Context-Aware Cybersecurity Training Systems, Apparatuses, and Methods
A system assesses the susceptibility of an electronic device user to a cybersecurity threat by sensing a user action with respect to the electronic device. The system maps the sensed data to a training needs model to determine whether the sensed data corresponds to a pattern associated with a threat scenario in the training needs model. When the system determines that the sensed data corresponds to a pattern associated with a threat scenario in the training needs model, identify a cybersecurity threat scenario for which the user is at risk, and use the training needs model to estimate susceptibility of the user to the cybersecurity threat scenario.
This patent document is a continuation of U.S. patent application Ser. No. 15/418,867, filed Jan. 30, 2017 (“the '867 Application’). The '867 Application is a continuation of U.S. patent application Ser. No. 14/216,002 (”the '002 Application’), filed Mar. 17, 2014, which in turn claims priority to U.S. Provisional Patent Application No. 61/793,011, filed Mar. 15, 2013. The '002 Application also claims priority to, and is a continuation-in-part of U.S. patent application No. 13/442,587 (“the '587 Application”), filed Apr. 9, 2012, which in turn claims priority to: (i) U.S. Provisional Patent Application No. 61/473,384, filed Apr. 8, 2011; and (ii) U.S. Provisional Patent Application No. 61/473,366, filed Apr. 8, 2011. The '002 Application also claims priority to, and is a continuation-in-part of, U.S. patent application Ser. No. 13/832,070, filed Mar. 15, 2013, which is a continuation of the '587 Application and the provisional applications listed above.
This document fully incorporates each of the patent applications listed above by reference.
BACKGROUNDThis document pertains generally to context-aware cybersecurity training and, particularly to training systems, apparatuses, and methods that select and provide cybersecurity training to a user based on action of a user.
Computer-based training systems and other forms of electronically supported learning and teaching (generically referred to as e-Learning systems) have traditionally relied on one-size-fits all training material, where the same collection of modules has to be taken by everyone. In addition, cybersecurity training has traditionally been delivered to users in the context of face-to-face lectures, training manuals, and software training modules, including interactive training modules. The benefits of these traditional cybersecurity training methods have often proven to be limited. This is in great part because this training is often abstract and delivered out of context.
This document describes methods and systems that address at least some of the issues described above, or additional issues.
SUMMARYIn an embodiment, a system that includes one or more processors provides cybersecurity training to one or more electronic device users. The system does this by accessing identifying information relating to a user of an electronic device. The system may select a mock attack; cause the mock attack to be delivered to a user of the electronic device via the electronic device in the user's regular context of use of the electronic device; sense an action (or lack thereof) of the user in a response to the mock attack; and use the sensed action to determine a susceptibility of the user to a cybersecurity threat. The system may also determine that the user should receive a training intervention; and select a training intervention from a set of at least one training intervention and delivering the selected training intervention to the user.
In various embodiments, causing the mock attack situation to be delivered to the user via the device in the user's regular context of use of the device may include luring the user to use the device to interact with any of the following mock attacks: a mock rogue wireless service; a mock malicious message; a mock malicious memory device; a mock malicious short-range tag; a mock malicious barcode; a mock social networking attack; a piece of mock malware; a mock malicious URL; or a mock rogue, compromised or malfunctioning device or service. For example, if the mock attack situation comprises a wireless service such as a wireless local area network service, a wireless personal area network service or a near field communication service, the system may detect a request to connect the device to the wireless service. If the mock attack situation comprises a network service or device that broadcasts an availability message, the system may detect a request to connect the electronic device to the network service or device. If the mock attack situation comprises an attack that lures users to install fake malware, the system may detect a request to install the fake malware on the device.
Optionally, the sensed action may include receipt of identifying information in response to the mock attack situation. If so, then when using the sensed action to determine whether the user should receive a training intervention the system may use the received identifying information in the response to determine whether the response originates from a registered user, and only deliver the selected training intervention if the response originates from the registered user. As another option, the sensed action may include receipt of identifying information in response to the mock attack situation. If so, then when using the sensed action to determine whether the user should receive a training intervention the system may use the received identifying information in the response to determine whether the response originates from a device that is a known device, and only deliver the selected training intervention if the response originates from a device that is a known device. In some embodiments, the system may determine both (i) whether the response originates from a user who is a registered user and (ii) whether the response originates from a device that is an approved device. If so, the system may deliver the selected training intervention if the response originates from a registered user who is not using an approved device.
In some embodiments, determining whether the user should receive a training intervention may include determining whether the user has responded to at least a threshold number of mock attack situations; or determining whether the user has performed a triggering action in response to the mock attack situation.
In some embodiments, selecting the training intervention may include using the sensed action to identify a threat scenario for which the user is at risk; identifying a collection of available training interventions that are relevant to the threat scenario; and selecting from the collection, based on the identified threat scenario, the training intervention to be delivered to the user.
If the mock attack situation comprises a mock social engineering call, the system may detect whether the user has provided sensitive information in response to the mock social engineering call, or whether the user has initiated some other activity placing the user or an organization associated with the user at risk. If the mock attack situation comprises delivering a mock malicious memory device to the user, the system may detect that the user has taken one or more of the following actions: connected the memory device to an electronic device, opened a file stored on the memory device, or provided the memory device to another person.
In an alternate embodiment, a system provides cybersecurity training to a user by: selecting a mock attack situation for a user, wherein the mock attack situation requires the user to be within a vicinity of a location to receive the mock attack situation; identifying an area within which the user is likely to be; causing the mock attack situation to be deployed in the area; after the user comes within the vicinity of the area, sensing an action of the user in response to the mock attack situation; based on the action, determining whether the user should receive a training intervention; if so, selecting a relevant training intervention from a set of one or more training interventions; and delivering the selected training intervention to the user.
Examples of mock attack situations include a wireless service that includes a Wi-Fi network, in which case the sensed action may include a request to connect the device to the Wi-Fi network. As another example, the mock attack situation may include a near field communication device that broadcasts an availability message, in which case the sensed action may include a request to connect the device to the near field communication device. As another example, the mock attack situation may include a barcode that, when scanned, will connect a device to a mock malicious URL. In this case, the sensed action may include indicia that the user has used a device to scan the barcode and requested to connect the device to the mock malicious URL.
Other embodiments, which may include one or more parts of the systems or methods described above, are also contemplated, and may thus have a broader or different scope. Thus, the embodiments in this Summary are mere examples, and are not intended to limit or define the scope of the invention or claims.
Accordingly, the methods and systems described in this document provide solutions to various shortcomings of prior training systems and methods. Other details, features, and advantages will become further apparent in the following detailed description.
The accompanying drawings, which are incorporated herein and constitute part of this specification, and wherein like reference numerals are used to designate like components, include one or more embodiments of the invention and, together with a general description given above and a detailed description given below, serve to disclose principles of embodiments of behavior sensitive training.
This document describes various embodiments involving cybersecurity training methods and systems based on mock attacks. It will be appreciated that these embodiments and implementations are illustrative and various aspects of the invention may have applicability beyond the specifically described contexts. Furthermore, it is to be understood that these embodiments and implementations are not limited to the particular compositions, methodologies, or protocols described, as these may vary. The terminology used in the following description is for the purpose of illustrating the particular versions or embodiments only, and is not intended to limit their scope in the present disclosure which will be limited only by the appended claims.
Throughout the specification, reference to “one embodiment,” “an embodiment,” or “some embodiments” means that a particular described feature, structure, or characteristic is included in at least one embodiment. Thus appearances of the phrases “in one embodiment,” “in an embodiment,” or “in some embodiments” in various places throughout this specification are not necessarily all referring to the same embodiment. Those skilled in the art will recognize that the various embodiments can be practiced without one or more of the specific details or with other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or not described in detail to avoid obscuring aspects of the embodiments. References to “or” are furthermore intended as inclusive, so “or” may indicate one or another of the ored terms or more than one ored term.
For the purposes of this document, the terms “electronic device” and “computing device” interchangeably refer to a device or system of one or more devices that includes at least one processor and non-transitory, computer-readable memory. The memory may contain programming instructions that, when executed by the processor, cause the device to perform one or more operations according to the programming instructions. Examples of computing devices include personal computers, gaming systems, televisions, wearable electronic devices (such as smart watches), implantable electronic devices, and portable electronic devices such as smartphones, personal digital assistants, cameras, tablet computers, laptop computers, global positioning service (GPS) navigation devices, media players and the like. Where appropriate for the context, the term “electronic device” also may refer to a software application configured to operate on an electronic device, or firmware that is installed in an electronic device.
