US 10,652,264 B2Granted

Information security vulnerability assessment system

AssigneeBank of America Corporation

InventorDavid Michael Steele

Life of this patent

Estimating the term…

Loading patent…

Abstract

Embodiments of the invention are directed to systems, methods, and computer program products for real-time generation and deployment of specific user information security vulnerability levels based on vulnerability assessments for the user. The invention utilizes a two-component system to detect security vulnerabilities for a user, generate a coherent vulnerability level for the user in real-time, and provides user specific mitigation actions depending on each user vulnerability assessment. The first component of the system is an information threat assessment engine, which identifies and/or receives external and internal data regarding users to determine information security threats. The second component is an analytics engine, which is configured to generate vulnerability levels and specific mitigation actions for the user based on threat patterning.

Claims17

Dependent claims

A system for user specific information security vulnerability level generation, the system comprising:

a memory device with computer-readable program code stored thereon;
a communication device;
a printing device for printing resource distribution documents;
a processing device operatively coupled to the memory device and the communication device, wherein the processing device is configured to execute the computer-readable program code to:
receive authentication from a user for a user specific vulnerability assessment;
identify external data for the user, wherein the external data comprises security threat data for the user from an external data source, and wherein the external data is received from an external data source system;
identify internal data for the user, wherein the internal data comprises security threat data for the user from an internal data source;
determine the user specific vulnerability assessment comprising information security threats for the user based on the external data and the internal data;
calculate a vulnerability level for the user based on the information security threats;
present, via a secured interface, a real-time vulnerability level for the user upon user authentication into the secured interface and include user specific mitigation actions for the user to reduce vulnerability level;
and
distribute the real-time vulnerability level for the user to a third party for user application and authorization into a third party program.

9 more elements

A computer program product for user specific information security vulnerability level generation with at least one non-transitory computer-readable medium having computer-readable program code portions embodied therein, the computer-readable program code portions comprising:

an executable portion configured for receiving authentication from a user for a user specific vulnerability assessment;
an executable portion configured for identifying external data for the user, wherein the external data comprises security threat data for the user from an external data source, and wherein the external data is received from an external data source system;
an executable portion configured for identifying internal data for the user, wherein the internal data comprises security threat data for the user from an internal data source;
an executable portion configured for determining the user specific vulnerability assessment comprising information security threats for the user based on the external data and the internal data;
an executable portion configured for calculating a vulnerability level for the user based on the information security threats;
an executable portion configured for presenting, via a secured interface, a real-time vulnerability level for the user upon user authentication into the secured interface and include user specific mitigation actions for the user to reduce vulnerability level;
and
an executable portion configured for distributing the real-time vulnerability level for the user to a third party for user application and authorization into a third party program.

5 more elements

A computer-implemented method for user specific information security vulnerability level generation, the method comprising:

providing a computing system comprising a computer processing device and a non-transitory computer readable medium, where the computer readable medium comprises configured computer program instruction code, such that when said instruction code is operated by said computer processing device, said computer processing device performs the following operations:
receiving authentication from a user for a user specific vulnerability assessment;
identifying external data for the user, wherein the external data comprises security threat data for the user from an external data source, and wherein the external data is received from an external data source system;
identifying internal data for the user, wherein the internal data comprises security threat data for the user from an internal data source;
determining the user specific vulnerability assessment comprising information security threats for the user based on the external data and the internal data;
calculating a vulnerability level for the user based on the information security threats;
presenting, via a secured interface, a real-time vulnerability level for the user upon user authentication into the secured interface and include user specific mitigation actions for the user to reduce vulnerability level;
and
distributing the real-time vulnerability level for the user to a third party for user application and authorization into a third party program.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/826,979Filed 30 Nov 2017
Published: US 2019/0166153 A130 May 2019
Granted: 12 May 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/1433
For detecting or protecting against malicious traffic: vulnerability analysis
G06F 21/577
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…
G06F 21/6245
To a system of files or objects, e.g. local or distributed file system or database: protecting personal data, e.g. for financial or medical purposes
G06N 20/00
Machine learning