METHOD AND APPARATUS FOR DATA SECURITY ANALYSIS OF DATA FLOWS

• US 20170032129A1
• Filed: 08/01/2016
• Published: 02/02/2017
• Est. Priority Date: 07/30/2015
• Status: Active Grant

• Current Assignee: Ior Analytics, LLC
• Original Assignee: Ior Analytics, LLC
• Inventors: LINDE, Matthew Michael, Kim, Daniel Jonghoon
• Granted Patent: US 10,198,582 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/067 Enterprise or organisation modelling

Abstract

A method and apparatus useful for data risk monitoring and management includes configuration and analysis of data flows to identify and assess risk and compliance to various regulatory standards and business practices. The evaluation of monitored data flows are then further used to identify potential security risks based on deviation from expected flows or compliant handling methods.

Claims

1. A method comprising:

determining a data flow configuration associated with a data element processed by a system, wherein the system comprises a plurality of processing nodes and wherein the data flow configuration indicates an expected sequence of the processing nodes that will interact with the data element;

monitoring an observed sequence of the plurality of processing nodes that are detected to process the data element; and

identifying a potential security issue when there is a deviation of the observed sequence from the expected sequence.

2. A method of claim 1, further comprising:

determining a data classification of the data element,

initiating the determining of the data flow configuration, the monitoring of the observed sequence, or the identifying of the potential security issue based on the data classification.

3. A method of claim 2, further comprising:

selecting the data flow configuration from among a set of potential data flow configurations based on the data classification.

4. A method of claim 1, further comprising:

determining a data compliance policy associated with the data element; and

selecting the data flow configuration from among a set of potential data flow configurations based on the data compliance policy.

5. A method of claim 4, wherein the data compliance policy is specified by a regulatory authority, a contractual authority, system authority, or a combination thereof.

6. A method of claim 1, wherein the data flow configuration is associated with a use configuration, and the identifying of the potential security issue is based on a difference between the use configuration of the data element and the use configuration of the plurality of processing nodes.

7. A method of claim 1, further comprising:

verifying and modifying the expected sequence based on a data flow attestation configuration.

8. A method of claim 7, wherein the data flow attestation configuration comprises an assignment of the verification to one or more personnel.

9. A method of claim 8, further comprising:

causing a presentation of a notification to the one or more personnel to complete the data flow attestation.

10. A method of claim 1, wherein the plurality of processing nodes of the system are representative of business entities.

11. A method of claim 1, further comprising:

presenting the observed sequence of the system as part of an enterprise-scale data flow display of all monitored sequences of the system.

12. An apparatus comprising:

at least one processor; and

at least one memory including computer program code for one or more programs, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following,

determine a data flow configuration associated with a data element processed by a system, wherein the system comprises a plurality of processing nodes and wherein the data flow configuration indicates an expected sequence of the processing nodes that will interact with the data element;

monitor an observed sequence of the plurality of processing nodes that are detected to process the data element; and

identify a potential security issue when there is a deviation of the observed sequence from the expected sequence.

13. An apparatus of claim 12, wherein the apparatus is further caused to:

determine a data classification of the data element,

initiate the determining of the data flow configuration, the monitoring of the observed sequence, or the identifying of the potential security issue based on the data classification.

14. An apparatus of claim 13, wherein the apparatus is further caused to:

select the data flow configuration from among a set of potential data flow configurations based on the data classification.

15. An apparatus of claim 12, wherein the apparatus is further caused to:

determine a data compliance policy associated with the data element; and

select the data flow configuration from among a set of potential data flow configurations based on the data compliance policy.

16. An apparatus of claim 15, wherein the data compliance policy is specified by a regulatory authority, a contractual authority, system authority, or a combination thereof.

17. An apparatus of claim 12, wherein the data flow configuration is associated with a use configuration, and the identifying of the potential security issue is based on a difference between the use configuration of the data element and the use configuration of the plurality of processing nodes.

18. An apparatus of claim 12, wherein the apparatus is further caused to:

verify and modify the expected sequence based on a data flow attestation configuration.

19. An apparatus of claim 18, wherein the data flow attestation configuration comprises an assignment of the verification to one or more personnel.

20. An apparatus of claim 19, wherein the apparatus is further caused to:

cause a presentation of a notification to the one or more personnel to complete the data flow attestation.

21. An apparatus of claim 12, wherein the plurality of processing nodes of the system are representative of business entities.

22. An apparatus of claim 12, wherein the apparatus is further caused to:

present the observed sequence of the system as part of an enterprise-scale data flow display of all monitored sequences of the system.