This document describes computer based training systems that may enable an administrator to trigger, or may allow the system to sense, use activity or behavior information in combination with user needs models, namely models of how critical it is for users engaging in these particular activities and behaviors to be knowledgeable of and proficient in different topics or training areas. The systems and methods may selectively prioritize those areas where the learner needs to be trained and selectively identify conditions where delivery of the training is likely to be most effective. That level of customization may be particularly valuable in domains where training content is vast or opportunities for training are limited (e.g. limited time), and where the training required by individual users varies based on their activities and behaviors. Identifying training needs based on static information (e.g. based solely on the department an employee works for, or his/her level of education) is often insufficient in these domains. Sensing activities, behaviors, or other contextual attributes can help better target training and mitigate consequences associated with undesirable behaviors.
In some embodiments, the methods and systems described below may sense user behavior and activity, such as a user response to mock attacks to determine user susceptibility to different types of cybersecurity threats and selectively identify training interventions that will be presented to individual users. The ability to tailor the cybersecurity training interventions presented to different users based on their susceptibility to different threats makes it possible to make better use of users' limited attention span when it comes to receiving cybersecurity training. This can be especially valuable as the number and types of threats to users can potentially be exposed to is large and continues to grow.
Various embodiments of context-aware training are directed to apparatuses, systems, and methods performing context-aware training. It will be appreciated by those skilled in the art, however, that a computer system may be assembled from any combination of devices with embedded processing capability, for example, computer, smart phone, tablet or other devices, including mobile or pervasive computing devices or appliances, electromechanical devices, and the like. The computer system can be configured to identify training interventions (or “training actions”) relevant to individual users and push those training interventions to users, both pro-actively (in anticipation of future needs) or reactively (in response to a need as it arises).
A training intervention can take many different forms, such as an interactive software training module, a training video, training games or other multimedia training content delivered to the content through one or more output devices. It may be delivered in one or more installments, including installments that may only be delivered subject to the sensing of an action or lack thereof by a user (e.g., a mock attack intended to sense a user's susceptibility to a particular threat scenario, which may be conditionally followed by a just-in-time training message and/or the assignment of a training module to a user). Training interventions may be provided as soon as a particular event is sensed (e.g., a just-in-time training intervention) or may be provided for later delivery to a user, such as the assignment of a software training module or a training activity that has to be completed by a certain date. A training intervention may include multiple iterations such as taking an interactive training module until one reaches a certain level of proficiency.
A just-in-time training intervention should not be confused with a warning of an event that is about to happen. In contrast to a warning which focuses on reducing risk associated with a situation that is at hand or about to occur (e.g., a user about to initiate a dangerous action), a training intervention is intended to also impart the user with some tips, best practices principles or other knowledge likely to help the user from repeating the same mistake or engage in the same risky behavior in the future. Simply telling the user that he is about to be put at risk or telling him to not do something in a one-off manner does not equate to a training intervention.
Numerous specific details are set forth in the specification and illustrated in the accompanying drawings to provide an understanding of the overall structure, function, manufacture, and use of embodiments of context-aware training. It will be understood by those skilled in the art, however, that the invention may be practiced without the specific details provided in the described embodiments. In other instances, well-known operations, components, and elements have not been described in detail so as not to obscure the embodiments described in the specification. Those of ordinary skill in the art will understand that the embodiments described and illustrated herein are non-limiting examples, and thus it can be appreciated that the specific structural and functional details disclosed herein may be representative and do not necessarily limit the scope of the embodiments, the scope of which is defined by the appended claims.
The one or more sensors 14 monitor one or more aspects of a user's behavior or activities (“user actions”). Those user actions may include sensing the behavior of people other than the user (regardless of whether they are a user of the system), the behavior of other entities (e.g. organisms, organization, the environment) with which a given user interacts (e.g. sensing how they respond to actions by the user), and other relevant contextual attributes. Those sensors 2 as well as other elements of the training system may be operated by one or more entities and may be deployed across a wide range of geographies, including different jurisdictional boundaries. The sensors may be part of the system, or the system may rely on external sensors and simply analyze data that it directly or indirectly received from the sensors.
The system may receive user behavior or activity data 15 and record that data over time in one or more data storage devices 1012. For example, the data may include relevant statistics relating to the user's behavior or activity over a period of time as received from the sensors. Those relevant statistics may include, for example, frequency of certain activities, frequency of certain behaviors, deviations from relevant baselines, and relevant trends.
The system may collect (as data received from the sensors) user behavior or activity data 15. The data may further be used in combination with historical user training data 16 which may be stored in one or more data storage devices and may include data related to the training one or more users have taken in the past. Historical user training data 16 may include information including when, and how well one or more users performed in prior training or assessments. For example, static user profiles 17 which may include a role of one or more individual user in the organization, their education levels, or demographic information for example, and may be stored in one or more data storage devices, may be used in combination with the historic user training data.
The system may store one or more user training needs models 18 in one or more data storage devices. A training needs model can include data and/or a rule set that the system may apply to correlate one or more behaviors or activities with training that is relevant to those behaviors or activities. User training needs models 18 may be qualitative or quantitative in nature, and may include a mixture of both qualitative and quantitative aspects. Training needs models may vary in complexity, ranging from simple “if-then” rules, for example, that map patterns of sensed data with training content typically required by people whose activity or behavior matches a given pattern (e.g., “if the user falls for a mock malicious barcode attack, select a training intervention that immediately teaches the user how to protect himself against malicious barcode attacks”, or “if the user connects a mock malicious USB memory stick to his laptop and opens a mock malicious file stored on the USB, then immediately pop up a just-in-time training intervention, and enroll the user for later, more in-depth training on malicious memory devices”), to more complex quantitative models. An example of a more complex model may take into account considerations such as the probability that a user requires some type of training, the time it takes to take the training, the relative effectiveness of available training modules in addressing a given training need, the type of training a given user has taken in the past, the amount of time available to train the user and more. The system may include training needs models that are customized or unique to a user or group of users, or the system may include standard training needs models that it may apply to any user. An example of this is described below in the context of
The system may implement a policy manager 19, which may include computer-readable instructions to analyze user behavior data 15 subject to a relevant set of rules or other appropriate logic. The policy manager may use additional data such as: (a) historical user training data 16 for the user, other similar users, or both; or (b) static profile data 17 such as the role of the user and the education level of the user. Based on its analysis, the policy manager 19 may select one or more training interventions from an extensible collection of training intervention modules 22 (thereby implementing “context-aware” training functionality), or it may initiate activities aimed at collecting additional data about one or more users such as estimating their training needs in different areas through the creation of mock situations, the assignment of quizzes, or some other available option. The policy manager 19 may perform its analysis in light of one or more relevant training needs models 18. The system may then generate one or more instructions, commands or other outputs that cause selected training interventions 23 to be pushed or provided to the user 24. This can range from (i) accessing one or more training interventions, optionally customizing them, and eventually sending them to one or more output devices for delivery or presentation to the user, to (ii) assigning a training module to a user in the system, or even (iii) activating a semi-automated process that involves the delivery of a training message to a user (e.g. scheduling someone for a face-to-face training meeting on a particular topic).
Training content data 20 may be organized in the form of an extensible collection of training interventions 22, including any relevant training metadata 21. Alternatively, it may consist of a fixed set of training interventions, possibly even just one type of training intervention. A collection of training interventions 22 may range from very short training interventions intended to be delivered in a just-in-time fashion, to longer, more extensive training modules that users may be encouraged or required to take within a predetermined period of time. Training interventions 22 along with relevant training meta-data 21 may be stored in one or more data storage devices. Relevant training meta-data 21 for a training intervention may include information about the training needs the training intervention is designed to address, the format in which the training intervention can be delivered, the amount of time the training intervention typically requires, estimated effectiveness of the training intervention (possibly across all users or possibly for different subsets of users based on considerations such as level of education, age, gender, prior training to which the users have been exposed) and other relevant considerations. The training meta-data 21 may include annotations and those annotations may be used by a policy manager 21 to select training content that is most appropriate for one or more users and when to provide that training content to the user or user group. Some training interventions may also be customizable based on relevant contextual information, such as the activities the user is engaged in, time available to train the user, available devices to deliver the content, preferred user language, demographic information and other contextual information. In the cybersecurity training domain where a user's time is limited and there is an increasingly vast amount of cybersecurity best practices and strategies to which the user should ideally be exposed, the policy manager 19 may be able to use its input to identify and possibly prioritize one or more training interventions 22 in a way that will minimize, or at least help reduce, the chances users fall prey to those threats to which they are most susceptible based on their activities, behavior, prior training history and/or other relevant contextual attributes.
