System and method for comprehensive data loss prevention and compliance management
A system and method to identify and prevent cybersecurity attacks on modern, highly-interconnected networks, to identify attacks before data loss occurs, using a combination of human level, device level, system level, and organizational level monitoring.
1. A system for comprehensive data loss prevention and compliance management, comprising:
a hardware processor and memory;
time series and graph-based data store comprising at least a plurality of programming instructions stored in the memory of, and operating on at least one hardware processor of, a computing device, wherein the plurality of programming instructions, when operating on the hardware processor, cause the computing device to:
monitor a plurality of network events;
produce time-series data comprising at least a record of a network event and the time at which the event occurred;
an observation and state estimation module comprising at least a plurality of programming instructions stored in the memory of, and operating on at least one hardware processor of, a computing device, wherein the plurality of programming instructions, when operating on the hardware processor, cause the computing device to: monitor a plurality of connected resources on a network;
produce a cyber-physical graph representing at least a portion of the plurality of connected resources, the cyber-physical graph comprising at least the logical relationships between the portion of the plurality of connected resources on the network and the physical relationships between any connected resources that comprise at least a hardware device;
a directed computational graph module comprising at least a plurality of programming instructions stored in the memory of, and operating on at least one hardware processor of, a computing device, wherein the plurality of programming instructions, when operating on the hardware processor, cause the computing device to: perform a plurality of analysis and transformation operations on at least a portion of the time-series data;
perform a plurality of analysis and transformation operations on at least a portion of the cyber-physical graph;
an activity monitoring engine comprising at least a plurality of programming instructions stored in the memory of, and operating on at least one processor of, a computing device, wherein the plurality of programming instructions, when operating on the hardware processor, cause the computing device to: access models of expected behavior of people, devices, systems, and organizations within a network;
gather and store data on actual behaviors of people, devices, systems, and organizations within a network by monitoring a plurality of network events;
detect deviations of the actual behaviors of people, devices, systems, and organizations from the expected behaviors of people, devices, systems, and organizations using at least one comparative algorithm;
when deviations are detected, send information about the deviation to a risk analysis and scoring engine;
and a risk analysis and scoring engine comprising at least a plurality of programming instructions stored in the memory of, and operating on at least one hardware processor of, a computing device, wherein the plurality of programming instructions, when operating on the hardware processor, cause the computing device to: receive deviation information from the activity monitoring engine;
analyze the severity of the threat posed by the deviation using at least one analysis algorithm;
generate a risk score based on a plurality of factors which indicate the severity of the threat; display the risk score in text and graphical form.
2. The system of claim 1 , wherein the plurality of analysis and transformation operations performed on at least a portion of the cyber-physical graph comprise the calculation of an impact assessment score for each of a portion of the resources in the graph.
3. The system of claim 2 , wherein the plurality of analysis and transformation operations performed on at least a portion of the time-series data comprise the calculation of the overall impact of a cyberattack, wherein the calculation is based at least in part on the impact assessment score for each resource affected by the cyberattack.
4. The system of claim 1 , wherein the plurality of analysis and transformation operations performed on at least a portion of the cyber-physical graph comprise a comparison of relationships between resources against known security vulnerabilities.
5. The system of claim 4 , wherein the analysis and scoring produced by the risk analysis and scoring engine are based at least in part on the results of the comparison against known security vulnerabilities.
6. The system of claim 1 , wherein the observation and state estimation module is further configured to produce a visualization based at least in part on at least a portion of the time-series data, wherein the visualization illustrates changes to the data over time.
7. A method for comprehensive data loss prevention and compliance management, comprising the steps of:
monitoring, using a time series and graph based data store comprising at least a plurality of programming instructions stored in the memory of, and operating on at least one processor of, a computing device, a plurality of network events;
producing time-series data comprising at least a record of a network event and the time at which the event occurred;
monitoring, using an observation and state estimation module comprising at least a plurality of programming instructions stored in the memory of, and operating on at least one processor of, a computing device, a plurality of connected resources on a network;
producing a cyber-physical graph representing at least a portion of the plurality of connected resources, the cyber-physical graph comprising at least the logical relationships between the portion of the plurality of connected resources on the network and the physical relationships between any connected resources that comprise at least a hardware device;
performing, using a directed computational graph module comprising at least a plurality of programming instructions stored in the memory of, and operating on at least one processor of, a computing device, a plurality of analysis and transformation operations on at least a portion of the time-series data;
performing a plurality of analysis and transformation operations on at least a portion of the cyber-physical graph;
accessing, using an activity monitoring engine comprising at least a plurality of programming instructions stored in the memory of, and operating on at least one processor of, a computing device, models of expected behavior of people, devices, systems, and organizations within a network;
gathering and storing data on actual behaviors of people, devices, systems, and organizations within a network by monitoring a plurality of network events;
detecting deviations of the actual behaviors of people, devices, systems, and organizations from the expected behaviors of people, devices, systems, and organizations using at least one comparative algorithm;
when deviations are detected, sending information about the deviation to a risk analysis and scoring engine;
receiving, at a risk analysis and scoring engine comprising at least a plurality of programming instructions stored in the memory of, and operating on at least one processor of, a computing device, deviation information from the activity monitoring engine;
analyzing the severity of the threat posed by the deviation using at least one analysis algorithm;
generating a risk score based on a plurality of factors which indicate the severity of the threat; and
displaying the risk score in text and graphical form.
8. The method of claim 7 , wherein the plurality of analysis and transformation operations performed on at least a portion of the cyber-physical graph comprise the calculation of an impact assessment score for each of a portion of the resources in the graph.
9. The method of claim 8 , wherein the plurality of analysis and transformation operations performed on at least a portion of the time-series data comprise the calculation of the overall impact of a cyberattack, wherein the calculation is based at least in part on the impact assessment score for each resource affected by the cyberattack.
10. The method of claim 7 , wherein the plurality of analysis and transformation operations performed on at least a portion of the cyber-physical graph comprise a comparison of relationships between resources against known security vulnerabilities.
11. The method of claim 10 , wherein the analysis and scoring produced by the risk analysis and scoring engine are based at least in part on the results of the comparison against known security vulnerabilities.
12. The method of claim 7 , wherein the observation and state estimation module is further configured to produce a visualization based at least in part on at least a portion of the time-series data, wherein the visualization illustrates changes to the data over time.