Real-time mitigation of data access insider intrusions

• US 20050071642A1
• Filed: 09/24/2004
• Published: 03/31/2005
• Est. Priority Date: 09/26/2003
• Status: Active Grant

• Current Assignee: IBM Technology Corporation (International Business Machines Corporation)
• Original Assignee: Peter T. Smith, Pratyush Moghe
• Inventors: Moghe, Pratyush, Smith, Peter T.
• Granted Patent: US 7,673,147 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

The present invention provides a policy specification framework to enable an enterprise to specify a given insider attack using a holistic view of a given data access, as well as the means to specify and implement one or more intrusion mitigation methods in response to the detection of such an attack. The policy specification provides for the use of “anomaly” and “signature” attributes that capture sophisticated behavioral characteristics of illegitimate data access. When the attack occurs, a previously-defined administrator (or system-defined) mitigation response (e.g., verification, disconnect, de-provision, network re-routing, or the like) is then implemented.

Claims

1. A method of protecting an enterprise information asset against insider attack, comprising:

specifying a policy filter that defines (a) a given action that a trusted user may attempt to take with respect to a given enterprise information asset stored on a given enterprise data server, and (b) a given risk mitigation response that is to be taken upon detection of the given action;

monitoring a trusted user'"'"'s given data access with respect to the given enterprise data server;

analyzing the given data access against the policy filter;

determining whether the trusted user'"'"'s given data access is indicative of the given action as specified by the policy filter;

if the trusted user'"'"'s given data access is indicative of the given action as specified in the policy filter, taking the given mitigation response as specified in the policy filter.

2. The method as described in claim 1 wherein the given mitigation response interrogates the trusted user for at least one additional credential.

3. The method as described in claim 2 wherein the trusted user is interrogated directly and in real-time.

4. The method as described in claim 2 wherein the trusted user is interrogated indirectly and in real-time.

5. The method as described in claim 2 wherein the trusted user is interrogated indirectly and in other than real-time.

6. The method as described in claim 1 wherein the given mitigation response disconnects the trusted user from the enterprise data server.

7. The method as described in claim 1 wherein the given mitigation response de-provisions the trusted user from a given enterprise resource that otherwise enables the trusted user to obtain access to the enterprise information asset.

9. The method as described in claim 1 wherein the given mitigation response initiates a forensic evaluation of prior data accesses of the trusted user.

10. The method as described in claim 1 wherein the forensic evaluation is performed to facilitate determination of a given mitigation response.

11. The method as described in claim 1 wherein the given mitigation response quarantines the trusted user.

12. The method as described in claim 11 wherein the trusted user is quarantined by network re-routing.

8. The method as described in claim 8 wherein the given enterprise resource is a directory.

13. A system for protecting an enterprise information asset against insider attack, comprising:

at least one or more processors;

code executing on a given processor for generating a display interface through which an authorized entity using a given policy specification language specifies an insider attack;

code executing on a given processor that determines whether a trusted user'"'"'s given data access to an enterprise resource is indicative of the insider attack; and

code executing on a given processor and responsive to the insider attack for taking a given mitigation action.

14. The system as described in claim 13 further including code executing on a given processor for interrogating the trusted user for an additional authorization.

15. The system as described in claim 13 further including code executing on a given processor for disconnecting the trusted user from the enterprise resource.

16. The system as described in claim 13 further including code executing on a given processor for de-provisioning the trusted user from the enterprise resource.

17. The system as described in claim 13 further including code executing on a given processor for quarantining the trusted user from the enterprise by re-routing the trusted user off a given network.

18. The system as described in claim 13 further including code executing on a given processor for performing a forensic analysis of historical access data to determine the given mitigation action.