Mock attack cybersecurity training system and methods

• US 9,824,609 B2
• Filed: 12/23/2016
• Issued: 11/21/2017
• Est. Priority Date: 04/08/2011
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Wombat Security Technologies, Inc (Proofpoint Incorporated)
• Inventors: Sadeh-Koniecpol, Norman, Wescoe, Kurt, Brubaker, Jason, Hong, Jason
• Primary Examiner(s): Gishnock, Nikolai A
• Application Number:
  US15/389,506
• Publication Number:
  US 20170103674A1
• Time in Patent Office: 333 Days
• Field of Search: 726 11, 726 22, 726 23, 726 24, 726 25, 434118
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G09B 19/0053 Computers, e.g. programming
• CPC Class Codes: G09B 5/00 Electrically-operated educational appliances working with questions and answers G09B7/00; simulators G09B9/00; advertising or displaying in general G09F
• CPC Class Codes: G09B 5/02 with visual presentation of the material to be studied, e.g. using film strip
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

A system assesses the susceptibility of an electronic device user to a cybersecurity threat by identifying information relating to the user of an electronic device, selecting a mock attack, and causing the mock attack to be deployed to the user so that the user receives the mock attack in the user'"'"'s regular context of use of the electronic device. When a sensor detects a user action that the user has interacted with the electronic device in response to the mock attack, the system will record the sensed user action and use the sensed user action to determine the susceptibility of the user to a cybersecurity threat. In some embodiments, the lack of user action in response to a mock attack also may be used to determine the user'"'"'s susceptibility to a cybersecurity threat.

Claims

1. A computer-implemented method of assessing susceptibility of an electronic device user to a cybersecurity threat, the method comprising:

by one or more processors;

accessing identifying information relating to a user of an electronic device;

selecting a mock attack;

causing the mock attack to be deployed to the user so that the user receives the mock attack in the user'"'"'s regular context of use of the electronic device;

receiving, from a sensor, a sensed user action in response to the mock attack, wherein the sensed user action comprises a user interaction with the electronic device;

recording the sensed user action;

using the sensed user action to determine a susceptibility of the user to a cybersecurity threat; and

generating one or more records that include the identifying information relating to the user, the susceptibility of the user to the cybersecurity threat, and the sensed user action in response to the mock attack.

2. The method of claim 1, further comprising:

accessing a set of historical data for the user; and

when determining the susceptibility of the user to the cybersecurity threat, also using the historical data in the determining.

3. The method of claim 1, wherein:

using the sensed user action to determine the susceptibility of the user to the cybersecurity threat comprises determining whether the user repeated a particular action at least a threshold number of times.

4. The method of claim 1, wherein causing the mock attack to be deployed to the user in the user'"'"'s regular context of use of the electronic device comprises luring the user to use the electronic device with at least one of the following:

a mock malicious memory device;

a mock malicious short-range tag;

a mock malicious barcode;

a piece of mock malware;

or

a mock rogue, compromised or malfunctioning device or service.

5. The method of claim 1, wherein:

the mock attack comprises a network service or device that broadcasts an availability message; and

the sensed user action comprises a request to connect the electronic device to the network service or device.

6. The method of claim 1, wherein:

the mock attack comprises an attack that is configured to lure users to install fake malware; and

the sensed user action comprises a request to install fake malware on the electronic device.

7. The method of claim 1, further comprising:

determining that the susceptibility of the user to the cybersecurity threat satisfies a rule to implement a training intervention;

selecting a training intervention that corresponds to one or more actions of the user; and

causing the electronic device to present the selected training intervention to the user.

8. The method of claim 7, wherein:

using the sensed user action to determine the susceptibility of the user to the cybersecurity threat comprises using the sensed user action to identify a threat scenario for which the user is at risk; and

selecting the training intervention comprises;

identifying a collection of available training interventions that are relevant to the threat scenario, and

selecting from the collection, based on the identified threat scenario, the selected training intervention.

9. A computer-implemented method of assessing susceptibility of an electronic device user to a cybersecurity threat, the method comprising:

by one or more processors;

accessing identifying information relating to a user of an electronic device;

selecting a mock attack;

causing the mock attack to be deployed to the user so that the user receives the mock attack in the user'"'"'s regular context of use of the electronic device;

by a sensor, sensing whether there is a user action that comprises a user interaction with the electronic device in response to the mock attack;

detecting, by the sensor, a lack of the user action in response to the mock attack, wherein the user action comprises a user interaction with the electronic device;

using the lack of the user action to determine a susceptibility of the user to a cybersecurity threat; and

generating one or more records that include the identifying information relating to the user and the susceptibility of the user to the cybersecurity threat.

10. The method of claim 9, further comprising:

accessing a set of historical data for the user; and

when determining the susceptibility of the user to the cybersecurity threat, also using the historical data in the determining.

11. The method of claim 9, wherein causing the mock attack to be deployed to the user in the user'"'"'s regular context of use of the electronic device comprises luring the user to use the electronic device with at least one of the following:

a mock malicious memory device;

a mock malicious short-range tag;

a mock malicious barcode;

a piece of mock malware;

or

a mock rogue, compromised or malfunctioning device or service.

12. The method of claim 9, wherein:

the mock attack comprises a network service or device that broadcasts an availability message; and

the user action comprises a request to connect the electronic device to the network service or device.

13. The method of claim 9, wherein:

the mock attack comprises an attack that is configured to lure users to install fake malware; and

the user action comprises a request to install fake malware on the device.

14. The method of claim 9, further comprising:

determining that the susceptibility of the user to the cybersecurity threat satisfies a rule to implement a training intervention;

selecting a training intervention that corresponds to one or more actions of the user; and

causing the electronic device to present the selected training intervention to the user.

15. A computer-implemented method of providing cybersecurity training to a user of an electronic device, the method comprising:

by one or more processors;

selecting a mock attack;

causing the mock attack to be deployed to the user so that the user receives the mock attack in a regular context of use of the user;

receiving, from a sensor, a sensed user action in response to the mock attack; and

implementing a policy manager that;

uses the sensed user action to determine a susceptibility of the user to a cybersecurity threat;

based on the susceptibility of the user to the cybersecurity threat, selects a training intervention that corresponds to the sensed action; and

causes the selected training intervention to be presented to the user.

16. The method of claim 15, further comprising:

receiving historical data for the user of the electronic device;

when determining the susceptibility of the user to a cybersecurity threat, also using the historical data to do so.

17. The method of claim 15, wherein causing the mock attack comprises luring the user to use the electronic device with at least one of the following:

a mock malicious memory device;

a mock malicious short-range tag;

a mock malicious barcode;

a piece of mock malware;

or

a mock rogue, compromised or malfunctioning device or service.

18. The method of claim 15, wherein:

the mock attack comprises a network service or device that broadcasts an availability message; and

the sensed user action comprises a request to connect the electronic device to the network service or device.

19. The method of claim 15, wherein:

the mock attack comprises an attack that lures users to install fake malware; and

the sensed user action comprises a request to install fake malware on the device.