providers being used, users of the enterprise using each of the identified cloud service providers, time of usage, volume of usage, directionality of the data, and the service category of the cloud service providers.

7. The method of claim 1, wherein generating a risk score for the enterprise comprises:

generating an enterprise risk score associated with a part of or all of the cloud service to usage behavior and pattern belonging to the enterprise; and

generating a user risk score associated with the cloud service usage behavior and pattern belonging to one or more users of the enterprise and darknet intelligence data associated with the one or more users.

8. The method of claim 7, wherein generating a user risk score further comprises:

generating the user risk score associated with the cloud service usage behavior and pattern belonging to one or more users of the enterprise and associated with darknet intelligence data indicating whether user credentials associated with the one or more users have been compromised.

9. The method of claim 8, further comprising:

determining a user risk score for a first user exceeding a first threshold; and

generating a recommendation to the enterprise to change the user credential of the first user.

10. A system for assessing a risk level of an enterprise using cloud-based services from one or more cloud service providers, the system comprising:

a processor configured to;

assess provider risk scores associated with the one or more cloud service providers and in view of darknet intelligence data;

assess cloud service usage behavior and pattern of the enterprise; and

generate a risk score for the enterprise based on the provider risk scores and on the cloud service usage behavior and pattern of the enterprise, the risk score being indicative of the risk of the enterprise relating to the use of the cloud-based services from the one or more cloud service providers; and

a memory coupled to the processor and configured to provide the processor with instructions.

11. The system of claim 10, wherein the processor is further configured to:

receive cloud service provider information characterized by a plurality of attributes, each attribute being associated with a plurality of attribute values, each attribute value being associated with a point value;

receive cloud service provider information characterized by an attribute related to darknet intelligence data;

for each cloud service provider, assess the attribute point value for each attribute based on the cloud service provider information;

aggregate the attribute point values for all of the plurality of attributes associated with a cloud service provider; and

generate a provider risk score for the cloud service provider based on the aggregated attribute point values associated with the cloud service provider.

12. The system of claim 10, wherein the processor is further configured to:

generate an enterprise risk score associated with a part of or all of the cloud service usage behavior and pattern belonging to the enterprise; and

generate a user risk score associated with the cloud service usage behavior and pattern belonging to one or more users of the enterprise and associated with darknet intelligence data associated with the one or more users.

13. The system of claim 12, wherein the processor is further configured to:

generate a user risk score associated with the darknet intelligence data indicating whether user credentials associated with the one or more users have been compromised.

14. The system of claim 13, wherein the processor is further configured to:

determine a user risk score for a first user exceeding a first threshold; and

generate a recommendation to the enterprise to change the user credential of the first user.