The policy manager 19 may operate autonomously or according to a mixed initiative mode. In a mixed initiative mode, a system administrator (e.g. a security analyst, a member of human resources in charge of training, or some other role in an organization) uses an administrator client 1014 to interact with the policy manager. In the mixed initiative mode, the system administrator may review results of the analysis conducted by the policy manager 19 and select one or more training interventions to address those training needs for which one or more users are at a particularly high risk. In that embodiment, the system administrator could launch a training campaign based on a special purpose cartoon to train all those employees who are scheduled to take their corporate laptops out of the country in the next two weeks because, based on the system's training needs model, those employees have been identified as being at a particularly high risk for laptop-related threat scenarios by the analysis conducted by the policy manager 19.
The collection of training interventions can change over time. For example, the system may include a user interface that enables an administrator to add, delete, or modify some or all the training interventions. The system may receive training interventions from different sources including, for example, corporate training developed in-house, external training interventions provided by vendors, training interventions obtained via personal subscriptions, and training interventions offered by service providers such as a doctor, a dietician, or a health club. In addition to the possibility that training interventions may vary over time, available sensors and other sources of contextual information may also vary over time. For example, a user may acquire a new mobile phone with additional sensors, a user may download a Mobile Device Management (MDM) client on his mobile phone, new data about the user may be collected by a new source, and a new source of data may become able to interface with the context-aware training system.
Sensed data about user behavior and activities can include activities conducted in cyber space, activities in the physical world or a combination thereof. Sensed data may include any activity or behavior that can be tracked, observed, or recorded in some manner, for example, driving behavior, physical, mental and social health-related activities and habits, professional activities, social activities, etc. Sensed data may also include data relating to the behavior of people (not necessarily users of the system) with whom the user interacts in some manner. For example, sensed data may include responses received by the user from people, organisms, objects, surrounding elements or other entities with whom the user interacts, whether directly or indirectly. Activities sensed may include general usage activities such as using a laptop, phone, tablet or other mobile electronic device having wireless data communication activity; or using a particular mobile electronic device such as a company-issued device. In addition, activities sensed may include more specific applications using the device listed above, such as downloading software or installing a memory device containing software, connecting to a wireless network, connecting to a short-range or near-field communication-enabled device, replying to an SMS message, placing or receiving a phone call using certain technology, or other activities.
Sensed data may also be provided by a system administrator via an administrator client, or retrieved from a data set containing profile and/or sensed activity or behavior data about the user. An administrator client may be software, or hardware that is running software, that supports a user interface by which an administrator may add or modify data or parameters relevant to the system (e.g. training needs models, parameters controlling the policy manager's logic), or may be able to review, edit and customize other parts of the system such as training interventions, including mock attacks, selected or recommended by the system. Sensed data may also include historical user training data or data obtained from other sources of information such as a corporate system with information about the scheduled deployment of smart phones in the enterprise. The latter sensed data, when processed by the policy manager 19 based on training needs models, can help anticipate the need to train employees in the area of smart phone security by different dates and can result in the assignment of smart phone security training interventions to different employees on different dates.
One or more sensors 14 can include one or more devices, artifacts or other sources of information. For example, sensors 14 can include hardware, software, electromechanical devices, bio-sensory devices, and sources of information provided by third parties. Sensors 14 can be used to sense one or more aspects of a user's activities or behavior, whether in the context of routine activities or in response to artificially created situations. The sensors may detect various actions of a user in response to a mock attack situation, such as the security of the user's communication network connection, whether the user is downloading an attachment or installing an application, the user's browsing history, and other data.
Examples of mock attack situations that the system may select and help deliver include:
-
- i. sending a mock malicious message (e.g., SMS, MMS, instant message, in-channel message delivered by a service such as a social networking site, or a message delivered using some other messaging technology such as WhatsApp) to a user (e.g., a mock malicious message with a mock malicious URL or a mock malicious attachment, or a mock malicious phone number, or a mock request for sensitive information);
- ii. a mock social networking attack involving a mock malicious post or update such as a post or update containing a mock malicious URL (e.g., a URL for a mock malicious website that prompts the user to enter sensitive information or exposes the user's device to mock malware) including a mock malicious URL that relies on one more levels of redirection, mock malicious attachment (e.g., a mock malicious picture, video, audio clip), a mock malicious phone number, a mock malicious barcode (e.g., QR Code®) that when read by a barcode scanner causes the computing device to access or download mock malware, a mock malicious post enticing a user to perform an activity that puts him, others, his organization or his country at risk;
- iii. giving a mock social engineering call to a user (including using a computer system to automatically place the phone call and interact with the user through an automated menu or some automated dialogue functionality such as Interactive Voice Recognition technology, multi-modal interactive technology, voice over Internet protocol (VOIP) technology, automated speech recognition technology, some other automated dialogue functionality) with the call requesting the user to provide sensitive information or to initiate a possibly sensitive activity (e.g. granting someone access to a resource, resetting someone's password, telling or requesting a colleague to do something, sending information to a colleague, installing malicious code, entering erroneous information in a computer system, evacuating a building in response to a mock malicious alert), instructing a colleague to ignore a warning, enticing someone to spread false information, or generally engaging in any other activity that could compromise the user's security or reputation, that of his organization or his country or that of some other people, organization or country;
- iv. leaving a mock malicious memory device such as a universal serial bus (USB) storage device on which mock malware at one or more locations where a user may be lured to pick up the device and plug it into a computer, directly giving or sending a USB or other memory device on which mock malware is stored to users to plug into their computer, dropping at one or more locations (e.g., a company cafeteria, booth at a tradeshow) some other portable memory device such as a DVD or an SD card with mock malware for users to possibly pick up and access from one of their computers, directly giving or sending some other portable memory device such as a DVD or an SD card with mock malware to users to access from one of their computers;
- v. placing a mock malicious barcode (such as a quick-response QR Code® or other matrix code) or some other type of bar code on an object such as a poster or wall so that the code, when scanned by a mobile electronic device or some other computer device, causes the device to be directed to a mock phishing website, initiate the download of mock malware (e.g., a mock malicious software app) on that computer device, connect the device to a mock malicious service, or contributes to the delivery of a mock attack on another user;
- vi. placing mock malicious short range tags such as mock malicious near field communication (NFC) or radio frequency identification (RFID) tags, or equivalent tags on objects with the tags when read by a mobile device or some other computer device, causing the device to be directed to a mock phishing website or a mock malicious service, initiating the download of mock malware on the device, demonstrating to users how such tags could expose them to other risks, or contributing to the delivery of a mock attack on another user;
- vii. exposing a user to a piece of mock malware such as placing a mock malicious app in an app store (possibly a mock app store or a mock malicious app store link), or file transfer site (or mock transfer site) and providing the user with a link or other means to entice the user to obtain and download the mock malware (such as by displaying a message inviting the user to obtain what is described as antivirus software, but what instead is fake malicious software, or enticing the user to download a new game app), or distributing mock malware through various means such as using mock malicious memory devices or using mock malicious bar codes or mock malicious URLs as already described above;
- viii. deploying a mock rogue wireless service such as a mock rogue Wi-Fi access point or mock malicious short range communication service (e.g. mock Bluetooth pairing) to lure users to connect via these mock rogue access points or communication services (e.g. by deploying such mock rogue services on company premises, near a coffee shop where employees of a company often go, or in an airport lounge;
- ix. deploying some other mock rogue, compromised or malfunctioning device or service such as a mock compromised keypad or some other mock rogue, compromised or malfunctioning authentication or access granting device or service (e.g. mock malfunctioning electronic lock) that a well-trained user should be able to spot and possibly report; mock unapproved hardware that could be used by an attacker to obtain sensitive information or sensitive access (e.g. mock spying camera or microphone that a well-trained user should be able to spot and report), mock rogue jamming equipment that a well-trained user should report, mock malfunctioning access device, etc.;
- x. using some other mock attack to entice (i.e., lure) users to do any of the following: access mock malicious websites; install mock malware on one of their computer devices; open mock malicious message attachments; disclose sensitive or dangerous information in a mock context; engage in a mock context in some other activity that has the potential of putting them, their organization, their country, others, other organizations or other countries at risk or of damaging their reputation; fail to engage in a mock context in some activity that, if not implemented, could have similarly deleterious consequences; or
- xi. repurposing an actual attack by making it harmless (e.g. replacing a poster that includes a malicious QR Code with an identical poster that includes a mock malicious QR Code, replacing a malicious attachment in an SMS message with a mock malicious attachment) and using the resulting attack as a mock attack to estimate the user's vulnerability to similar attacks.
