Method and system for controlling context-aware cybersecurity training
View Patent ↗A context-aware training system senses a user action that may expose the user to a threat, such as a cybersecurity threat. The system selects a training action from a collection of available training actions and causes the training action to be delivered to the user or a group of users. The system includes an administrator interface that enables an administrator to select, customize and/or assign constraints to the training action that will be delivered to the user(s).
1. A cybersecurity training system, comprising:
one or more data storage devices that store:
at least one cybersecurity training intervention, and
a training needs model;
an electronic device comprising one or more sensors that sense data relating to behavior or activity of at least one user of the electronic device, wherein the one or more sensors comprise one or more of the following:
a USB device sensor configured to detect when a USB drive has been connected to the electronic device,
a Wi-Fi sensor configured to detect a Wi-Fi access point to which the electronic device is connected, or
a Wi-Fi sensor configured to detect whether the at least one user has attempted to connect the electronic device to a mock rogue Wi-Fi access point;
an analysis host computer comprising a computer-readable memory portion holding programming instructions that, when executed, instruct one or more processors of the analysis host computer to implement a policy manager that:
receives the sensed data from the electronic device via a communications network;
analyzes the sensed data by applying the training needs model to the sensed data to determine whether the at least one user may be at risk for a threat scenario, and
identifies, from the at least one cybersecurity training intervention, a set of one or more policy manager-identified cybersecurity training interventions that are relevant to the threat scenario;
a computer-readable memory portion holding programming instructions that, when executed, instruct one or more processors to implement a system administrator interface that displays the set of one or more policy manager-identified cybersecurity training interventions and receives a selection of an intervention in the set via the system administrator interface; and
a computer-readable memory portion holding programming instructions that, when executed, instruct one or more processors to generate a command to deliver the selected cybersecurity training intervention to an electronic device for presentation to the at least one user.
2. The system of claim 1 , wherein the instructions that implement the system administrator interface also comprise instructions to receive a customization of the selected cybersecurity training intervention via the system administrator interface.
3. The system of claim 1 , wherein the instructions that implement the system administrator interface also comprise instructions to display parameters of the training needs model, and receive a customization of the training needs model via the system administrator interface.
4. The system of claim 1 , wherein the instructions that implement the system administrator interface also comprise instructions to display logic of the policy manager, and receive a configuration of the policy manager via the system administrator interface.
5. The system of claim 1 , wherein the instructions that implement the system administrator interface also comprise instructions to display analysis results from the policy manager and receive a manipulation of the analysis results-via the system administrator interface.
6. The system of claim 1 , wherein:
the instructions to implement the system administrator interface also comprise instructions to:
display, via the system administrator interface, statistics for a plurality of additional users, and
receive, via the system administrator interface, a selected group of the additional users; and
the system further comprises a computer-readable memory portion holding programming instructions that, when executed, instruct one or more processors to generate a command to deliver the selected cybersecurity training intervention to the selected group of the additional users.
7. The system of claim 1 , wherein:
the threat scenario comprises an SMS attack threat scenario; and
the instructions to implement a system administrator interface that receives a customization for the selected cybersecurity training intervention comprise instructions to:
display, via the system administrator interface, a plurality of SMS attack templates,
receive, via the system administrator interface, a selection of one of the displayed SMS attack templates, and
apply the customization to the selected template so that the customization comprises one or more of any of the following:
automatic insertion of the user's name in the administrator-selected template;
a selected start time or end time for the selected cybersecurity training intervention;
information obtained from a social network or public profile that is relevant to the user;
link selected via the system administrator interface; or
an SMS message edited via the system administrator interface.
8. The system of claim 1 , wherein:
the threat scenario comprises use of a malicious memory device; and
the instructions to implement the system administrator interface that receives a customization for the selected training intervention comprise instructions to:
display, via the system administrator interface, a plurality of mock malicious memory device attack templates,
receive, via the system administrator interface, a selection of one of the displayed mock malicious memory device attack templates, and
apply the customization to the selected template so that the customization comprises a selection of mock malware to include on at least one memory device that will be used in the training intervention.
9. The system of claim 8 , wherein the instructions to implement the system administrator interface that receives a customization of the selected training intervention also comprise instructions to receive any the following:
one or more locations at which the devices are to be delivered; or
a selection of mock malware to include on the devices.
