Applying security policy based on behaviorally-derived user risk profiles

• US 8,776,168 B1
• Filed: 10/29/2009
• Issued: 07/08/2014
• Est. Priority Date: 10/29/2009
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Gibson, Douglas, Newstadt, Keith
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Shepperd, Eric W
• Application Number:
  US12/608,772
• Time in Patent Office: 1,713 Days
• Field of Search: 726/1, 726 5- 6, 726 22- 28, 709224-225
• US Class Current: 726/1
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

Security policy changes can be implemented for a user or a user group based on behaviorally-derived risk information. A behavior-receiving module receives information about user behaviors for the user across various clients with which the user interacts. An attribute-receiving module receives one or more user attributes identified for a user. A profile-generating module generates a user risk profile for the user based on the received information about the user behaviors and the received user attributes. A user scoring module assigns the user a user risk score based on an evaluation of the user risk profile for the user. Similarly, groups of users can be given group risk scores, or users can have combined group/user scores. Finally, a remediation module automatically establishes a security policy requiring remediative actions for the user (or user group) based on the user risk score or combined score (or group score).

Claims

1. A computer-implemented method of establishing a security policy for a user based on risk information for that user, the method comprising:

receiving information about user behaviors for the user across a plurality of clients with which the user interacts;

receiving one or more user attributes identified for the user;

generating a user risk profile for the user based on the received information about the user behaviors and the received user attributes;

assigning the user a user risk score based on an evaluation of the user risk profile for the user;

identifying a plurality of user groups to which the user belongs based on the user attributes;

assigning the user a group risk score for each of the identified user groups to which the user belongs, each group risk score calculated based on the risk scores of the users in the user group, and each group risk score indicating a likelihood of engaging in risky behaviors by the users of the user group;

calculating a combined user risk score for the user based on the user risk score and at least one of the group risk scores; and

automatically establishing a security policy requiring a plurality of remediative actions for the user based on the combined user risk score.

2. The method of claim 1, wherein the user behaviors comprise behaviors of the user that indicate whether the user has a tendency to engage in risky behaviors that are known to be more likely to lead to infections of clients by malware than other behaviors.

3. The method of claim 1, wherein the user attributes comprise identifying attributes of the user that are selected from the group consisting of:

employment status, company department, geographic location, demographic characteristics, and any combination of these.

4. The method of claim 1, wherein the remediative actions are taken for the user responsive to the user risk score indicating that the user takes risky actions associated with malware infections more frequently than other users.

5. The method of claim 1, further comprising:

automatically establishing a security policy or initiating security policy changes requiring a plurality of remediative actions for each of the user groups based on the group risk score.

6. The method of claim 1, further comprising presenting to the system administrator a list of users or a list of groups of users that are determined to be high risk users to allow preventative steps to be taken by the system administrator to reduce the risk of these users or these groups.

7. A non-transitory computer-readable storage medium storing executable computer program instructions for establishing a security policy for a user based on risk information for that user, the computer program instructions comprising instructions for performing the steps comprising:

receiving information about user behaviors for the user across a plurality of clients with which the user interacts;

receiving one or more user attributes identified for the user;

generating a user risk profile for the user based on the received information about the user behaviors and the received user attributes;

assigning the user a user risk score based on an evaluation of the user risk profile for the user;

identifying a plurality of user groups to which the user belongs based on the user attributes;

assigning the user a group risk score for each of the identified user groups to which the user belongs, each group risk score calculated based on the risk scores of the users in the user group, and each group risk score indicating a likelihood of engaging in risky behaviors by the users of the user group;

calculating a combined user risk score for the user based on the user risk score and at least one of the group risk scores; and

automatically establishing a security policy requiring a plurality of remediative actions for the user based on the combined user risk score.

8. The computer-readable storage medium of claim 7, wherein the user behaviors for which information is collected are selected from a group consisting of:

clicking on links in email messages sent by other users that are not in an address book of the user, using weak passwords, using peer-to-peer sites, clicking on email messages that are detected as spam, and ignoring security warnings by security applications.

9. The computer-readable storage medium of claim 7, wherein automatically establishing a security policy further comprises automatically initiating security policy changes requiring a plurality of remediative actions for the user based on the combined user risk score and on a plurality of security rules configurable by a system administrator.

10. The computer-readable storage medium of claim 9, wherein the security rules are configurable by the system administrator to adjust the remediative actions taken against different users and user groups.

11. The computer-readable storage medium of claim 7, further comprising:

correlating user scores for a plurality of users with user attributes for each of those users to identify a plurality of user groups; and

calculating a group risk score for each of the user groups.

12. The computer-readable storage medium of claim 7, further comprising:

automatically establishing a security policy or initiating security policy changes requiring a plurality of remediative actions for each of the user groups based on the group risk score.

13. The computer-readable storage medium of claim 7, wherein one or more of the remediative actions are automatically taken for the user without requiring interaction with the system administrator.

14. A computer system for establishing a security policy for a user based on risk information for that user, the system comprising:

a non-transitory computer-readable storage medium storing executable software modules, comprising;

a behavior-receiving module for receiving information about user behaviors for the user across a plurality of clients with which the user interacts;

an attribute-receiving module for receiving one or more user attributes identified for the user;

a profile-generating module for generating a user risk profile for the user based on the received information about the user behaviors and the received user attributes;

a user scoring module for assigning the user a user risk score based on an evaluation of the user risk profile for the user;

a grouping module for identifying a plurality of user groups to which the user belongs based on the user attributes;

a group scoring module for assigning the user a group risk score for each of the identified user groups to which the user belongs, each group risk score calculated based on the risk scores of the users in the user group, and each group risk score indicating a likelihood of engaging in risky behaviors by the users of the user group;

a combined scoring module for calculating a combined user risk score for the user based on the user risk score and at least one of the group risk scores;

a remediation module for automatically establishing a security policy requiring a plurality of remediative actions for the user based on the user risk score; and

a processor configured to execute the software modules stored by the computer-readable storage medium.

15. The system of claim 14, wherein the behavior-receiving module and the attribute-receiving module are further configured to receive the information and user attributes from a client module on each of the clients of the user that collects this data from security programs and corporate directory information on each of the clients.

16. The system of claim 14, wherein the behavior-receiving module and the attribute-receiving module are configured to receive the information about user behaviors and the one or more user attributes for each of a plurality of users, and wherein the system further comprises:

the remediation module for automatically initiating security policy changes and a plurality of remediative actions for each of the user groups based on the group risk score.

17. The system of claim 14, further comprising:

the combined scoring module for calculating the combined risk score for the user based on the user risk score assigned to the user and the group risk scores assigned to each of the user groups to which the user belongs.

18. The system of claim 14, wherein the remediation module is further configured to apply the user risk score to identify users that more frequently engage in user behaviors known to be associated with security problems than other users.

19. The system of claim 14, wherein the remediative actions are selected from a group consisting of:

increasing a frequency of security scans run on one or more of the clients, limiting access of the user to certain applications or network resources one or more of the clients,

and restricting privileged of the user on one or more of the clients.