Potential data leakage reporting system, method, and computer program product
View Patent ↗A reporting system, method, and computer program product are provided with respect to occurrences of potential data leakage. In use, a plurality of occurrences of potential data leakage is identified based on user behavior. In addition, a report is provided based on a determination of whether an aspect of the plurality of occurrences exceeds a predetermined threshold.
1. A method, comprising:
identifying settings related to monitoring one or more computer systems for data leakage, wherein the settings are obtained via a graphical user interface;
receiving, from one or more of a plurality of agents, one or more communications indicating a plurality of occurrences of potential data leakage from a monitored computer system, wherein:
each of the plurality of agents executes on one of a plurality of computer systems other than the monitored computer system,
each of the plurality of agents is configured to monitor at least one type of user behavior indicated by the settings, the at least one type of user behavior associated with the one of the plurality of computer systems on which the agent executes, wherein each of the plurality of agents is configured to monitor a different type of behavior, and
the plurality of occurrences of data leakage are associated with data transmissions from the monitored computer system;
identifying the plurality of occurrences of potential data leakage based on the one or more types of user behavior monitored by the plurality of agents;
determining, using a processor, whether an aspect of the plurality of occurrences exceeds a first predetermined threshold;
providing a first report of all data leakage occurrences during a monitored time period based on the determination that the aspect of the plurality of occurrences exceeds the first predetermined threshold; and
performing a non-report action responsive to a determination that the aspect of the plurality of occurrences exceeds a second predetermined threshold different from the first predetermined threshold.
2. The method of claim 1 further comprising receiving the settings related to data leakage based upon either user input or default values.
3. The method of claim 1 wherein the settings include values corresponding to the first threshold.
4. The method of claim 1 wherein the settings include values corresponding to the first report.
5. The method of claim 1 further comprising the step of providing a second report based on the determination that the aspect of the plurality of occurrences exceeds the second predetermined threshold.
6. The method of claim 1 wherein the settings include values corresponding to the second threshold.
7. The method of claim 6 wherein the settings include values corresponding to the non-report action.
8. One or more non-transitory computer readable media, on which are stored instructions, comprising instructions that when executed cause a computer to:
identify settings related to monitoring one or more computer systems for data leakage, wherein the settings are obtained via a graphical user interface;
receive, from one or more of a plurality of agents, one or more communications indicating a plurality of occurrences of potential data leakage from a monitored computer system, wherein:
each of the plurality of agents executes on one of a plurality of computer systems other than the monitored computer system,
each of the plurality of agents is configured to monitor at least one type of user behavior indicated by the settings, the at least one type of user behavior associated with the one of the plurality of computer systems on which the agent executes, wherein each of the plurality of agents is configured to monitor a different type of behavior, and
the plurality of occurrences of data leakage are associated with data transmissions from the monitored computer system;
identify the plurality of occurrences of potential data leakage based on certain user behaviors monitored by the plurality of agents and indicated by the settings;
determine whether an aspect of the plurality of occurrences exceeds a first predetermined threshold;
provide a first report of all data leakage occurrences during a monitored time period based on the determination that the aspect of the plurality of occurrences exceeds the first predetermined threshold; and
perform a non-report action responsive to a determination that the aspect of the plurality of occurrences exceeds a second predetermined threshold different from the first predetermined threshold.
9. The one or more computer readable media of claim 8 , wherein the instructions further comprise instructions that when executed cause the computer to receive the settings related to data leakage based upon either user input or default values.
10. The one or more computer readable media of claim 8 wherein the settings include values corresponding to the first threshold and the first report.
11. The one or more computer readable media of claim 8 wherein the settings include values corresponding to the second threshold.
12. The one or more computer readable media of claim 8 , wherein the instructions that when executed case the computer to determine whether an aspect of the plurality of occurrences exceeds a first predetermined threshold comprise instructions that when executed cause the computer to:
increment a score by adding a weight of each identified data leakage occurrence to the score; and
determine whether the score exceeds the first predetermined threshold.
13. A system comprising:
a plurality of agents configured to monitor a monitored computer system for occurrences of potential data leakage, wherein:
each of the plurality of agents executes on one of a plurality of computer systems other than the monitored computer system,
each of the plurality of agents is configured to monitor the monitored computer system for at least one type of user behavior, the at least one type of user behavior associated with the one of the plurality of computer systems on which the agent executes, wherein each of the plurality of agents is configured to monitor a different type of behavior, and
the occurrences of data leakage are associated with data transmissions from the monitored computer system; and
a monitoring computing device comprising
a processor configured to execute instructions, the instructions comprising instructions that when executed cause the processor to:
identify settings related to monitoring one or more computer systems for data leakage;
receive, from one or more of the plurality of agents, one or more communications indicating a plurality of occurrences of potential data leakage from the monitored computer system,
identify the plurality of occurrences of potential data leakage based on certain user behaviors monitored by the plurality of agents, wherein the certain user behaviors are indicated by the settings;
determine whether an aspect of the plurality of occurrences exceeds a first predetermined threshold;
provide a first report of all data leakage occurrences during a monitored time period based on the determination that the aspect of the plurality of occurrences exceeds the first predetermined threshold; and
perform a non-report action responsive to a determination that the aspect of the plurality of occurrences exceeds a second predetermined threshold, different from the first predetermined threshold.
14. The system of claim 13 wherein said monitoring computing device identifies the settings related to data leakage based upon either user input or default values.