Correlating concerning behavior during an activity session with a security risk persona

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and
• a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• monitoring an entity, the monitoring observing at least one electronically-observable data source;
• deriving an observable based upon the monitoring of the electronically-observable data source;
• identifying a security related activity, the security related activity being based upon the observable from the electronic data source, the security related activity comprising a concerning behavior, the security related activity being enacted during an activity session;
• associating the security related activity enacted during an activity session with a security risk persona and a human-centric factor associated with the entity;
• analyzing the security related activity, the analyzing the security related activity using the security risk persona;
• and,
• performing a security operation in response to the analyzing the security related activity, the security operation being performed by at least one of an endpoint device and a security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system;
• and wherein
• the security risk persona is included within a human-centric risk modeling framework, the human-centric risk modeling framework enabling quantification of the human-centric factor associated with the entity, the human-centric factor comprising a motivation factor, a stressor factor and an organizational dynamics stressor factor, the human-centric factor having an associated effect on the entity, the motivation factor representing a user entity behavior that provides an indication of a motivation for enacting the user entity behavior, the stressor factor representing an issue influencing the user entity behavior, the organizational stressor factor representing an event occurring within an organization affecting the user entity behavior.

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

• monitoring an entity, the monitoring observing at least one electronically-observable data source;
• deriving an observable based upon the monitoring of the electronically-observable data source;
• identifying a security related activity, the security related activity being based upon the observable from the electronic data source, the security related activity comprising a concerning behavior, the security related activity being enacted during an activity session;
• associating the security related activity enacted during an activity session with a security risk persona and a human-centric factor associated with the entity;
• analyzing the security related activity, the analyzing the security related activity using the security risk persona;
• and,
• performing a security operation in response to the analyzing the security related activity, the security operation being performed by at least one of an endpoint device and a security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system;
• and wherein
• the security risk persona is included within a human-centric risk modeling framework, the human-centric risk modeling framework enabling quantification of the human-centric factor associated with the entity, the human-centric factor comprising a motivation factor, a stressor factor and an organizational dynamics stressor factor, the human-centric factor having an associated effect on the entity, the motivation factor representing a user entity behavior that provides an indication of a motivation for enacting the user entity behavior, the stressor factor representing an issue influencing the user entity behavior, the organizational stressor factor representing an event occurring within an organization affecting the user entity behavior.