Examples of how an administrative user may select, or the system may select and implement, a mock attack situation will be described below.
Examples of behavior or activity sensors 14 in the cybersecurity training domain include sensors that detect attachments in emails sent or received by a user, sensors to determine whether one or more users access different services over secure connections, sensors to identify the number, type and/or identity of applications installed on a user's mobile phone, sensors to track the physical locations that a user visits, sensors to keep track of the URLs that a user visits. Some sensors 14 can also include, for instance, sensors to detect USB key usage, record browsing history, identify Bluetooth headset use, sensors that detect the number or types of emails received, sensors that inspect the content of emails, and sensors that track the physical location of users. Sensors 14 can also include Mobile Device Management (MDM) clients and MDM infrastructure or Data Leakage Prevention (DLP) functionality, as well as data obtained from an MDM system, DLP system, firewall system, email filtering system, browsers, network proxies, or other types infrastructure components that can be used to monitor user activities and behaviors as well as other relevant contextual attributes (e.g. types of websites a user visits, emails they receive, phone numbers they call or receive calls from).
The sensors 14 can be embedded in or interface with smart phones, laptop computers, desktops, tablets, e-readers, body parts, or any other devices, appliances or elements of the user's local or global environment (e.g. smart home, smart car, smart office, or other mobile or pervasive computing device or appliance, including medical devices, surveillance cameras, and other environmental sensors). A sensor 14 may include a data storage device or processor, for example in microprocessor form, and can obtain data provided by the user, by people other than the user, by organizations, or by entities including colleagues, friends, family members, strangers, doctors. A sensor 14 may alternately or in addition obtain data provided by systems (including data aggregated and synthesized from multiple sources, including aerial sensors, space-based sensors, implanted devices, and medical devices). For example, a sensor 14 may sense calendar information, status updates on social networks, and credit card transactions and can sense information or actions obtained through video surveillance. Some sensors 14 may also sense a combination of data. Some sensors 14 may also sense that the user has fallen for a mock attack, including any of the mock attacks identified above.
The system may receive and analyze data from any or all of such sensors and use the data to determine whether the user is at risk of a threat scenario. Examples of how the system may receive and analyze sensor data will be described in more detail below. As an example of how the system may sense data, if the user is provided a memory device on which an executable fake malware file is stored, when the user uses the device (by inserting it into a computing device's port) or attempts to open the file, the fake malware may execute or cause the device to execute a command to send a message to the training system. The message may include data such as time and/or date of execution, an identification code for the computing device to which the memory is connected, and/or network identification data for a communication network to which the computing device is connected. As another example, if the message is a fake messaging service message, the message may lure the user into taking an action by including a phone number for the user to call, or it may contain a hyperlink to or address for a website, or it may contain an attachment such as an executable file. The system may sense whether or not the user took an unsafe action by monitoring for a communication from the website operator, the phone number operator, or the user device itself indicating that the user accessed the website, called the phone number, or downloaded and executed the attachment.
User behavior data 15 can be captured and recorded in one or more locations and may include relevant statistics, such as frequency associated with different types of events or situations, trends, and comparisons against relevant baselines. Such user behavior data 15 may help create a unique profile for each individual user that captures this user's activities and behaviors at a particular point in time or over different periods of time.
Historical user training data 16 may inform the selection of relevant training for a user by capturing the training history of that user. This can include the selection of relevant mock attacks as well as the selection of relevant training interventions in response to data collected in the context of mock attacks. Historical user training data 16 may include information such as: the training modules to which that user has already been exposed, how often and when that user was exposed to training modules, how well the user responded when taking the training modules, and other indicators of the user's proficiency in the area or areas in which the user has been trained. User proficiency can include, for example, recorded instances where the user failed to conform to expected best practices or apply relevant knowledge covered by the training system.
For example, if a mock attack involved luring the user with a USB memory device that contained fake malware, the system may include in the historical training user data the information on whether or not the user used that memory device within a period of time. Similarly, if the training intervention involved a fake malicious SMS message, the system may include in the historical user training data an indicator of whether or not the user acted upon the message, such as by calling a mock malicious phone number provided with the SMS message or clicking on a mock malicious hyperlink in the SMS message. The operator of the website to which the user links or the phone number that the user calls may serve as a sensor who will then provide information about the user, such as the user's phone number or electronic device identifier, to the training system for inclusion in the historical user training data and/or analysis by a policy manager.
Cybersecurity training and awareness for everyday users is a domain that stands to benefit significantly from context-aware training and in particular context-aware training based on mock attacks. The complexity of today's computers, including cell phones, tablets and other computer-powered or Internet-enabled devices, and networking systems make them vulnerable to an ever-wider range of attacks. Human users who adopt best practices and strategies (e.g. not falling for Internet-enabled social engineering attacks, regularly checking and installing software patches, adopting safe browsing practices, safe USB memory practices, safe security settings on their smartphones, etc.) can often help reduce their exposure to many of those threats. Training everyday users to adopt improved strategies that address potential threats can be a daunting task. Accordingly, an effective way to mitigate risks is to prioritize training for individual users based on the threat scenarios to which they are most likely to be exposed by taking into account information about user activities or behaviors and/or other relevant contextual attributes such as their prior training history and level of expertise as well as their responses to mock attacks representative of various threat scenarios to which they may be expo sed.
-
- i. devices capable of sensing relevant elements of a user's activities, behavior and more general context such as tablets 1002, laptop computers 1003, other consumer devices 1005 such as cameras, wristwatches, smart appliances 1006 including smart televisions and refrigerators, smartphones 1007, smart cars 1008, and other sensing devices not represented in the figure such as, for example RFID readers, heart rate monitors, cameras, and hardware and software sensors capable of sensing different types of activities and behaviors, including the effects of actions by the user on himself, other people, other organisms, or elements of his surrounding environment;
- ii. other data sources 1004 such as social networks, satellite imagery, public records, company records, criminal records, health, and financial records; and
- iii. devices capable of delivering training interventions to users such as tablets 1002, laptop computers 1003, smart appliances 1006, smartphones 1007 and other types of output devices 1013.
In general, different training interventions may utilize different delivery devices, such as some just with output capability, others with different combinations of output and input functionality.
The system may include a storage system 1012, which may comprise a plurality of storage devices, including cloud-based devices, possibly located across a plurality of locations. The storage system 1012 may serve as repository for static user data 17, recorded data 15 collected from one or more sensors, historical user training data 16, and training needs models 18. The storage system 1012 may also store part or all of the training content 22 and training meta-data available to the context-aware training system.
The computers 1002, 1003, 1007, 1010 and other devices 1005, 1006 and artifacts 1008, 1013 may be computers, computer systems or other electronic devices as described above and may each include at least one processor and possibly one or more other components of a computer or network of computers. For example, the analysis host computer 1010 may be a single server or could be a distributed computing platform or a cloud-based system running software such as Microsoft Windows, Linux or UNIX. The client configuration, participant computers, which may include one or more laptops 1003, tablets 1002, smart phones 1007, one or more administrator client devices 1014 or output devices 1013, may themselves comprise a collection of participant computers capable of network connectivity. Those devices may support any number of input and output functions. Those input and output functions may be embedded in the devices themselves or may be provided by satellite hardware such as a keyboard, mouse, display, or speaker. Devices may be connected to the network either through a physical hardwire connection or through wireless technology such as 802.11 Wi-Fi, Bluetooth, NFC, or GSM/CDMA/LTE cellular networks, or through other communication methods or systems. The operating system of each participant computer could include Microsoft Windows, Linux, UNIX, Mac OSX, Android, iOS, PALM, or another operating system. When relevant the computing devices may run browser software such as, for example, Mozilla, IE, Safari, Chrome or another browser software or browsing methodology. The type and configuration of the participant computing devices (e.g. 1002, 1003, 1007, and 1010) can be otherwise configured as desired.
The communication networks 1009 could be any type of data or computer communication network or any other technology enabling computers and possibly other devices or appliances to communicate with one another.
