Granted Patent B2

US 9,280,911 · App. 13/832,070 · Granted Mar 8, 2016

Abstract

Claims (75)

1. A computer-implemented method of providing cybersecurity training to a user, comprising:

by one or more processors of a cloud-based system, generating a command to present a user with a mock attack situation;

by a sensor device, sensing an action of the user when using an electronic device in response to the mock attack situation, wherein the sensor device comprises at least one of the following:

a USB sensor device configured to detect that the user has connected a USB device to the electronic device, or

a Wi-Fi sensor device configured to detect that the user has connected or attempted to connect the electronic device to a Wi-Fi access point;

by the one or more processors of the cloud-based system, using data from the sensor device to determine that, in response to the mock attack situation, the user has performed an action that indicates a need for the user to receive a cybersecurity training intervention relating to the performed action; and

by the one or more processors of the cloud-based system, generating a command to deliver the cybersecurity training intervention to the user via an electronic device.

2. The method of claim 1 , further comprising, by the one or more processors of the cloud-based system:

in response to detecting that the user has performed the action, identifying a threat scenario for which the user is at risk;

identifying a collection of available cybersecurity training interventions that are relevant to the threat scenario;

selecting from the collection, based on the identified threat scenario, the training intervention to be delivered to the user.

3. The method of claim 2 , wherein selecting the training intervention is also based on user behavior data or historical training data for the user.

4. The method of claim 1 , further comprising, by the one or more processors of the cloud-based system:

recording a response of the user to the cybersecurity training intervention; and

storing the response with the user behavior data or historical training data in a data storage system.

5. The method of claim 1 , further comprising, by the one or more processors of the cloud-based system, customizing the cybersecurity training intervention based on the performed action or information about the user other than the performed action, the information comprising user behavior data, historical user data, or user profile information.

6. The method of claim 2 , wherein selecting the cybersecurity training intervention comprises:

using a risk model to identify a combination of cybersecurity training interventions; and

prioritizing the identified cybersecurity training interventions in the combination.

7. The method of claim 2 , further comprising, by the one or more processors of the cloud-based system:

sending a list of available cybersecurity training interventions to a system administrator interface for review and selection; and

causing the selected cybersecurity training intervention to be delivered to the user via an electronic device in response to a selection from the system administrator interface.

8. The method of claim 2 , further comprising, by the one or more processors of the cloud-based system:

sending the selected cybersecurity training intervention to the user;

receiving feedback from user interaction with the cybersecurity training intervention; and

based on the feedback, selecting and sending an additional cybersecurity training intervention to the user via an electronic device.

9. A computer-implemented method of providing cybersecurity training to a user, comprising:

by one or more processors of a cloud-based system:

receiving, from a sensor device, a sensed action of the a user of an electronic device, wherein the sensor device and sensed action comprise at least one of the following:

a USB sensor device, and that the user has connected a USB device to the electronic device, or

a Wi-Fi sensor and that the user has connected or attempted to connect the electronic device to a Wi-Fi access point;

using data from the sensor device to determine that the user is at risk for a cybersecurity threat scenario;

identifying a data storage system comprising a collection of available training interventions that are relevant to the cybersecurity threat scenario;

accessing a training needs model for the user;

selecting a training intervention from the collection that relates to the identified threat scenario, wherein the selecting is based on the identified cybersecurity threat scenario and one or more of the following: historical user training data, user behavior data or user profile information; and

generating a command to deliver the training intervention to the user.

10. The method of claim 9 , further comprising delivering the selected training intervention to the user as a mock situation that comprises an interactive intervention.

11. The method of claim 9 , further comprising, by the one or more processors of the cloud-based system:

recording a response of the user to the selected training intervention; and

storing the response with the historical user training data or user behavior data in a data storage system.

12. The method of claim 9 , wherein determining that the user has performed an action that may subject the user to a threat scenario comprises, by the one or more processors of the cloud-based system:

using a risk model to determine, based on a frequency of the user's performance of the action, a susceptibility of the user falling victim to the threat scenario; and

determining that the frequency exceeds a risk threshold based on a cost associated with the threat scenario.

13. The method of claim 12 , wherein selecting the training intervention comprises, by the one or more processors of the cloud-based system:

using the risk model to identify a combination of training interventions; and

prioritizing the identified training interventions in the combination.

14. The method of claim 9 , further comprising, by the one or more processors of the cloud-based system:

sending a list of available training interventions to a system administrator for review and selection; and

causing the selected training intervention to be delivered to the user in response to the system administrator's selection.

15. The method of claim 9 , further comprising, by the one or more processors of the cloud-based system:

sending the selected training intervention to the user via the electronic device;

receiving feedback from user interaction with the training intervention; and

based on the feedback, selecting and sending an additional training intervention to the user via an electronic device.

16. A cybersecurity training system, comprising:

a first computer-readable memory portion containing a collection of available cybersecurity training interventions;

a second computer-readable memory portion containing a risk model comprising a susceptibility estimate of a user of an electronic device falling victim to a cybersecurity threat scenario;

a sensor device comprising:

a USB sensor device configured to detect that the user has connected a USB device to the electronic device, or

a Wi-Fi sensor device configured to detect that the user has connected or attempted to connect the electronic device to a Wi-Fi access point; and

a computer system comprising one or more processors and computer-readable instructions that, when executed by the one or more processors, cause the computer system to:

receive, from the sensor device, a sensed action of the user, wherein the sensed action comprises:

that the user has connected a USB device to the electronic device, or

that the user has connected or attempted to connect the electronic device to a Wi-Fi access point; and

determine, based on the sensed data and the risk model, that the user is at risk for a cybersecurity threat scenario;

select, based on the cybersecurity threat scenario, a cybersecurity training intervention from the collection; and

generate a command to deliver the cybersecurity selected training intervention to the user via an electronic device.

17. The system of claim 16 , wherein the instructions for determining that the user is at risk for a cybersecurity threat scenario comprise instructions to generate a command to sense a user's response to a mock attack situation.

18. The system of claim 16 , wherein the instructions for selecting the cybersecurity training intervention comprise instructions to:

use the risk model to identify a combination of cybersecurity training interventions; and

prioritize the identified cybersecurity training interventions in the combination.

19. The system of claim 16 , further comprising instructions that, when executed by the one or more processors, cause the computer system to:

send the selected cybersecurity training intervention to the user via an electronic device;

receive feedback from user interaction with the cybersecurity training intervention; and

based on the feedback, select and send an additional cybersecurity training intervention to the user via an electronic device.

20. The system of claim 16 , further comprising instructions that, when executed by the one or more processors, cause the computer system to customize the selected cybersecurity training intervention based on the performed action or information about the user other than the performed action, the information comprising user behavior data, historical user data, or user profile information.

Assignments (9)