Cybersecurity training system with automated application of branded content

• US 9,398,029 B2
• Filed: 02/11/2015
• Issued: 07/19/2016
• Est. Priority Date: 08/01/2014
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Wombat Security Technologies, Inc (Proofpoint Incorporated)
• Inventors: Sadeh-Koniecpol, Norman, Wescoe, Kurt, Ferrara, Joseph A.
• Primary Examiner(s): Gishnock, Nikolai A
• Application Number:
  US14/619,520
• Publication Number:
  US 20160036829A1
• Time in Patent Office: 524 Days
• Field of Search: 726/11, 726/22, 726/23, 726/26
• US Class Current: 1/1
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1475 : Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 63/1483 : service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A cybersecurity training system uses lures and training actions to help train a user of an electronic device to recognize and act appropriately in situations that could compromise security. The system includes an administrator interface by which an administrator may customize a lure and/or a training action with branded content. When used in a lure, this enables the lure to appear to the user as if it were a legitimate, non-threatening action from the brand. If the user falls for the lure, the system may provide the user with cybersecurity training, which may automatically include content that is tailored for the selected brand.

Claims

1. A method of providing cybersecurity training to a user of an electronic device, comprising:

maintaining, in a data storage device, a library of brand items; and

maintaining, in a data storage device, a library of training actions, wherein each training action comprises a lure or a training intervention;

by a processor of a policy manager device;

causing a first electronic device to output an administrator interface,

generating a query to the library of training actions,

in response to the query, retrieving a training action from the library of training actions, wherein the training action comprises implementation of a Wi-Fi access point, and presenting the retrieved training action via the administrator interface,

presenting, via the administrator interface, at least one brand item from the library of brand items;

receiving, via the administrator interface, a selection of one of the presented brand items;

automatically modifying the retrieved training action to include branded content that corresponds to the selected brand item by including the selected brand item in an identifier for the Wi-Fi access point, and

causing the modified training action with the branded content to be sent to a second electronic device.

2. The method of claim 1, further comprising, by the processor:

receiving a request to add a new brand item to the library of brand items;

determining whether a consent to use the new brand item in the cybersecurity training has been received from an owner of the new brand item; and

only making the new brand item available for use in the modified training action if consent has been received from the owner, otherwise restricting the new brand item from being used in the modified training action.

3. The method of claim 1, wherein:

the library of brand items comprises a library of branded content; and

modifying the retrieved training action to include the branded message that corresponds to the selected brand item comprises;

accessing a library of branded content, each of which is associated with a brand type and a training intervention type, and

selecting, from the library of branded content, branded content having an associated brand type that corresponds to the selected brand and an associated training action type that corresponds to the selected training action.

4. The method of claim 1, wherein:

the library of brand items comprises a library of candidate brands; and

presenting the at least one brand item via the administrator interface comprises;

accessing profile data for the user;

using the profile data to identify, from the library of candidate brands, a brand with which the user has likely interacted; and

presenting the identified brand via the administrator interface.

5. The method of claim 1, wherein presenting the at least one brand from the library of brands comprises:

accessing the library of brand items, in which each brand item is associated with a brand category; and

selecting, from the library of brand items, one of the brands using one or more of the following criteria;

a requirement that the selected brand item be associated with a category that is also associated with the user,

a requirement that the selected brand item comprise or have associated branded content that is consistent with a category of the training intervention, or

a requirement that the all training interventions initiated by the policy manager device include the selected brand item.

6. The method of claim 1, further comprising automatically managing the library of brands by:

for a first candidate brand, sending a request for consent to an owner of the first candidate brand;

if consent is received from the owner within a threshold period of time;

permitting branded content associated with the first candidate brand to be used in modified training actions,

creating the branded content so that it contains a trademark associated with the first candidate brand, as well as other content,

confirming that the owner has approved the created branded content, and

storing the created branded content in the library of brand items to be used in the modified training actions;

if consent is not received from the owner within the threshold period of time, restricting branded content with the first candidate brand from being used in the modified training actions.

7. The method of claim 1, further comprising, by the processor, permitting an administrator to modify the training action, but restricting the administrator from modifying the branded content within the training action.