One embodiment of a method of context-aware training that may be performed, for example, by one or more of the components illustrated in
Cybersecurity training via mock attacks involves sensing user susceptibility to one or more threat scenarios by presenting a user with a mock attack situation in his or her actual context of use of a software program, a device, a service, or some other computer-mediated process. The system senses the user's response to the mock attack situation (or lack thereof) in an actual, everyday context of use (software program, a device, a service, or some other computer-mediated process). In this document, the phrases “actual context of use” and “regular context of use” are used interchangeably to refer to typical and ordinary conditions under which a user interacts with hardware, software or a service as part of his or her regular activities. This can range from browsing the web, reading email, responding to phone calls, accepting USBs at professional tradeshows, interacting with online services, accessing corporate systems, pairing one's cellphone with another device, unlocking doors with a security token, authenticating with any number of software or hardware artifacts, interacting with proximity tokens, granting permissions to other users, just carrying an electronic device with oneself as one goes about other activities, etc., as they are carried out by users as they go about their actual activities. In an actual context of use, when the user is presented with a mock attack situation, the user does not a priori know that the situation is a mock attack created to evaluate his or her readiness or susceptibility to different threat scenarios. This is in contrast to recording responses or lack thereof in the context of an interactive training module, a simulator, a drill, a quiz, or some other hypothetical or simulated situation in which the user actually knows that he or she is being evaluated.
Presenting a mock attack situation in an actual context of use can be particularly useful for improving user security readiness and/or reducing user susceptibility to different threat scenarios. This is because for most users security is not a primary task or a primary objective. For instance, at a given point in time, a sales representative's primary objective might be to make his quarterly quota, a software engineer's primary objective might be to meet a release date, and an executive assistant's primary objective might be to book a trip for his or her boss. Evaluating users in simulated situations where the user knows he is being evaluated changes this situation and makes security that user's primary objective at that particular point in time, thereby significant distorting the user's response. In addition, knowing that one failed a quiz or some other simulated exercise that was known not to be real is not the same as knowing that one failed to respond to a mock attack situation in one's actual context of use. The latter can humble users and get them to acknowledge that they need training. The end result is a teachable moment, where a user is more likely to pay attention and retain knowledge and tips offered to avoid falling for similar attacks in the future.
In some embodiments, the mock attack selection and delivery process 100 may include accessing identifying information 105, which may include the selection of users to be targeted by the mock attack. This information may be used to customize or deliver a mock attack situation. It may also be used to identify users who are being sensed in the context of a mock attack situation, such as identifying an action or lack thereof by a user, identifying a device associated with a given user (e.g., identifying a user carrying a particular Bluetooth-discoverable device), or determining whether a sensed device belongs to a user for whom prior consent (e.g. consent to record sensed activity and behavior and deliver training interventions) has been obtained. The identifying information may include, for example:
-
- contact information about a user such as the user's name, phone number, email address, street address, cubicle number, personal social media handle, etc.;
- some identifying information not tied to a particular device such as an account number, a user ID, or an ID associated with a software artifact or service not tied to a particular device (e.g., browser ID, video conferencing service ID).
- some identifying information tied to a device, including services, clients, operating systems or other software artifacts running on that device (e.g., unique device ID, MAC address, IP address, mobile phone number, cookie), with such identifying information likely but not necessarily guaranteed to be tied to a given user.
- one or more locations near which the user may be expected to come such as locations where a user or one or more of his or her devices may be within a range wherein a mock attack situation can be expected to be effective (e.g., an elevator lobby where some of the Bluetooth settings of a user's smartphone can be sensed, a coffee shop where the user may attempt to connect to a mock rogue Wi-Fi access point, a booth at a tradeshow where a user can be lured to pick up a promotional USB memory stick with mock malware, a rental car where a user could be exposed to a mock device pairing attack, a mock rogue authentication keypad placed by a door which a user is expected to use).
As used in this discussion, a device may be an electronic device that the user uses in an ordinary activity or carries with him or her as part of ordinary activities. The term device can also include the operating system, software applications and other software artifacts running on the device. Examples include smartphones, tablets and laptop computers, as well as also other devices such as a car, an electronic garage door opener, a security token, an activity tracking bracelet, an insulin pump, a prosthetic arm, and a smart wheelchair. A service is a service that the user may access via a device. Examples include a technology-mediated service such as a messaging service or a VOIP phone service for which the user has an account and an account ID, or it may also include any other service that could expose users to a threat scenario (e.g., a social engineering attack or shoulder surfing attack). The system could be involved in the delivery of a mock attack intended to measure user susceptibility and/or could be used to deliver follow-up training interventions.
Identification information about a device or service may also include, or may make it possible to retrieve, information that can be used to identify and customize available mock attacks (e.g., determining that a particular type of mock attack is only available for a certain type of device and a target user's device is not covered, or customizing elements of a mock attack situation to a particular user such as the particular features of that user's smartphone). In other words, in some embodiments the identifying information about the device or service may also be used to access additional information about the characteristics of the device or particular characteristics of the services, clients, operating system or other software artifacts running on that device (e.g., model, screen size, available functionality, operating system type).
The mock attack selection and delivery process 100 includes selecting a mock attack situation 110.
The selection of the mock attack situation 110, which may include the selection of target users, may be done from a set of one or more available mock attack situations and it may be based on any suitable criteria to identify a relevant mock attack situation. This selection will typically be carried out by a policy manager, possibly based on one or more training needs models, either in an automated fashion, or manually via an administrator client, or through a semi-automated process, where an administrator has the ability to review and manipulate some aspects of the selection process. The selection process may associate different types of mock attack situations with different types of devices or services, with one or more elements of a user's context (e.g., role within the enterprise, prior training history, country where the user works, country where the user is scheduled to travel), with sensed data about the user (e.g., user who has downloaded a mobile banking application, user who connects his laptop to Wi-Fi networks outside the office, user who connects USB memory devices to his laptop), with sequencing considerations such as following a first mock attack with a second attack of the same type or of a different type, as well as with any other relevant data available to the system. The system may use any combination of this data to select a mock attack situation relevant to the device, service or location of one or more users. As indicated above, in some embodiments, the system may permit an administrator to control one or more elements of the process involved in the selection of the mock attack situation as well as to possibly customize some elements of the selected mock attack situation. In other embodiments, the customization process may be automated in full or in part based on logic contained within scripts or programs used in the delivery of the mock attack situation 115 or within logic embedded in the policy manager. Examples of this will be discussed below.
Once selected, the mock attack situation is delivered to the user in the user's regular context of use 115. The system may do this by generating a command, instruction, document or other communication to deploy a service, system or other necessary artifacts, by directly or indirectly deploying the attack (such as by sending an SMS message, placing a VOIP call, arranging for a USB to be delivered in the mail to the user, deploying a rogue Wi-Fi access point), any combination of the above, or any other relevant means.
The system may detect an interaction event comprising action of the user (or lack thereof) in response to the mock attack 120. By extension, the sensed user response should also be understood to include sensing of the configuration of a user's software or hardware artifacts (e.g., sensing that a user's smartphone includes Bluetooth settings that make the device discoverable) or sensing attributes of activities in which the user engages that expose him or her to particular threat scenarios (e.g., a user discussing sensitive matters on a smartphone in a public space, a user entering password information where he or she is at particularly high risk of a shoulder surfing attack). A sensor may directly detect the interaction event, or the system may receive data that is collected by a sensor. The data may correspond to user activities or behaviors or, more generally, other contextual attributes relevant to the selection of appropriate training interventions in response to a given mock attack or at a later stage. Such contextual attributes may include any relevant sensory data as well as information obtained from other relevant sources of information, such as browser history, credit card records, surveillance cameras, electronic doors, employment records, information collected about a person with which the user has interacted, and social networking information. They can also include time data, duration data, and any other relevant information about the user's interaction with a mock attack situation (e.g., sensitive information provided by the user, voice recording of the user's interaction). The interaction signature can be produced in various ways including using cryptographic hashes of one or more attributes of an interaction event. In some embodiments, sources of sensory data may forward sensed information to one or more other participant computers. In one instance, a software or executable program will run on a participant computer or device and locally process sensed data to detect one or more relevant interaction events prior to forwarding the detected information (e.g. in the form of interaction signatures) to a storage system. The executable program may include logic to locally deliver just-in-time training interventions in response to particular interaction events. In some embodiments, user data can be forwarded directly to the analysis host computer or computers responsible for hosting the policy manager. The storage system may be responsible, among other things, for storing sensed user data. The system may detect an action of the user 120 by filtering sensed data, aggregation of sensed data, pre-processing of the sensed data, analysis of the sensed data, and/or receipt of one or more event interaction signatures.
