Educating computer users concerning security threats
View Patent ↗Attacks are simulated to a user, by performing the steps of the attacks without actually performing any malicious activity. Educational security information is displayed to the user, based on the user's response to simulated attacks. If the user responds to a simulated attack in a manner indicating that the user is vulnerable, educational security information can be displayed that educates the user as to how to avoid being victimized. One or more security settings for protecting the user's computer from malware can be adjusted, based on the user's response to the simulating of attacks. Additionally, other factors can be adjusted based on the user's response to the simulating of attacks, such as a security hygiene rating and/or a level of monitoring activity concerning the user.
1. A computer implemented method for educating and protecting users concerning attacks through attack simulation, the method comprising the steps of:
selecting a user to for attack simulation based on a security hygiene rating, wherein the security hygiene rating is based on a history of security events for the user;
simulating, by a computer, the specific attack against the user, wherein the attack targets a user action to perform the attack;
receiving a user action in response to the simulated specific attack;
displaying educational security information to the user concerning best practices for the user including steps to avoid being victimized, based on the user's response to the simulating of the specific attack, said educational security information describing the specific attack;
adjusting the security hygiene rating concerning the user, based on the user's response to the simulated specific attack; and
automatically adjusting, based on the security hygiene rating of the user, at least one security setting for protecting a computer operated by the user from malware.
2. The method of claim 1 wherein simulating, by a computer, the specific attack further comprises:
simulating, by a computer, activities performed during the specific attack, without performing any malicious activity.
3. The method of claim 1 wherein displaying, by a computer, educational security information to the user, based on the user's response to the simulating of the specific attack, further comprises:
based on the user responding to the simulating of the specific attack in a manner indicating that the user is vulnerable to being victimized by the specific attack, displaying, by a computer, educational security information educating the user as to how to avoid being victimized by the specific attack.
4. The method of claim 1 wherein displaying, by a computer, educational security information to the user further comprises:
displaying, by a computer, educational security information educating the user as to the workings of attacks, and specific steps to take to in order to avoid being victimized by attacks.
5. The method of claim 1 further comprising:
installing, by a computer, an attack description update concerning a new attack;
simulating, by a computer, the new attack;
displaying, by a computer, educational security information to the user, based on the user's response to the simulating of the new attack, said educational security information describing the new attack; and
adjusting, by a computer, at least one security setting for protecting the computer operated by the user from malware, based on the user's response to the simulating of the new attack.
6. The method of claim 1 further comprising:
adjusting, by a computer, a level of monitoring activity concerning the user, based on the user's response to the simulating of at least one attack.
7. At least one non-transitory computer readable storage medium storing a computer program product for educating and protecting users concerning attacks through attack simulation, the computer program product comprising program code to perform a method comprising the steps of:
selecting a user to for attack simulation based on a security hygiene rating, wherein the security hygiene rating is based on a history of security events for the user;
simulating the specific attack against the user, wherein the attack targets a user action to perform the attack;
receiving a user action in response to the simulated specific attack;
displaying educational security information to the user concerning best practices for the user including steps to avoid being victimized, based on the user's response to the simulating of the specific attack, said educational security information describing the specific attack;
adjusting the security hygiene rating concerning the user, based on the user's response to the simulated specific attack; and
automatically adjusting, based on the security hygiene rating of the user, at least one security setting for protecting a computer operated by the user from malware.
8. The computer program product of claim 7 wherein the program code for simulating the specific attack further comprises:
program code for simulating activities performed during the specific attack, without performing any malicious activity.
9. The computer program product of claim 7 wherein the program code for displaying educational security information to the user, based on the user's response to the simulating of the specific attack, further comprises:
program code for, based on the user responding to the simulating of the specific attack in a manner indicating that the user is vulnerable to being victimized by the specific attack, displaying educational security information educating the user as to how to avoid being victimized by the specific attack.
10. The computer program product of claim 7 wherein the program code for displaying educational security information to the user further comprises:
program code for displaying educational security information educating the user as to the workings of attacks, and specific steps to take to in order to avoid being victimized by attacks.
11. The computer program product of claim 7 further comprising:
program code for installing an attack description update concerning a new attack;
program code for simulating the new attack;
program code for displaying educational security information to the user, based on the user's response to the simulating of the new attack, said educational security information describing the new attack; and
program code for adjusting at least one security setting for protecting the computer operated by the user from malware, based on the user's response to the simulating of the new attack.
12. The computer program product of claim 7 further comprising:
program code for adjusting a level of monitoring activity concerning the user, based on the user's response to the simulating of at least one attack.
13. A computer system for educating and protecting a user concerning attacks through attack simulation, the computer system comprising:
at least one processor; and
a computer memory comprises:
an attack simulator module to simulate a specific attack against the user, wherein the attack targets a user action to perform the attack, and to receive a user action in response to the simulated attack;
an user educator module to display educational security information to the user concerning best practices including steps to avoid being victimized, based on the user's response to the simulating of the specific attack, said educational security information describing the specific attack; and
a settings adjustment module to adjust the security hygiene rating concerning the user, based on the user's response to the simulated specific attack, and to automatically adjust based on the user's response to the simulating of the specific attack, at least one security setting for protecting a computer operated by the user from malware.
14. The computer system of claim 13 wherein the attack simulator module simulating the specific attack further comprises:
the attack simulating module simulating activities performed during the specific attack, without performing any malicious activity.
15. The computer system of claim 13 wherein displaying educational security information to the user, based on the user's response to the simulating of the specific attack, further comprises:
the settings adjusting module adjusting, based on the user responding to the simulating of the specific attack in a manner indicating that the user is vulnerable to being victimized by the specific attack, displaying educational security information educating the user as to how to avoid being victimized by the specific attack.
16. The computer system of claim 13 wherein displaying educational security information to the user further comprises:
the user educating module displaying educational security information educating the user as to the workings of attacks, and specific steps to take to in order to avoid being victimized by attacks.
17. The computer system of claim 13 further comprising:
an update installing module, in the memory, to install an attack description update concerning a new attack,
wherein the attack simulator module simulates the new attack,
wherein the user education module displays educational security information to the user, based on the user's response to the simulating of the new attack, said educational security information describing the new attack, and
wherein the settings adjustment module adjusts at least one security setting for protecting the computer operated by the user from malware, based on the user's response to the simulating of the new attack.
18. The computer system of claim 13 further comprising:
a monitoring adjustment module to adjust a level of monitoring activity concerning the user, based on the user's response to the simulating of at least one attack.
19. The method of claim 1 , wherein the security hygiene rating is determined by one of: whether the user has been subject to attempted malware attacks, whether attacks on the user have been successful, and how often the user browses high risk web sites.