10. The system of claim 2 , wherein:
the instructions to implement the system administrator interface also comprise instructions to:
display, via the system administrator interface, identification information for a plurality of additional users,
receive, via the system administrator interface, a selected group of the additional users, and
receive the customization such that different mock attacks are provided to various members of the selected group; and
the system further comprises a computer-readable memory portion holding programming instructions that, when executed, instruct one or more processors to generate a command to deliver the selected cybersecurity training intervention with the customization to the selected group of additional users.
11. The system of claim 1 , wherein:
the instructions to implement the system administrator interface also comprise instructions to implement a user interface portion that enables receipt of a selection of:
one or more scheduling constraints for the selected training intervention, and
one or more additional users to whom the selected training intervention will be delivered; and
the system further comprises a computer-readable memory portion holding programming instructions that, when executed, instruct one or more processors to generate a command to deliver the selected cybersecurity training intervention to the additional users in accordance with the scheduling constraints.
12. A method of providing an administrator interface for a cybersecurity training system, comprising:
maintaining, on one or more data storage devices, one or more training interventions and a training needs model;
by one or more sensors of an electronic device, sensing data relating to behavior or activity of at least one user of the electronic device, wherein the one or more sensors comprise one or more of the following:
a USB device sensor configured to detect when a USB drive has been connected to the electronic device,
a Wi-Fi sensor configured to detect a Wi-Fi access point to which the electronic device is connected, or
a Wi-Fi sensor configured to detect whether the at least one user has attempted to connect the electronic device to a mock rogue Wi-Fi access point; and
by a processor of an analysis host computer:
receiving the sensed data from the one or more sensors via a communication network,
applying the training needs model to the received data to determine whether the at least one user may be at risk of a threat scenario,
identifying one or more of the training interventions that are relevant to the threat scenario,
displaying, via the system administrator interface, the identified one or more training interventions,
receiving, via the system administrator interface, a selection of a displayed cybersecurity training intervention, and
generating a command to deliver the selected cybersecurity training intervention to an electronic device for output to the at least one user.
13. The method of claim 12 , further comprising, by the processor:
receiving, via the system administrator interface, a customization for the selected training intervention; and
when generating the command to deliver the selected training intervention to the user, generating a command to deliver the customization of the selected training intervention.
14. The method of claim 12 , further comprising, by the processor, causing the system administrator interface to perform one or more of the following:
display parameters of the training needs model, and receive a customization of the training needs model via the system administrator interface;
display logic of the policy manager, and receive a configuration of the policy manager via the system administrator interface; or
display an output of data from the policy manager and receive a manipulation of the output data via the system administrator interface.
15. The method of claim 12 , further comprising, by the processor:
causing the system administrator interface to:
display, via the system administrator interface, statistics for a plurality of additional users, and
receive, via the system administrator interface, a selected group of the additional users; and
generating a command to deliver the selected training intervention to the selected group of the additional users.
16. The method of claim 15 , further comprising, by the processor, causing the system administrator interface to display the statistics so that the statistics are presented, sorted and/or compiled according to criteria that are selected via the system administrator interface.
17. The method of claim 12 , wherein:
the threat scenario comprises an SMS attack threat scenario; and
receiving the customization for the selected training intervention comprises:
displaying, via the system administrator interface, a plurality of SMS attack templates,
receiving, via the system administrator interface, a selection of one of the displayed SMS attack templates, and
applying the customization to the selected template so that the customization comprises one or more of any of the following:
automatic insertion of the at least one user's name in the template;
a selected start time or end time for the administrator-selected training intervention;
information obtained from a social network or public profile that is relevant to the at least one user; or
an SMS message edited via the system administrator interface.
18. The method of claim 12 , wherein:
the threat scenario comprises use of a malicious memory device; and
receiving the customization for the selected training intervention comprises:
displaying, via the system administrator interface, a plurality of mock malicious memory device attack training templates,
receiving, via the system administrator interface, a selection of one of the displayed mock malicious memory device attack training templates, and
applying the customization to the selected template so that the customization comprises a selection of mock malware to include on one or more memory devices that will be used in the training intervention.
19. The method of claim 12 , wherein receiving the customization for the selected training intervention also comprises receiving one or more of any the following:
one or more locations at which the one or more devices are to be delivered, or
a selection of mock malware to include on the devices.
20. The method of claim 12 , further comprising:
displaying, via the system administrator interface, identification information for a plurality of additional users;
receiving, via the system administrator interface, a selected group of the additional users;
receiving the customization such that different mock attacks are provided to various members of the selected group; and
generating a command to deliver the selected training intervention with the customization to the selected group of the additional users.
