Back to results
US 11,636,213 B1Granted
System and methods for reducing an organization's cybersecurity risk based on modeling and segmentation of employees
AssigneeProofpoint, Inc.
InventorsDoron Asher Elgressy, David Robert Knight, Arthur Zavalkovsky
Life of this patent
Estimating the term…
Abstract
Systems, apparatuses, and methods for more effectively preparing for and responding to cybersecurity threats directed at people or at groups of people. A segmentation process is described that evaluates multiple characteristics of a person that may make them a potential target or that may make a cybersecurity attack on that person more likely to be successful. Based on the segmentation, a security analyst can apply an appropriate risk reduction or security protocol to each person or group of similarly situated people to reduce the likelihood of an attack and/or the likelihood of a successful attack.
Claims20
A method of reducing cybersecurity risk to an organization, comprising:
- for each person of a set of people in an organization,
- obtaining data regarding attempted cybersecurity attacks directed at the person;
- obtaining data regarding the person's access to privileged or confidential information;
- obtaining data regarding the person's cybersecurity training experience;
- processing the obtained data to generate a normalized measure representing each of a plurality of contributions to a cybersecurity risk for the person;
- combining one or more of the normalized measures to generate a total measure of the cybersecurity risk for the person for one or more risk categories, wherein the risk categories include Attacked Persons, Vulnerable Persons, and Privileged Persons;
- based on the total measure of the cybersecurity risk for the person for the risk categories of Attacked Persons, Privileged Persons, and Vulnerable Persons, determining if the person belongs to one or more sub-groups of Very Attacked People, Very Vulnerable People, and Very Privileged People;
- determining if the person belongs to one or more target groups formed from an intersection of two or more of the sub-groups of Very Attacked People, Very Vulnerable People, and Very Privileged People;
- generating a display or user interface showing a plurality of people in the organization in each of the risk categories of Attacked Persons, Vulnerable Persons, and Privileged Persons, the sub-groups of Very Attacked People, Very Vulnerable People, and Very Privileged People, and the one or more target groups formed from an intersection of two or more of the sub-groups;
- and
- for each of the plurality of people represented in the generated display or user interface
- receiving an input from a user identifying a specific cybersecurity process to apply to each of the plurality of people;
- and
- in response to the input received from the user, applying the specific cybersecurity process.
11 more elements
A system for reducing cybersecurity risk to an organization, comprising:
- at least one electronic processor;
- an electronic non-transitory data storage element including a set of computer-executable instructions that, when executed by the electronic processor, cause the system to
- for each person of a set of people in an organization,
- obtain data regarding attempted cybersecurity attacks directed at the person;
- obtain data regarding the person's access to privileged or confidential information;
- obtain data regarding the person's cybersecurity training experiences;
- process the obtained data to generate a normalized measure representing each of a plurality of contributions to a cybersecurity risk for the person;
- combine one or more of the normalized measures to generate a total measure of the cybersecurity risk for the person for each of one or more risk categories, wherein the risk categories include Attacked Persons, Vulnerable Persons, and Privileged Persons;
- based on the total measure of the cybersecurity risk for the person for the one or more risk categories of Attacked Persons, Privileged Persons, and Vulnerable Persons, determine if the person belongs to one or more sub-groups, wherein the sub-groups include Very Attacked People, Very Vulnerable People, and Very Privileged People;
- determine if the person belongs to one or more target groups formed from an intersection of two or more of the sub-groups of Very Attacked People, Very Vulnerable People, and Very Privileged People;
- generate a display or user interface showing a plurality of people in the organization in each of the risk categories of Attacked Persons, Vulnerable Persons, and Privileged Persons, the sub-groups of Very Attacked People, Very Vulnerable People, and Very Privileged People, and;
- for each of the plurality of people represented in the generated display or user interface
- receive an input from a user identifying a specific cybersecurity process to apply to each of the plurality of people;
- and
- in response to the input received from the user, apply the specific cybersecurity process.
12 more elements
Dependencies are inferred from the claim text.