System for Tracking Data Security Threats and Method for Same

• US 20160072836A1
• Filed: 06/18/2015
• Published: 03/10/2016
• Est. Priority Date: 09/05/2014
• Status: Active Grant

• Current Assignee: Workday Incorporated
• Original Assignee: Resilient Systems Inc. (International Business Machines Corporation)
• Inventors: Hadden, Allen, Rogers, Kenneth Allen
• Granted Patent: US 9,832,219 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An incident response system and method for tracking data security incidents in enterprise networks is disclosed. An Incident Manager application (IM) stores incident objects and incident artifacts (IAs) created in response to the incidents, where the incident objects include the information for the incident and the IAs are associated with data resources (e.g. IP addresses and malware hashes) identified within the incident objects. In response to creation of the IAs, the IM issues queries against one or more external threat intelligence sources (TISs) to obtain information associated with the IAs and augments the IAs with the obtained information. In examples, the IM can identify known threats by comparing the contents of IAs against TIS(s) of known threats, and can identify potential trends by correlating the created incident objects and augmented IAs for an incident with incident objects and IAs stored for other incidents.

Claims

1. A method for tracking data security incidents in an enterprise network, the method comprising:

creating, in an incident manager (IM), incident objects that include information for the data security incidents and incident artifacts (IAs) that include information for data resources identified within the incident objects;

looking up the IAs in one or more external threat intelligence sources (TIS(s)) to obtain knowledge information concerning the IAs; and

augmenting the IAs with the knowledge information concerning the IAs obtained from the TIS(s).

2. The method of claim 1, wherein creating the incident objects and the incident artifacts is accomplished by the IM in response to receiving messages sent from devices in the enterprise network, wherein the messages include the information for the data security incidents.

3. The method of claim 1, wherein creating the incident objects and the incident artifacts, is accomplished by Incident Response Team (IRT) personnel of the enterprise network in response to the data security incidents.

4. The method of claim 1, further comprising Incident Response Team (IRT) personnel of the enterprise network augmenting the IAs to include information concerning the IAs.

5. The method of claim 1, wherein looking up the IAs in the one or more external TIS(s) further comprises:

querying first level TIS(s) to identify whether the IAs are associated with known threats; and

querying second level TIS(s) to provide metadata and/or usage data for the IAs.

6. The method of claim 5, further comprising executing rules associated with the known threats to provide an incident response to the data security incidents.

7. The method of claim 1, further comprising correlating the created incident objects and the augmented IAs, with other incident objects and IAs stored in the IM associated with other data security incidents, to identify potential trends in the correlated data.

8. The method of claim 7, further comprising executing rules associated with the identified potential trends to provide an incident response to the data security incidents.

9. The method of claim 1, further comprising storing the incident objects and the IAs in an incident database included within the IM.

10. The method of claim 1, wherein the data resources identified within the incident objects include Internet Protocol (IP) addresses, file hashes associated with malware, domain names, names of files, user account IDs, registry keys, email addresses, and/or protocol port numbers.

11. The method of claim 1, wherein the external TIS(s) include first level TIS(s) of known threats including IP address blacklist and malware hash information.

12. The method of claim 1, wherein the external TIS(s) include second level TIS(s) including whois, geolocation, and traceroute information.

13. An incident response system for tracking data security incidents in an enterprise network, comprising:

one or more external threat intelligence sources (TIS(s)) that respond to queries with knowledge information concerning requested data resources; and

an incident manager (IM) that;

stores incident objects and incident artifacts (IAs) created in response to the data security incidents, wherein the incident objects include information for the data security incidents and the IAs include information for data resources identified within the incident objects;

provides the IAs as the requested data resources in queries to the one or more external threat information sources to obtain knowledge information concerning the IAs; and

augments the IAs with the knowledge information concerning the IAs obtained from the one or more external threat information sources.

14. The system of claim 13, wherein the information for the data security incidents are included within messages sent from devices in the enterprise network, and wherein the IM creates the incident objects and the IAs in response to receiving the messages.

15. The system of claim 13, wherein Incident Response Team (IRT) personnel of the enterprise network create the incident objects and the IAs in response to the data security incidents.

16. The system of claim 13, further comprising Incident Response Team (IRT) personnel of the enterprise network augmenting the IAs with information concerning the IAs.

17. The system of claim 13, wherein the external TIS(s) include:

first level TIS(s) that provide an indication whether the IAs are associated with known threats; and

second level TIS(s) that provide metadata and/or usage data for the IAs.

18. The system of claim 17, wherein the IM includes a rules engine including rules, and wherein the rules engine executes rules associated with the known threats to provide an incident response to the data security incidents.

19. The system of claim 13, wherein the IM includes a correlation engine that correlates the stored incident objects and the augmented IAs with other incident objects and IAs stored in the IM to identify potential trends in the correlated data.

20. The system of claim 19, wherein the IM includes a rules engine including rules, and wherein the rules engine executes rules associated with the identified potential trends to provide an incident response to the data security incidents.

21. The system of claim 13, wherein the IM includes an incident database that stores the incident objects and the IAs.

22. The system of claim 13, wherein the data resources identified within the incident objects include Internet Protocol (IP) addresses, file hashes associated with malware, domain names, names of files, user account IDs, registry keys, email addresses, and/or protocol port numbers.

23. The system of claim 13, wherein the external TIS(s) include first level TIS(s) including IP address blacklist and malware hash information.

24. The system of claim 13, wherein the external TIS(s) include second level TIS(s) including whois, geolocation, and traceroute information.