21. The method of claim 12 , further comprising implementing a portion of the system administrator interface that enables receipt of a selection of:
one or more scheduling constraints for the selected training intervention; and
one or more additional users to whom the selected training intervention will be delivered;
wherein the instructions also include instructions to generate a command to deliver the selected cybersecurity training intervention to the electronic device in accordance with the scheduling constraints.
22. A method of providing an administrator interface for a cybersecurity training system, comprising:
maintaining, on one or more data storage devices, at least one cybersecurity training intervention;
by one or more sensors of an electronic device, receiving data relating to behavior or activity of at least one user of the electronic device, wherein the one or more sensors comprise one or more of the following:
a USB device sensor configured to detect when a USB drive has been connected to the electronic device,
a Wi-Fi sensor configured to detect a Wi-Fi access point to which the electronic device is connected, or
a Wi-Fi sensor configured to detect whether the at least one user has attempted to connect the electronic device to a mock rogue Wi-Fi access point; and
by a processor of an analysis host computer; and
by a processor of an analysis host computer:
receiving the data from the electronic device via a communication network,
applying a training needs model to the received data to determine whether the at least one user may be at risk for a threat scenario,
displaying, via a system administrator interface, a representation of a measurement of whether the at least one user may be at risk for the threat scenario,
identifying one or more of the cybersecurity training interventions that are relevant to the threat scenario,
displaying, via the system administrator interface, the identified one or more cybersecurity training interventions,
receiving, via the system administrator interface, a selection of one of the displayed cybersecurity training interventions,
receiving a customization for the selected cybersecurity training intervention, and
generating a command to deliver the selected cybersecurity training intervention with the customization to an electronic device for presentation to the at least one user.
23. The method of claim 22 , further comprising:
displaying, via the system administrator interface, identification information for a plurality of additional users;
receiving, via the system administrator interface, a selected group of the additional users; and
generating a command to deliver the selected cybersecurity training intervention with the customization to the selected group of the additional users.
24. The method of claim 22 , further comprising implementing a user interface portion of the system administrator interface that enables receipt of a selection of:
one or more scheduling constraints for the selected cybersecurity training intervention; and
an identification of one or more additional users to whom the selected cybersecurity training intervention will be delivered;
wherein the instructions also include instructions to generate a command to deliver the selected cybersecurity training intervention with the customization to the additional users in accordance with the scheduling constraints.
25. A cybersecurity training system, comprising:
one or more data storage devices that store:
at least one training intervention, and
a training needs model;
an electronic device comprising one or more sensors that sense data relating to behavior or activity of at least one user of the electronic device, wherein the one or more sensors comprise one or more of the following:
a USB device sensor configured to detect when a USB drive has been connected to the electronic device,
a Wi-Fi sensor configured to detect a Wi-Fi access point to which the electronic device is connected, or
a Wi-Fi sensor configured to detect whether the at least one user has attempted to connect the electronic device to a mock rogue Wi-Fi access point;
an analysis host computer comprising one or more processors and a computer-readable memory portion holding programming instructions that, when executed, instruct the one or more processors of the analysis host computer to implement a policy manager that:
receives the sensed data from the electronic device via a communication network, and
analyzes the sensed data relating to at least one user by applying the training needs model to the sensed data to determine whether the at least one user may be at risk for a threat scenario; and
a computer-readable memory portion holding programming instructions that, when executed, instruct one or more processors to implement a system administrator interface that is configured to perform at least one of the following actions:
display parameters of the training needs model and receive a customization of the training needs model via the system administrator interface, or
display logic of the policy manager and receive a configuration of the logic the system administrator interface;
wherein the system is also configured to, upon completion of at least one of the actions of the system administrator interface:
select one or more of the training interventions that are relevant to the threat scenario, and
generate a command to deliver the selected training intervention to an electronic device for presentation to the at least one user.
26. The system of claim 25 , wherein the system administrator interface is also configured to perform at least one of the following actions:
display the one or more selected training interventions and allow the administrator to select a subset to be delivered; or
receive, via the system administrator interface, a customization of one of the training interventions to be delivered.
27. The system of claim 25 , wherein:
the instructions to implement the system administrator interface also comprise instructions to:
display, via the system administrator interface, statistics for a plurality of additional users, and
receive, via the system administrator interface, a selected group of the additional users; and
the instructions to generate the command also comprise instructions to generate a command to deliver the selected training intervention to the selected group of the additional users.
28. The system of claim 27 , wherein the instructions to implement the system administrator interface also comprise instructions to display the statistics so that the administrator can have the statistics presented, sorted and/or compiled according to selected criteria.