# US 2021/0240836 A1 · System and method for securing electronic correspondence > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240836 A1 - Document ID: US20210240836A1 - Status: Published application - Kind: A1 - Application number: 17/050,493 - Filed: 2019-04-17 - Published: 2021-08-05 - Earliest claimed: 2018-04-27 - Assignees: Dcoya Ltd. - Applicants: Dcoya Ltd. - Inventors: Yariv HAZONY; Ivgeni Broitman; Asaf Kotsel - Web page: https://patentgrep.com/patent/US20210240836A1 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 11/3438: {monitoring of user actions (tracking the activity of the user H04L67/535)} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/71: to assure secure computing or processing of information - G09B 5/00: Electrically-operated educational appliances (working with questions and answers G09B7/00; simulators G09B9/00; advertising or displaying in general G09F) - G09B 7/00: Electrically-operated teaching apparatus or devices working with questions and answers (mechanically operated G09B3/00; computing arrangements G06F) - G09B 19/00: Teaching not covered by other main groups of this subclass (teaching or practice apparatus for gun-aiming or gun-laying F41G3/26) - H04L 51/212: using filtering or selective blocking - H04L 63/102: {Entity profiles} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06Q 10/107: Computer-aided management of electronic mailing [e-mailing] - H04L 51/02: using automatic reactions or user delegation, e.g. automatic replies or chatbot-generated messages - H04L 51/216: Handling conversation history, e.g. grouping of messages in sessions or threads - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G09B: EDUCATIONAL OR DEMONSTRATION APPLIANCES; APPLIANCES FOR TEACHING, OR COMMUNICATING WITH, THE BLIND, DEAF OR MUTE; MODELS; PLANETARIA; GLOBES; MAPS; DIAGRAMS (devices for psychotechnics or for testing reaction times A61B5/16; games, sports, amusements A63; projectors, projector screens G03B) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A system and method for training a user with respect to security of information may include monitoring interaction of a user with a user's computing device to update a user's information security profile and selecting, based on the profile and based on an event, to perform an action related to the user, the action selected such that is raises the awareness of the user to security of information. ## Claims ### Claim 1 A system comprising: a memory; and a controller adapted to: monitor interaction of a user with a user's computing device to update a user's information security profile; and select, based on the profile and based on an event, to perform an action related to the user, wherein the action is selected such that is raises the awareness of the user to security of information. ### Claim 2 (depends on 1) The system of claim 1, wherein the controller is further adapted to: receive, from an information security system (ISS), information related to an action taken by the user or by the ISS with relation to the user; and based on the action, perform at least one of: inform the user regarding the action, guide the user in responding to the action, force the user to perform an action and prevent the user from performing an action. ### Claim 3 (depends on 1) The system of claim 1, wherein the controller is further adapted to select, based on an event and based on the profile, a training session for the user. ### Claim 4 (depends on 1) The system of claim 1, wherein the controller is further adapted to present and monitor completion of a security training session, the training session designed to raise the user's awareness to security, and update the profile based a result of the session. ### Claim 5 (depends on 1) The system of claim 1, wherein the controller is further adapted to update the profile according to information obtained from an ISS. ### Claim 6 (depends on 1) The system of claim 1, wherein the controller is further adapted to intervene in an interaction of the user with the computing device based on at least one of: a violation of a security policy, information received, information about to be sent, a user's profile and a user's score ### Claim 7 (depends on 1) The system of claim 1, wherein the action is selected based on: a score included in the profile; and an event including at least one of: reception of a message and an interaction of a user with a computing device. ### Claim 8 (depends on 1) The system of claim 1, wherein the controller is further adapted to chat with a user and provide guidance related to security issues. ### Claim 9 (depends on 1) The system of claim 1, wherein the controller is further adapted to cause an ISS to modify rules related to the user. ### Claim 10 (depends on 1) The system of claim 1, wherein the controller is further adapted to remind the user to perform an action related to a security threat caused by an action of the user. ### Claim 11 (depends on 1) The system of claim 1, wherein the controller is further adapted to modify a graphical user interface (GUI) object in an application according to a security consideration. ### Claim 12 (depends on 1) The system of claim 1, wherein the controller is further adapted to establish a communication channel between at least one of: a security management personnel and a user, and an ISS and the user. ### Claim 13 (depends on 1) The system of claim 1, wherein the controller is included in the user's computing device. ### Claim 14 A method of securing electronic correspondence, the method comprising: monitoring interaction of a user with a user's computing device to update a user's information security profile; and selecting, based on the profile and based on an event, to perform an action related to the user, wherein the action is selected such that is raises the awareness of the user to security of information. ### Claim 15 (depends on 14) The method of claim 14, further comprising: receiving, from an information security system (ISS), information related to an action taken by the user or by the ISS with relation to the user; and based on the action, performing at least one of: informing the user regarding the action, guiding the user in responding to the action, forcing the user to perform an action and preventing the user from performing an action. ### Claim 16 (depends on 14) The method of claim 14, comprising, selecting, based on an event and based on the profile, a training session for the user. ### Claim 17 (depends on 14) The method of claim 14, comprising, presenting and monitoring completion of, a security training session, the training session designed to raise the user's awareness to security, and updating the profile based a result of the session. ### Claim 18 (depends on 14) The method of claim 14, comprising, updating the profile according to information obtained from an ISS. ### Claim 19 (depends on 14) The method of claim 14, comprising, intervening in an interaction of the user with the computing device based on at least one of: a violation of a security policy, information received by the user, information about to be sent by the user, a user's profile and a user's score. ### Claim 20 A method of increasing awareness of a user to security of information, the method comprising: monitoring interaction of a user with a user's computing device; identifying an action of a user as risky; selecting a training session for the user; and causing the user to complete the training session.