Adaptive trust profile reference architecture
A system, method, and computer-readable medium are disclosed for generating an adaptive trust profile via an adaptive trust profile operation. In various embodiments the adaptive trust profile operation includes: monitoring an electronically-observable action of an entity, the electronically-observable action of the entity corresponding to an event enacted by the entity; converting the electronically-observable action of the entity to electronic information representing the action of the entity; generating an entity profile based upon the action of the entity; and, using the entity profile to generate the adaptive trust profile.
1. A computer-implementable method for generating an adaptive trust profile, comprising:
monitoring an electronically-observable action of an entity, the electronically-observable action of the entity corresponding to an event enacted by the entity;
converting the electronically-observable action of the entity to electronic information representing the action of the entity;
generating an entity profile based upon the action of the entity, the entity profile comprising a collection of information that uniquely describes an identity of the entity, the collection of information comprising a user profile attribute;
using the entity profile to generate the adaptive trust profile, the adaptive trust profile comprising a collection of information that describes a particular entity;
deriving an inference regarding the action of the entity using the adaptive trust profile;
performing a security analytics operation via a security analytics system, the security analytics system executing on a hardware processor of an information handling system, the security analytics operation using the inference regarding the entity to determine whether a particular event is of analytic utility, the particular event being of analytic utility indicating the action of the entity represents a security risk; and,
mitigating the security risk via the security analytics system based upon the inference when the particular event is of analytic utility.
2. The method of claim 1 , wherein:
the profile attribute is used to generate the adaptive trust profile.
3. The method of claim 2 , wherein:
the entity profile attribute is used to ascertain an identity of the entity.
4. The method of claim 2 , wherein:
the entity profile attribute comprises an authentication factor.
5. The method of claim 2 , wherein:
the profile attribute comprises a user profile attribute; and,
the user profile attribute comprises personal information associated with a user entity.
6. The method of claim 5 , wherein:
the personal information associated with the user entity comprises at least one of the non-sensitive personal information associated with a user entity, technical skill level information, peer information, expense account information, paid time off (PTO) information, data analysis information, insider information, misconfiguration information, third party information and sensitive personal information associated with the user entity.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
monitoring an electronically-observable action of an entity, the electronically-observable action of the entity corresponding to an event enacted by the entity;
converting the electronically-observable action of the entity to electronic information representing the action of the entity;
generating an entity profile based upon the action of the entity, the entity profile comprising a collection of information that uniquely describes an identity of the entity, the collection of information comprising a user profile attribute;
using the entity profile to generate the adaptive trust profile, the adaptive trust profile comprising a collection of information that describes a particular entity
deriving an inference regarding the action of the entity using the adaptive trust profile;
performing a security analytics operation via a security analytics system, the security analytics system executing on a hardware processor of an information handling system, the security analytics operation using the inference regarding the entity to determine whether a particular event is of analytic utility, the particular event being of analytic utility indicating the action of the entity represents a security risk; and,
mitigating the security risk via the security analytics system based upon the inference when the particular event is of analytic utility.
8. The system of claim 7 , wherein:
the profile attribute is used to generate the adaptive trust profile.
9. The system of claim 8 , wherein:
the entity profile attribute is used to ascertain an identity of the entity.
10. The system of claim 8 , wherein:
the entity profile attribute comprises an authentication factor.
11. The system of claim 8 , wherein:
the profile attribute comprises a user profile attribute; and,
the user profile attribute comprises personal information associated with a user entity.
12. The system of claim 11 , wherein:
the personal information associated with the user entity comprises at least one of the non-sensitive personal information associated with a user entity, technical skill level information, peer information, expense account information, paid time off (PTO) information, data analysis information, insider information, misconfiguration information, third party information and sensitive personal information associated with the user entity.
13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
monitoring an electronically-observable action of an entity, the electronically-observable action of the entity corresponding to an event enacted by the entity;
converting the electronically-observable action of the entity to electronic information representing the action of the entity;
generating an entity profile based upon the action of the entity, the entity profile comprising a collection of information that uniquely describes an identity of the entity, the collection of information comprising a user profile attribute;
using the entity profile to generate the adaptive trust profile, the adaptive trust profile comprising a collection of information that describes a particular entity;
deriving an inference regarding the action of the entity using the adaptive trust profile;
performing a security analytics operation via a security analytics system, the security analytics system executing on a hardware processor of an information handling system, the security analytics operation using the inference regarding the entity to determine whether a particular event is of analytic utility, the particular event being of analytic utility indicating the action of the entity represents a security risk; and,
mitigating the security risk via the security analytics system based upon the inference when the particular event is of analytic utility.
14. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the profile attribute is used to generate the adaptive trust profile.
15. The non-transitory, computer-readable storage medium of claim 14 , wherein:
the entity profile attribute is used to ascertain an identity of the entity.
16. The non-transitory, computer-readable storage medium of claim 14 , wherein:
the entity profile attribute comprises an authentication factor.
17. The non-transitory, computer-readable storage medium of claim 14 , wherein:
the profile attribute comprises a user profile attribute; and,
the user profile attribute comprises personal information associated with a user entity.
18. The non-transitory, computer-readable storage medium of claim 17 , wherein:
the personal information associated with the user entity comprises at least one of the non-sensitive personal information associated with a user entity, technical skill level information, peer information, expense account information, paid time off (PTO) information, data analysis information, insider information, misconfiguration information, third party information and sensitive personal information associated with the user entity.
19. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are deployable to a client system from a server system at a remote location.
20. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are provided by a service provider to a user on an on-demand basis.