Continuing references to
The policy management process 140 may include determining whether the user who responded should receive training 150. At a high level, an early step in this process may be determining whether the user is a known user to whom the mock attack was directed for training purposes. In this document, the text may use the terms “known user” or “registered user” interchangeably to refer to a user whom the system has some identifying information about and who is an intended recipient of a mock attack. The policy management process or another process may include the step of registering a user as a registered user and, if necessary, obtain consent from the user to be exposed to mock attacks. This process may be driven by a system administrator or may be automated in part or in full. Alternatively, the registration process may be done directly by a user who registers and consents to receive mock attacks, or by a proxy for the user (such as the user's employer or any owner of the electronic device that the user is using). If the responding user is not a known user to whom the attack was directed or in a group to whom the attack was directed, the system may be programmed or configured to not deliver any training to the responding user. The system may also be programmed or configured to discard some or all information obtained from non-registered users. On the other hand, if the user is a known user who is a candidate for training then the system may initiate a training analysis at 150 and, when appropriate, identify one or more relevant training interventions from a collection of available training interventions, including possibly just-in-time training interventions.
In some situations, the system may use a combination of a user ID and device ID to determine whether to initiate a training intervention. For example, if the system receives identifying information relating to the user it may determine whether the response originates from a user who is a registered user. If the system receives identifying information relating to a device it may use that information to determine whether the device is an approved device. A device may be approved if it is registered to an organization (such as the user's employer) or permitted according to a policy of the organization. If the system determines that a registered user is using a non-approved device, it may deliver a training intervention to the user, such as a training intervention that is geared toward the use of only approved devices.
The policy manager is responsible for determining, and possibly prioritizing, the training interventions to be delivered to individual users. The policy manager in the embodiment illustrated in
Referring again to
In particular, for example, the system administrator may launch a training campaign for a group of users whose estimated training need in a given area is above a certain threshold level. In another instance, a system administrator could select all those users who failed recent assessments via one or more mock malicious SMS attacks and who also receive more than 5 SMS messages per day to be exposed to a cybersecurity training intervention intended to teach them how to better protect themselves from malicious SMS attacks. Such a training intervention could also include the system administrator or policy manager 19 identifying groups of users who are perceived to be at particularly high risk for a combination of threat scenarios and scheduling training campaigns for those users involving one or more training interventions that specifically address those training needs.
Regular assessment of user training needs may involve running in batch mode, where all users are being reviewed in one batch or where different groups of users are processed in different batches, possibly according to different schedules. Regular assessment of user training needs may also include pushing short security quizzes and creating mock attack situations aimed at better evaluating the needs of an individual user or a group of users. In a real-time mode, the policy manager 19 may operate in an event-driven manner enabling it to more rapidly detect changes in user behavior or activities and other relevant contextual attributes, and to more quickly push training interventions that reflect the risks to which the user is exposed at a desired time. Any of those modes can be implemented in the form of simple rules or more complex logic that can potentially be customized and refined by an organization where, for instance, the organization is using administrator client software interfaces. Examples of such interfaces will be described beginning with the discussion of
The rules or more complex logic can also be defined to allow for mixed initiative iterations with system administrators and users, where results from the analysis performed by the policy manager 19 are shown to the user and the user can interact with the policy manager 19 to refine the analysis, evaluate different options, and possibly finalize the selection, prioritization and scheduling of training interventions, whether for individual users or groups of users. The rules and/or logic of the policy manager 19 may be manually configured by system administrators, programmers or other qualified personnel (whether working for the organization providing the context-aware training system, for a customer organization, for a contractor working for either of those organizations, or by some other individual or group of individuals) or derived through statistical analysis or data mining techniques, or a combination of both. The administrator client software interface may also allow administrators to maintain and customize training needs models and other relevant parameters (such as the threshold levels, training needs and other parameters shown in
Returning to
Training interventions may include one or more dates by which the user should experience the training intervention, proficiency levels that may have to be achieved by the user while engaging with the training content (e.g. training quiz, training game, simulation exercise, responses to mock situations and other interactive types of interventions). Training interventions may also be performed through a combination of types of interventions including, for example, a delivery of a combination of just-in-time training interventions to the user, training assignments to be completed by the user by assigned dates or times, and recommendations for further training of the user. Training interventions, including training content, assignments, and recommendations, may also be provided to the user by other relevant means.
Training interventions may include the creation of mock attack situations, whether through fully automated processes (e.g. automated delivery of mock malicious SMS messages to a number of users), or manual processes (e.g. activating personnel responsible for creating mock situations such as mock impersonation phone calls intended to measure people's susceptibility to social engineering attacks), or hybrid processes (e.g. mock USB memory attack, where a USB includes fake malware intended to train one or more users not to plug USB memory sticks into a computer and further wherein such USB memory devices are manually scattered around an office to lure employees to pick them up). Training interventions may come in many different formats, ranging from video and audio content, to cartoons, alerts (e.g. alarms, flashing lights), training interventions involving personnel (e.g. a phone call from the boss of a user, a training session with a certified instructor, a conversation with the parent of a user), or any combination of the above or any other relevant format by which training content may be delivered to a user.
Returning to
In some embodiments, the response collection process 185, mock attack selection and delivery process 100 and/or the training intervention process 140 may be integral. For example, the data collection process and training intervention process can together be implemented as an “if-then” rule pursuant to which the system delivers a training intervention if the system detects that a user has fallen for a particular mock attack situation.
In the user action and response collection processes, various sensors may be used to gather the data. The sensors may be physical sensors deployed at a location to receive data, or software-implemented sensor that analyzes a received response to identify certain data included in the response. Examples of sensors include: (i) sensors to detect whether a fake malware program was installed on, or whether a storage device was inserted into, an electronic device; (ii) configuration sensors that detect one or more hardware or software settings of an electronic device; (iii) a network sensor to detect whether a device is connecting to an unsecured network, a roaming network, or a near field or short range communication device; (iv) a messaging sensor; (v) a sensor that detects usage of a particular application, such as a social networking application; and (vi) others. Some of the sensors listed above may aggregate data they collect from other sensors such as device drivers, browsers, operating system components, and more. User behavior data collected from those sensors may be directly interpreted by a policy manager running on an analysis host computer or can be recorded in a data storage system for later analysis.
In the case of an embodiment of a context-aware cybersecurity training system, sensed user data is analyzed to identify threat scenarios for which a user in a given context is most susceptible or most at risk.
For example, the system may include one or more executable programming instructions that serve as dangerous program sensors. These sensors may be used to inspect the code of software running on devices operated by a user (e.g. static code analysis), monitor incoming and outgoing data flows as well as other behavioral characteristics associated with software running on devices operated by a user, and look for and report any static and/or behavioral signatures that are indicative of vulnerability to one or more threat scenarios. Examples could include instructions to identify dangerous mobile apps installed by a user on his smartphone, such as by accessing a database of known apps or analyzing certain properties of the app. Dangerous apps may be identified as apps that access sensitive application programming interfaces (APIs) or sensitive combinations of APIs (e.g., whether the app accesses sensitive APIs such as APIs to access the user's contacts list, the user's fine grain location, the phone's microphone, social media functionality, etc.), apps that access APIs or request permissions they ostensibly do not require, apps that are simply unknown to the system, or apps that have reviews indicative of potential vulnerabilities. The system can also include a sensor to monitor incoming and/or outgoing data flows or processing actions to indicating that the user has caused, installed, downloaded or acquired software requiring that the user opens up sensitive ports on his computing device, a sensor to identify that the user has installed, downloaded or acquired software known to have vulnerabilities, or that the user has installed, downloaded or acquired a software client associated with risky usage scenarios (e.g. peer-to-peer client software). Some of this sensing infrastructure may piggy back on functionality from a Data Leakage Prevention (DLP) system, a Mobile Device Management (MDM) system, a firewall system or any other infrastructure element with relevant sensing functionality that the context-aware training system may have access to.
Other examples of sensed data may include, for example:
-
- i. filenames or other data relating to content of a user's saved file directory, such as a directory of saved email attachments or a directory of files downloaded using a browser client;
- ii. data relating to the configuration of the user's browser, operating system, or some other software running on a device with which the user interacts;
- iii. data indicating whether the user is using or has used a computing device on a Wi-Fi network, and whether or not the Wi-Fi network is a secured network or known, trusted network;
- iv. location data obtained through one or more technologies (e.g., Wi-Fi location tracking, cell phone triangulation, Bluetooth beacons, RFID tags, credit card transactions, GPS, smartphone APIs, browser APIs, IP address) indicative of places where the user goes, or where the user has operated or attempted to access a particular computing system;
- v. a phishing sensor, such as a monitor that receives data indicating whether (and optionally how frequently) a user visits or attempts to visit one or more blacklisted web sites, or a sensor looking at the number of emails received by a user and flagged as phishing emails by an email filter;
- vi. a password vulnerability sensor, such as a monitor that receives data indicating how often a user changes his password or a sensor that estimates the strength of passwords selected by a user (e.g., the password must contain a minimum number of characters or a certain type or combinations of types of characters, such as at least one capital letter, at least one lowercase letter, and at least one number, or have some minimum length);
- vii. an external memory device monitor that receives data from a computer indicating when an external memory device such as a USB memory device has been connected to a communication port of an electronic device operated by a user, potentially allowing for the transfer of malicious files on that electronic device;
- viii a social networking sensor, such as a monitor that receives data from a browser or browser plug-in estimating the time that the user has spent accessing one or more known social networking websites; or
- ix. a social networking sensor that crawls known social networking sites looking to estimate the level and type of social networking activities in which users engage (e.g., data files, photos, videos, or comments posted by a user, location information leaked by a user, photos where a user is tagged, number of friends a user has). This may include estimating the amount of such data or activities, their frequency, their level of sensitivity, etc.
