Cybersecurity training system with automated application of branded content

• US 9,813,454 B2
• Filed: 06/17/2016
• Issued: 11/07/2017
• Est. Priority Date: 08/01/2014
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Wombat Security Technologies, Inc (Proofpoint Incorporated)
• Inventors: Sadeh-Koniecpol, Norman, Wescoe, Kurt, Ferrara, Joseph A.
• Primary Examiner(s): Gishnock, Nikolai A
• Application Number:
  US15/185,228
• Publication Number:
  US 20160301716A1
• Time in Patent Office: 508 Days
• Field of Search: 726 11, 726 22, 726 23, 726 26
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1475 : Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 63/1483 : service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A cybersecurity training system uses lures and training actions to help train a user of an electronic device to recognize and act appropriately in situations that could compromise electronic device security. The system includes a library of cybersecurity training actions and a library of brand items. The system retrieves a template for a cybersecurity training action from the first library, automatically modifies the retrieved template to include a brand or branded content from the second library, and causes the cybersecurity training action according to the modified template instantiated with the branded content to be sent to the user'"'"'s electronic device.

Claims

1. A method of providing cybersecurity training to a user of an electronic device, comprising:

maintaining, in a data storage device, a library of brand items;

maintaining, in a data storage device, a library of cybersecurity training actions, wherein each cybersecurity training action comprises a lure or a cybersecurity training intervention; and

by a policy manager system;

generating a query to the library of cybersecurity training actions,

in response to the query, retrieving a template for a cybersecurity training action from the library of cybersecurity training actions,

select, from the library of brand items, at least one brand item that is available for use in the template for the cybersecurity training action,

automatically modifying the retrieved template for the cybersecurity training action to include a brand or branded content that corresponds to the selected at least one brand item by including the brand or branded content in one or more elements of the template for the cybersecurity training action, and

causing the cybersecurity training action according to the modified template instantiated with the branded content to be sent to a second electronic device.

2. The method of claim 1, further comprising, by the policy manager system before automatically modifying the retrieved template for the cybersecurity training action to include the branded content:

causing a first electronic device to output an administrator interface;

presenting the template for the cybersecurity training action to an administrator via the administrator interface; and

receiving, via the administrator interface, an administrator selection of the selected at least one brand item.

3. The method of claim 1, further comprising, by the policy manager system before automatically modifying the retrieved template for the cybersecurity training action to include the branded content:

causing a first electronic device to output an administrator interface; and

receiving, via the administrator interface, a selection of a category;

wherein generating the query to the library of cybersecurity training actions comprises querying the library of cybersecurity training actions for a cybersecurity training action in the selected category.

4. The method of claim 1, further comprising, by the policy manager system before automatically modifying the retrieved template for the cybersecurity training action to include the branded content:

causing a first electronic device to output an administrator interface;

receiving, via the administrator interface, a selection of a user to be trained; and

accessing profile data about the user to be trained;

wherein generating the query to the library of cybersecurity training actions comprises querying the library for a template for a cybersecurity training action that corresponds to the profile data.

5. The method of claim 4, wherein accessing the profile data and querying the library for a template for a cybersecurity training action that corresponds to the profile data comprises:

determining that the user is a new employee and querying the library for a template for a new employee cybersecurity training action;

or

determining that the user recently infected a computing device with malware from a USB device and querying the library for a template for a safe USB handling cybersecurity training action.

6. The method of claim 1, further comprising, by the policy manager system:

monitoring a user response or lack thereof to the cybersecurity training action that was sent to the second electronic device; and

delivering a follow-up cybersecurity training intervention to the second electronic device.

7. The method of claim 1, wherein:

the cybersecurity training action that is sent to the second electronic device comprises a lure;

the template comprises a fake phishing email template comprising a prompt that is configured to prompt a user of the second device to click a hyperlink that, when actuated, causes an application of the second electronic device to access a particular URL; and

the lure is associated with a cybersecurity training intervention warning a user to inspect a URL of the link prior to clicking the link.

8. The method of claim 7 further comprising, by the policy manager system based on a response of the user of the second electronic device, either:

presenting the user of the second electronic device with an additional cybersecurity training action corresponding to the training intervention template;

or

presenting the user of the second electronic device with a positive cybersecurity communication.

9. The method of claim 1, wherein:

the cybersecurity training action that is sent to the second electronic device comprises a lure; and

the template comprises a prompt that is configured to prompt a user of the second device to download a mock malicious mobile app.

10. The method of claim 9 further comprising, by the policy manager system based on a response of the user of the second electronic device, either:

presenting the user of the second electronic device with an additional cybersecurity training intervention;

or

presenting the user of the second electronic device with a positive cybersecurity communication.

11. The method of claim 1, wherein the template comprises a change your password phishing email that can be customized with the brand or branded content.

12. The method of claim 1, wherein causing the cybersecurity training action to be sent to the second electronic device comprises causing the cybersecurity training action to be delivered via a lure that is a short-range communication device containing instructions that are configured to, when read by the second electronic device, cause the second electronic device to be directed to a mock malicious website or service, or to initiate a download of mock malware.

13. The method of claim 1, wherein:

the cybersecurity training action that is sent to the second electronic device comprises a lure; and

the lure comprises a mock malicious memory device containing an executable file that will activate if inserted into the first electronic device.

14. The method of claim 1, wherein:

the cybersecurity training action that is sent to the second electronic device comprises a lure; and

the lure comprises a barcode that, when scanned by the first electronic device, will cause the first electronic device to be directed to a mock malicious website or service, or to initiate a download of mock malware.

