Method of and system for enterprise information asset protection through insider attack specification, monitoring and mitigation

• US 20050071643A1
• Filed: 09/24/2004
• Published: 03/31/2005
• Est. Priority Date: 09/26/2003
• Status: Active Grant

• Current Assignee: IBM Technology Corporation (International Business Machines Corporation)
• Original Assignee: IBM International Group BV (International Business Machines Corporation)
• Inventors: Moghe, Pratyush
• Granted Patent: US 8,880,893 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

The present invention provides a policy specification framework to enable an enterprise to specify a given insider attack using a holistic view of a given data access, as well as the means to specify and implement one or more intrusion mitigation methods in response to the detection of such an attack. The policy specification provides for the use of“anomaly” and “signature” attributes that capture sophisticated behavioral characteristics of illegitimate data access. When the attack occurs, a previously-defined administrator (or system-defined) mitigation response (e.g., verification, disconnect, de-provision, or the like) is then implemented.

Claims

1. Apparatus for protecting an enterprise data server against insider attack, comprising:

at least one processor;

code executable on a processor for generating a display interface through which an authorized entity using a given policy specification language specifies an insider attack, wherein the given policy specification language enables the authorized entity to specify at least policy filter that is associated with a given enterprise data server type and defines (a) a given action that a trusted user may attempt to take with respect to a given enterprise information asset stored on a given enterprise data server, and (b) a given response that is to be taken upon detection of the given action;

code executable on a processor to monitor a trusted user'"'"'s given data access against a set of one or more policy filters;

code executable by a processor to analyze the trusted user'"'"'s given data access against the set of one or more policy filters;

code executable by a processor to determine whether the trusted user'"'"'s given data access is indicative of a given action as specified by a given policy filter in the set of policy filters; and

code executable by a processor if the trusted user'"'"'s given data access is indicative of a given action as specified by the given policy filter for taking the given response specified by the policy filter.

2. The apparatus as described in claim 1 wherein the given response generates an alert event and the apparatus further includes code executable by a processor for storing the audit event.

3. The apparatus as described in claim 1 wherein the given response initiates a given attack mitigation and the apparatus further includes code executable by a processor for performing a given risk mitigation function.

4. The apparatus as described in claim 1 wherein the policy language specification enables a given data access operation to be specified against a particular content string or a set of one or more addresses associated with a given information asset.

5. The apparatus as described in claim 1 wherein the monitor code understands one or more different data access protocols.

6. The apparatus as described in claim 1 wherein the monitor code monitors the trusted user'"'"'s given data access promiscuously.

7. The apparatus as described in claim 1 wherein the monitor code monitors a log of the trusted user'"'"'s given data access.

8. The system as described in claim 1 wherein the display interface includes a set of controls that enable the authorized entity to specify the policy filter, the given response, and policy metadata.

9. A method of protecting an enterprise information asset against insider attack, comprising:

specifying a policy filter that defines a given action that a trusted user may attempt to take with respect to a given enterprise information asset stored on a given enterprise data server;

monitoring a trusted user'"'"'s given data access with respect to the given enterprise data server;

analyzing the given data access against the policy filter;

determining whether the trusted user'"'"'s given data access is indicative of the given action as specified by the policy filter;

if the trusted user'"'"'s given data access is indicative of the given action as specified in the policy filter, taking a given action.

10. The method as described in claim 9 wherein the given action is a mitigation action.

11. The method as described in claim 9 wherein the given action stores an audit event.

12. The method as described in claim 9 wherein the trusted user'"'"'s given data access is monitored promiscuously or by evaluating a log.

13. The method as described in claim 9 wherein the trusted user'"'"'s given data access is monitored for given content patterns as defined by the policy filter.

14. The method as described in claim 9 wherein the trusted user'"'"'s given data access is monitored for given content containers as defined by the policy filter.

15. A system for protecting an enterprise information asset against insider attack, comprising:

at least one or more processors;

code executing on a given processor for generating a display interface through which an authorized entity using a given policy specification language specifies an insider attack;

code executing on a given processor that determines whether a trusted user'"'"'s given data access to an enterprise resource is indicative of the insider attack; and

code executing on a given processor and responsive to the insider attack for taking a given mitigation action.