The system may include a dataset of possible threat scenarios for which a context-aware cybersecurity training system may determine that a user is at risk. The system may include a dataset of associations between threat scenarios and associated actions that may indicate that a person who performs the actions may be at risk for the threat scenario. These associations may provide a basis for a training needs model (See
Optionally, the system may receive sensed data relating to the user actions and/or behavior, and it may apply rules to determine whether the user is at risk for the associated threat scenario. These rules may include analysis of the action or behavior itself (such as the content of information posted to a social network) to determine whether the action satisfies a threat criterion such as any content that identifies an employee by name, a social security number, a corporate name, device ID or other prohibited content). Sometimes, to determine whether a user is at risk or contributes to susceptibility to one or more threat scenarios, the policy manager may require that a threshold of one or more indicative user actions be sensed, or that a particular user action be repeated a threshold number of times, possibly over a given period of time. For instance, assessment of the risk associated with a user falling for a malicious SMS threat scenario can benefit from monitoring activities that include how often a user replies to mock malicious SMS messages. The logic used by the policy manager to drive this analysis (whether automatically or in the context of mixed initiative interaction scenarios) may rely on one or more rules and thresholds or some more complex logic. It may be manually entered by an analyst or system administrator, may be derived using statistical analysis and/or data mining techniques, may be obtained through benchmarking activities involving one or more organizations, or any combination of the above.
Also, the system may receive sensed action data for multiple users and store that data in correlation with relevant attributes of the data, such as identifying information for the multiple users (e.g., unique device IDs for different users), a date of the action or actions taken by the users, in a data set such as a user profile, user behavior data set, or historical user training data set, where the data may be organized by users.
An embodiment of a partial training needs model based on simple threshold levels is illustrated in
An alternate embodiment of a partial training needs model based on simple threshold levels is illustrated in
A user may be identified as being at high risk for a number of different possible threat scenarios. In one embodiment, the policy manager is responsible for consolidating the training needs identified for the user and for identifying a suitable and possibly prioritized collection of training interventions, based on considerations such as the collection of training interventions available for addressing the collection of training needs identified by the model.
Some training interventions can address more than one training need. For instance a smart phone security training module may address both smart phone security at large as well as malicious messaging attacks in the context of smart phones. Training interventions selected by the policy manager may include immediate, just-in-time training interventions, assignments of training interventions the user should take by a certain date, and recommendations for additional training.
Elements of an embodiment of a slightly more complex training needs model 4000 including data based on one or more risk models is illustrated in
Elements of the quantitative training needs model 4000 illustrated in
The particular format of the risk models shown in
In another embodiment, a computer-implemented training system is contemplated in which a user computing device communicates with a remote analysis host computer. The computer-implemented training system includes an input device for receiving user input or a user action and a first processor coupled to the input device. The first processor has instructions which, when executed by the first processor, cause the first processor to receive a user initiated input from an input device, transmit an action associated with the input to a second processor, receive a training intervention, possibly including a mock attack situation, from the second processor, and provide the training action to the user. The computer implemented training system may also receive at least one input provided at the input device in response to the provision of the training action and transmit the at least one input provided in response to the provision of the training action to the second processor.
In another embodiment in which a user computing device (i.e., 1002, 1003, 1005, 1006, 1007, and 1008 illustrated in
Examples of the training interventions and meta-data described in
In the method of
When a user uses a barcode scanning application on a mobile device to capture an image of the mock malicious barcode, the user's device will decode the data and use it to generate a request to access a mock malicious URL or perform some other action such as prompting the user to download a mock malicious mobile app, inviting the user to share a mock malicious link on a social network, or any number of other action that can be encoded in a barcode, interpreted by a barcode scanning application and used to create a mock malicious situation equivalent to a threat scenario the target user could possibly encounter. When the system detects that a user has performed an action 2005 that is prompted by the barcode, it may need to determine 2007 whether the action originated from a known trainee. It may do this by comparing the received device ID or some other user data to the known trainee information and determine if a match occurs. If the action did not originate from a known trainee, the system may be programmed to discard the data it collected and/or deliver a non-trainee service such as displaying a more generic training message, or displaying a “broken link” message, or redirecting the user to a non-trainee webpage (all of which are examples of delivering a non-trainee service 2011). If the action did originate from a known trainee, the system may capture and record identifying information about the trainee as well as the trainee's response action 2009, determine a training intervention that is appropriate for the trainee based on the trainee's action (using methods such as those described earlier in this document) 2013, and deliver the training to the trainee 2015. The training intervention may be delivered to the trainee via a service that the user accessed via the barcode (e.g. a webpage hosted at the mock malicious URL to which the user's mobile device was redirected), through an entirely different channel (e.g. an automated phone call or SMS message that uses information about the user that includes the user's cell phone number as well as possibly the location where the mock malicious barcode was scanned), by assigning a training module to the user, any combination of the above or of any other relevant means of delivering a training interventions. Optionally, the training action may only be delivered if the trainee responds to at least a threshold number of training interventions; it may only be delivered if the user takes certain predetermined actions in response to the training intervention; or it may only be delivered according to more complex training needs models and/or logic in the policy manager. Those skilled in the art will readily appreciate that the flow diagram illustrated in
In the method of
When the user requests to connect to the mock malicious wireless service 3105, the system may optionally determine 3107 whether the request originated from a known trainee. It may do this by comparing a unique device ID or some other identifying data obtained as part of the user request to determine whether the request is originating from a known trainee. If the request did not originate from a known trainee or device the system may deliver a non-trainee service to the user 3111, such as by connecting the user to an ordinary, functional Wi-Fi network. If the request did originate from a known trainee, the system may capture and record identifying information about the trainee as well as the trainee's response action 3109, determine a training intervention that is appropriate for the trainee based on the trainee's action (using methods such as those described earlier in this document) 3113, and deliver the training to the trainee 3115. The training intervention may be delivered to the trainee via the service that the user accessed, some other communication channel or output device or any combination of the above and of any other means to direct training interventions to the trainee. Optionally, the training action may only be delivered if the trainee responds to at least a threshold number of training interventions, or only if the user takes certain predetermined actions in response to the training intervention. Note that, while in
In one embodiment of the method illustrated in
When a user performs an action in response to the mock malicious message (such as by providing a reply to the message or clicking a hyperlink in the message), the system may detect the action 3205 and determine 3207 whether the action originated from a known trainee. It may do this by comparing identifying information provided as part of the user's action to identifying information about known trainees and determine if a match occurs. In an embodiment where the message is based on automated call functionality, the system may use voice recognition technology to determine whether the voice of the person who answers the call matches that of a known trainee. Optionally, the service may not require or retrieve personally identifiable information and may instead rely solely on the device ID to determine whether the device is a registered device that is known to be used by a known trainee. If the request did not originate from a known trainee or device, the system may not need to take any particular application for that user 3211. If the request did originate with a known trainee, the system may capture and record identifying information about the trainee as well as the trainee's response action 3209, determine a training intervention that is appropriate for the trainee based on the trainee's action (using methods such as those described earlier in this document) 3213, and deliver the training intervention to the trainee 3215. The training intervention may be delivered to the trainee via another message in response to the user's reply or through some other channel. Or, the service may provide the trainee with instructions indicating how the trainee should receive the training intervention. Optionally, the training action may only be delivered if the trainee responds to at least a threshold number of training interventions, or only if the user takes certain predetermined actions in response to the training intervention. When a reply to a mock malicious message is identified as not originating from a known, registered user, the system may just delete the reply and not keep any information associated with that reply.