15. The method of claim 1, wherein causing the cybersecurity training action to be sent to the second electronic device comprises causing the cybersecurity training action to be delivered via a mock malicious Wi-Fi access point that lures a user of second electronic device to connect the second electronic device to the Wi-Fi access point.

16. The method of claim 1, wherein:

the library of brand items, also comprises, for at least some of the brand items in the library, information indicating whether the brand items has been authorized for use in one or more cybersecurity training actions by the owner of the brand item; and

selecting the brand item that is available for use in the cybersecurity action comprises selecting a brand item that has been authorized for use in the cybersecurity training actions by the owner of the brand item.

17. A cybersecurity training system, comprising:

a processor;

a data storage device portion that stores a library of brand items;

a data storage device portion that stores instructions for a library of cybersecurity training actions, wherein each cybersecurity training action comprises a lure or a cybersecurity training intervention; and

a data storage device portion containing programming instructions that are configured to instruct the processor to implement a policy manager system by;

generating a query to the library of cybersecurity training actions,

in response to the query, retrieving a template for a cybersecurity training action from the library of cybersecurity training actions,

selecting, from the library of brand items, at least one brand item that is available for use in the template for the cybersecurity training action,

automatically modifying the retrieved template for the cybersecurity training action to include a brand or branded content that corresponds to the selected at least one brand item by including the brand or branded content in one or more elements of the template for the cybersecurity training action, and

causing the cybersecurity training action according to the modified template instantiated with the branded content to be sent to a second electronic device.

18. The system of claim 17, further comprising additional programming instructions that are configured to cause the policy manager system to, before automatically modifying the retrieved template for the cybersecurity training action to include the branded content:

cause a first electronic device to output an administrator interface;

present the template for the cybersecurity training action corresponding to the retrieved template to an administrator via the administrator interface; and

receive, via the administrator interface, an administrator selection of the selected at least one brand item.

19. The system of claim 17, further comprising additional programming instructions that are configured to cause the policy manager system to, before automatically modifying the retrieved template for the cybersecurity training action to include the branded content:

cause a first electronic device to output an administrator interface; and

receive, via the administrator interface, a selection of a category;

wherein the instructions to generate the query to the library of cybersecurity training actions comprises instructions to query the library cybersecurity training actions for a cybersecurity training action in the selected category.

20. The system of claim 17, further comprising additional programming instructions that are configured to cause the policy manager system to, before automatically modifying the retrieved template for the cybersecurity training action to include the branded content:

cause a first electronic device to output an administrator interface;

receive, via the administrator interface, a selection of a user to be trained; and

access profile data about the user to be trained;

wherein the instructions to generate the query to the library of cybersecurity training actions comprises instructions to query the library for a template for a cybersecurity training action that corresponds to the profile data.

21. The system of claim 20, wherein the instructions to access the profile data and query the library for a template for a cybersecurity training action that corresponds to the profile data comprise instructions to:

determine that the user is a new employee and querying the library for a template for a new employee cybersecurity training action;

or

determine that the user recently infected a computing device with malware from a USB device and querying the library for a template for a safe USB handling cybersecurity training action.

22. The system of claim 17, further comprising additional instructions that are configured to cause the policy manager system to:

monitor a user response or lack thereof to the cybersecurity training action that was sent to the second electronic device; and

deliver a follow-up cybersecurity training intervention to the second electronic device.

23. The system of claim 17, wherein:

the cybersecurity training action that is sent to the second electronic device comprises a lure;

the template comprises a fake phishing email template comprising a prompt that is configured to prompt a user of the second device to click a hyperlink that, when actuated, causes an application of the second electronic device to access a particular URL; and

the lure is associated with a cybersecurity training intervention warning a user to inspect a URL of the link prior to clicking the link.

24. The system of claim 17, wherein:

the cybersecurity training action that is sent to the second electronic device comprises a lure; and

the template comprises a prompt that is configured to prompt a user of the second device to download a mock malicious mobile app.

25. The system of claim 17, wherein the template comprises a change your password phishing email that can be customized with the brand or branded content.

26. The system of claim 17, wherein the instructions to cause the cybersecurity training action to be sent to the second electronic device comprise instructions to cause the cybersecurity training action to be delivered via a lure that is a short-range communication device containing instructions that are configured to, when read by the second electronic device, cause the second electronic device to be directed to a mock malicious website or service, or to initiate a download of mock malware.

27. The system of claim 17, wherein:

the cybersecurity training action that is sent to the second electronic device comprises a lure; and

the lure comprises a mock malicious memory device containing an executable file that will activate if inserted into the first electronic device.

28. The system of claim 17, wherein:

the cybersecurity training action that is sent to the second electronic device comprises a lure; and

the lure comprises a barcode that, when scanned by the first electronic device, will cause the first electronic device to be directed to a mock malicious website or service, or to initiate a download of mock malware.

29. The system of claim 17, wherein the instructions to cause the cybersecurity training action to be sent to the second electronic device comprise instructions to cause the cybersecurity training action to be delivered via a mock malicious Wi-Fi access point that lures a user of second electronic device to connect the second electronic device to the Wi-Fi access point.

30. The system of claim 17, wherein:

the library of brand items also comprises, for at least some of the brand items in the library, information indicating whether the brand item has been authorized for use in one or more cybersecurity training actions by the owner of the brand item; and

the instructions to select at least one brand item that is available for use in the cybersecurity action comprise instructions to select a brand item that has been authorized for use in the cybersecurity training actions by the owner of the brand item.