Identifying and remediating phishing security weaknesses
A threat management facility generates a simulated phishing threat based on one or more characteristics of a network user. Based on whether the user fails to respond appropriately to the simulated phishing threat, the threat management facility may implement one or more prophylactic measures to remediate the security weakness exposed by the user's failure to respond appropriately to the simulated phishing threat. For example, a security policy for an endpoint associated with the user may be adjusted to address the security weakness. Additionally, or alternatively, the user may be enrolled in training directed at reducing the likelihood that the user will be the victim of an actual phishing attack in the future.
1. A system for improving security of computer networks by identifying and remediating phishing security weaknesses associated with a particular user identifier, the system comprising:
one or more endpoints coupled to an enterprise network; and
a threat management facility for the enterprise network in a communicating relationship with the one or more endpoints, the threat management facility including a processor and a memory, the memory bearing computer executable code configured to be executed by the processor to perform the steps of:
selecting a security weakness for a user identifier associated with a user in the enterprise network;
generating a response object corresponding to the security weakness, wherein access to the response object identifies an action by the user exposing the security weakness;
generating an electronic communication containing the response object;
transmitting the electronic communication to the user;
detecting a request from an endpoint for the response object;
determining that a threat assessment failure has exposed the security weakness of the user on the endpoint based on detecting the request for the response object;
identifying one or more additional computing devices associated with the user based on a unique identifier for the user in the response object and a database of user information for the enterprise network;
communicating an adjustment for a security policy for the endpoint and the one or more additional computing devices associated with the user to a network device between the endpoint and a network external to the enterprise network;
at the network device, adjusting the security policy for the user identifier associated with the user, wherein adjusting the security policy includes limiting at least one of application usage or network usage for the user identifier to address the security weakness exposed by the threat assessment failure; and
restricting access to resources by the endpoint and the one or more additional computing devices with the network device in response to the security policy.
2. The system of claim 1 , wherein the threat management facility is in a communicating relationship with the one or more endpoints via a heartbeat system.
3. The system of claim 1 , wherein the network device is an endpoint, a firewall, or a wireless access point.
4. The system of claim 1 , wherein the response object is a Uniform Resource Locator (URL).
5. A method for improving security of computer networks by identifying and remediating phishing security weaknesses associated with a particular user identifier, the method comprising:
selecting a security weakness for a user identifier associated with a user in an enterprise network;
generating a response object corresponding to the security weakness, wherein access to the response object identifies an action by the user exposing the security weakness;
generating an electronic communication containing the response object;
transmitting the electronic communication to the user;
detecting a request from an endpoint for the response object;
determining that a threat assessment failure has exposed the security weakness of the user on the endpoint based on detecting the request for the response object;
identifying one or more additional computing devices associated with the user based on a unique identifier for the user in the response object and a database of user information for the enterprise network;
at a network device between the endpoint and a network external to the enterprise network, adjusting a security policy for the endpoint and the one or more additional computing devices associated with the user, wherein adjusting the security policy includes limiting at least one of application usage or network usage for the user identifier to address the security weakness exposed by the threat assessment failure; and
controlling access to resources by the endpoint and the one or more additional computing devices with the network device based on the security policy.
6. The method of claim 5 , wherein adjusting the security policy includes increasing detection sensitivity on the endpoint for at least one of a static detection antimalware agent, a dynamic behavior antimalware agent, a firewall, a blacklist, and a whitelist.
7. The method of claim 5 , wherein adjusting the security policy includes updating one or more security programs to a most recent version.
8. The method of claim 5 , wherein the electronic communication includes at least an attached document, the user identifier, and executable code embedded within the attached document, the executable code configured transmit the response object and the user identifier from the endpoint when the attached document is opened.
9. The method of claim 8 , wherein the electronic communication includes human readable text including an instruction to the user to open the attached document.
10. The method of claim 8 , wherein the attached document is of a file type associated with one or more of a word processing file, a spreadsheet file, an accounting file, an archive file, an image file, a presentation file, and a database file.
11. The method of claim 5 , further comprising, in response to detecting the request for the response object, providing educational material to the user, the education material including training content associated with the security weakness.
12. The method of claim 11 , further comprising tracking progress of the user through the training content and retesting the user on adherence to the training content after a predetermined interval.
13. The method of claim 5 , wherein generating the electronic communication includes customizing the electronic communication for the user.
14. The method of claim 13 , wherein generating the electronic communication includes customizing the electronic communication for at least one of a name, the user identifier, a title, or an organizational role of the user.
15. The method of claim 5 , wherein the security weakness includes one or more of a phishing vulnerability and missing security updates.
16. The method of claim 5 , further comprising, in response to detecting the request for the response object, automatically enrolling the user in a program including training content associated with the security weakness.
17. A computer program product for improving security of computer networks by identifying and remediating phishing security weaknesses associated with a particular user identifier, the computer program product comprising non-transitory computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
selecting a security weakness for a user identifier associated with a user in an enterprise network;
generating a response Uniform Resource Locator (URL) corresponding to the security weakness, wherein access to the response URL identifies an action by the user exposing the security weakness;
generating an electronic communication containing the response URL;
transmitting the electronic communication to the user;
detecting a request from an endpoint for the response URL;
determining that a threat assessment failure related to the security weakness of the user has occurred on the endpoint based on detecting the request for the response URL;
identifying one or more additional computing devices associated with the user based on a unique identifier for the user in the response URL and a database of user information for the enterprise network;
at a network device between the endpoint and a network external to the enterprise network, adjusting a security policy for the endpoint and the one or more additional computing devices associated with the user, wherein adjusting the security policy includes limiting at least one of application usage or network usage for the user identifier to address the security weakness exposed by the threat assessment failure; and
controlling access to resources by the endpoint and the one or more additional computing devices with the network device based on the security policy.
18. The computer program product of claim 17 , wherein adjusting the security policy includes increasing detection sensitivity on the endpoint for at least one of a static detection antimalware agent, a dynamic behavior antimalware agent, a firewall, a blacklist, and a whitelist.