In the method of
When a user requests to install the malware (or when the user just downloads and/or installs the malware), the system may detect the user's action 3305 (such as by receiving the request or sensing the download) and determine 3307 whether the action originated from a known trainee. It may do this by comparing the received device ID or user data to the known trainee information and determine if a match occurs. Optionally, the service may not require or retrieve personally identifiable information and may instead rely solely on the device ID to determine whether the device is a registered device that is known to be used by a known trainee. In some embodiments, the personally identifiable information may be returned to the service in a confirmation indicating that the fake malware has been installed. If the action did not originate from a known trainee or device, then the system may not need to take any particular action for that user, or it may provide the user with an error message to let the user know that the downloaded software does not work; or it may provide the user with a functional version of the software the user wanted to download; or it may provide the user with a generic training message intended to inform the user about the general risks associated with the threat scenario which the mock attack is intended to capture. These and other related options are intended to be captured by step 3311 (“deliver non-trainee service”), including the option of just doing nothing. If the request did originate with a known trainee, the system may capture and record identifying information about the trainee as well as the trainee's response action 3309, determine a training intervention that is appropriate for the trainee based on the trainee's action (using methods such as those described earlier in this document) 3313, and deliver the training intervention to the trainee 3315. The training intervention may be delivered to the trainee via the mock malware itself or through an entirely different channel (e.g. email, phone call, SMS). Or, the mock malware may provide the trainee with instructions indicating how the trainee should receive the training intervention. Optionally, the training action may only be delivered if the trainee responds to at least a threshold number of training interventions, or only if the user takes certain predetermined actions in response to the training intervention. As detailed earlier, more complex logic and more sophisticated training needs models may be used to drive this process. As in
While specific embodiments of the invention have been described in detail, it should be appreciated by those skilled in the art that various modifications and alternations and applications could be developed in light of the overall teachings of the disclosure. Accordingly, the particular arrangements, systems, apparatuses, and methods disclosed are meant to be illustrative only and not limiting as to the scope of the invention.
Claims
1-23. (canceled)
24. A computer-implemented method for automatically providing cybersecurity training to a user of an electronic device, the method comprising:
- by one or more processors: receiving historical data for a user of an electronic device; using the historical data to determine a first susceptibility of the user to a first cybersecurity threat and the historical data to determine a second susceptibility of the user to a second cybersecurity threat; determining, based on the first susceptibility of the user to the first cybersecurity threat and the second susceptibility of the user to the second cybersecurity threat, that the user is more susceptible to the first cybersecurity threat; determining an amount of time available to train the user, wherein the amount of time available to train the user indicates that a single training intervention is sufficient to train the user; based on the determination that the user is more susceptible to the first cybersecurity threat and the amount of time available to train the user, selecting a training intervention, wherein the training intervention corresponds to the first cybersecurity threat; and causing the selected training intervention to be presented to the user.
25. The method of claim 24, further comprising receiving additional data indicating that a sensor has detected a first interaction event using voice recognition technology to detect an interaction of the user with the electronic device in which the user provided sensitive information.
26. The method of claim 25, wherein:
- the method further comprises automatically placing a phone call to the user and interacting with the user via an automated menu or automated dialogue; and
- the first interaction event comprises interaction of the user with the electronic device in which the user provided sensitive information.
27. The method of claim 26 further comprising, before receiving the additional data: generating a mock attack; and
- transmitting the mock attack to the electronic device to be presented to the user in the user's regular context of use of the electronic device, wherein the first interaction event comprises the user having taken an action that interacts with or responds to the mock attack.
28. The method of claim 27, wherein determining the first susceptibility of the user to the first cybersecurity threat comprises:
- determining a frequency within which the user has repeated a first sensed action; and
- determining whether the determined frequency exceeds a frequency threshold for a threat scenario.
29. The method of claim 28, wherein determining the first susceptibility of the user to the first cybersecurity threat comprises:
- determining a frequency within which the user has repeated the first sensed action during each of a plurality of given periods of time; and
- determining a susceptibility for each of the given periods of time.
30. The method of claim 29, wherein the sensor is a sensor of the electronic device.
31. The method of claim 29, further comprising:
- causing the selected training intervention to be presented to a second user at a second time, later than a first time, wherein: the first sensed action comprises a user input scheduling deployment of smart phones to a plurality of users including the user and the second user, the selected training intervention comprises a smart phone security training intervention, and causing the selected training intervention to be presented to the user comprises causing the selected training intervention to be presented at the first time and causing the selected training intervention to be presented to the second user at the second time.
32. The method of claim 25, further comprising:
- establishing known trainee information indicating that the user is a trainee and a second user is a non-trainee;
- identifying, based on the trainee information, that the user is a trainee, wherein the first interaction event comprises scanning a mock malicious barcode with the electronic device that causes user identification information for the user to be shared with a policy manager, wherein causing the selected training intervention to be presented to the user is based on identifying that the user is a trainee;
- identifying, based on the trainee information and a third interaction event, that the second user is a non-trainee, wherein the third interaction event comprises scanning the mock malicious barcode with a second electronic device that causes user identification information for the second user to be shared with the policy manager; and
- based on identifying that the second user is a non-trainee, causing a non-training interface to be presented to the second user.
33. The method of claim 24, wherein the training intervention is further selected based on one or more of: a role of the user, an age of the user, a gender of the user, a preferred language for the user, available devices on which the user may participate in the training intervention, or a country to which the user is scheduled to travel.
34. The method of claim 24, wherein the electronic device comprises one or more of: a car, an electronic garage door opener, a security token, an activity tracking bracelet, an insulin pump, a prosthetic arm, or a smart wheelchair.
35. The method of claim 24, further comprising:
- based on the second susceptibility of the user to the second cybersecurity threat, selecting a second training intervention;
- determining that the first cybersecurity threat is applicable to the user within a predetermined period of time and that the second cybersecurity threat is not applicable to the user until after expiration of the predetermined period of time; and
- causing the second training intervention to be presented to the user after expiration of the predetermined period of time, wherein causing the training intervention to be presented to the user comprises causing the training intervention to be presented to the user prior to expiration of the predetermined period of time.
36. A system comprising:
- an analysis host computer comprising a processor and a non-transitory memory storing instructions that, when executed by the processor, cause the analysis host computer to: receive historical data for a user, use the historical data to determine a first susceptibility of the user to a first cybersecurity threat and the historical data to determine a second susceptibility of the user to a second cybersecurity threat, determine, based on the first susceptibility of the user to the first cybersecurity threat and the second susceptibility of the user to the second cybersecurity threat, that the user is more susceptible to the first cybersecurity threat, determine an amount of time available to train the user, wherein the amount of time available to train the user indicates that a single training intervention is sufficient to train the user, select, based on the determination that the user is more susceptible to the first cybersecurity threat and the amount of time available to train the user, a training intervention that corresponds to the first cybersecurity threat, and transmit the selected training intervention to an electronic device.
37. The system of claim 36, wherein the memory further stores a data set of historical training data for a plurality of users, and wherein the historical data for the user is part of the data set of historical training data.
38. The system of claim 36, wherein:
- a first electronic message is received by the electronic device and includes a mock malicious hyperlink; and
- a first interaction event comprises an event in which the user accessed a website that corresponds to the mock malicious hyperlink.
39. The system of claim 38, wherein:
- the first electronic message includes a mock malicious attachment; and
- the first interaction event comprises an event in which the user opened or downloaded the mock malicious attachment.
40. The system of claim 38, wherein the instructions, when executed by the processor, cause the analysis host computer to receive, from a sensor, first data indicating that the first interaction event has occurred comprises software configured to cause the analysis host computer to use voice recognition technology to detect interaction of the user with the electronic device in which the user provided sensitive information.
41. The system of claim 38, wherein:
- data indicating that the first interaction event and a second interaction event have occurred indicates that the user interacted with an automated menu or automated dialogue function; and
- the first interaction event comprises an interaction of the user with the electronic device in which the user provided sensitive information.
42. The system of claim 38, wherein the instructions, when executed by the processor, cause the analysis host computer to:
- determine a frequency within which the user has repeated the first interaction event; and
- determine whether the determined frequency exceeds a frequency threshold for a threat scenario.
43. The system of claim 36, wherein the analysis host computer is in communication with via a mobile device management (MDM) system or a data leakage prevention (DLP) system, a firewall system, an email filtering system, a browser or a network proxy.
Type: Application
Filed: Sep 27, 2021
Publication Date: Jan 13, 2022
Inventors: Norman Sadeh-Koniecpol (Pittsburgh, PA), Kurt Wescoe (Pittsburgh, PA), Jason Brubaker (East Berlin, PA), Jason Hong (Pittsburgh, PA)
Application Number: 17/486,014
