Back to results
US 11,379,608 B2Granted
Monitoring entity behavior using organization specific security policies
AssigneeForcepoint LLC
InventorBrandon L. Swafford
Life of this patent
Estimating the term…
Abstract
A system, method, and computer-readable medium are disclosed for enforcing security policies. Enforcing security policies includes monitoring electronically-observable user interactions of an entity, the electronically-observable user interactions comprising corresponding user behavior of the entity; converting the electronically-observable user interactions into electronic information representing the user behavior; and, applying an organization specific security policy based upon the electronic information representing the user behavior, the organization specific security policy comprising an automatically generated organization specific rule.
Claims17
A computer-implementable method for enforcing security policies, comprising:
- monitoring electronically-observable user interactions of an entity, the electronically-observable user interactions comprising corresponding user behavior of the entity, the monitoring being performed by a protected endpoint, the protected endpoint comprising an endpoint agent executing on an endpoint device, the endpoint agent comprising an entity-specific security policy feature pack;
- converting the electronically-observable user interactions into electronic information representing the user behavior;
- and,
- applying an organization specific security policy based upon the electronic information representing the user behavior, the organization specific security policy comprising an automatically generated organization specific rule, the organization specific security policy comprising an aggregation of a plurality of entity specific security policies, each of the plurality of entity specific security policies corresponding to a respective entity, each respective entity having a corresponding user profile, each corresponding user profile comprising a collection of information that uniquely describes an identify of the respective entity, the collection of information comprising a user profile attribute, a user behavior factor and a user mindset factor, the mindset factor comprising information used to determine a mental state of a user at a particular point in time, the organization specific security policy comprises a risk-adaptive security policy, the risk-adaptive security policy comprising a security policy implemented to be revised to adaptively remediate risk associated with a user behavior, the user behavior being represented via a plurality of risk-adaptive behavior factors, the plurality of risk-adaptive behavior factors comprising at least one user behavior factor and a user mindset factor;
- and,
- using the organization specific security policy to perform a security analytics operation, the security analytics operation identifying anomalous, abnormal, unexpected, or malicious user behavior, the security analytics operation being performed by a security analytics system, the security analytics system communicating with the protected endpoint via a network.
3 more elements
A system comprising:
- a processor;
- a data bus coupled to the processor;
- and
- a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
- monitoring electronically-observable user interactions of an entity, the electronically-observable user interactions comprising corresponding user behavior of the entity, the monitoring being performed by a protected endpoint, the protected endpoint comprising an endpoint agent executing on an endpoint device, the endpoint agent comprising an entity-specific security policy feature pack;
- converting the electronically-observable user interactions into electronic information representing the user behavior;
- and,
- applying an organization specific security policy based upon the electronic information representing the user behavior, the organization specific security policy comprising an automatically generated organization specific rule, the organization specific security policy comprising an aggregation of a plurality of entity specific security policies, each of the plurality of entity specific security policies corresponding to a respective entity, each respective entity having a corresponding user profile, each corresponding user profile comprising a collection of information that uniquely describes an identify of the respective entity, the collection of information comprising a user profile attribute, a user behavior factor and a user mindset factor, the mindset factor comprising information used to determine a mental state of a user at a particular point in time, the organization specific security policy comprises a risk-adaptive security policy, the risk-adaptive security policy comprising a security policy implemented to be revised to adaptively remediate risk associated with a user behavior, the user behavior being represented via a plurality of risk-adaptive behavior factors, the plurality of risk-adaptive behavior factors comprising at least one user behavior factor and a user mindset factor;
- and,
- using the organization specific security policy to perform a security analytics operation, the security analytics operation identifying anomalous, abnormal, unexpected, or malicious user behavior, the security analytics operation being performed by a security analytics system, the security analytics system communicating with the protected endpoint via a network.
7 more elements
A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
- monitoring electronically-observable user interactions of an entity, the electronically-observable user interactions comprising corresponding user behavior of the entity, the monitoring being performed by a protected endpoint, the protected endpoint comprising an endpoint agent executing on an endpoint device, the endpoint agent comprising an entity-specific security policy feature pack;
- converting the electronically-observable user interactions into electronic information representing the user behavior;
- and,
- applying an organization specific security policy based upon the electronic information representing the user behavior, the organization specific security policy comprising an automatically generated organization specific rule, the organization specific security policy comprising an aggregation of a plurality of entity specific security policies, each of the plurality of entity specific security policies corresponding to a respective entity, each respective entity having a corresponding user profile, each corresponding user profile comprising a collection of information that uniquely describes an identify of the respective entity, the collection of information comprising a user profile attribute, a user behavior factor and a user mindset factor, the mindset factor comprising information used to determine a mental state of a user at a particular point in time, the organization specific security policy comprises a risk-adaptive security policy, the risk-adaptive security policy comprising a security policy implemented to be revised to adaptively remediate risk associated with a user behavior, the user behavior being represented via a plurality of risk-adaptive behavior factors, the plurality of risk-adaptive behavior factors comprising at least one user behavior factor and a user mindset factor;
- and,
- using the organization specific security policy to perform a security analytics operation, the security analytics operation identifying anomalous, abnormal, unexpected, or malicious user behavior, the security analytics operation being performed by a security analytics system, the security analytics system communicating with the protected endpoint via a network.
3 more elements
Dependencies are inferred from the claim text.