Adaptive remediation of multivariate risk
A method, system and computer-usable medium for adaptively remediating multivariate risk, comprising: detecting a violation of a multivariate security policy, the multivariate security policy comprising a plurality of variables; identifying a variable from the plurality of variables associated with a cause of the violation; associating an entity with the variable associated with the cause of the violation; and, adaptively remediating a risk associated with the entity.
1. A computer-implementable method for adaptively remediating multivariate risk by performing a multivariate risk remediation operation, the multivariate risk remediation operation improving processor efficiency by adaptively remediating a risk, comprising:
providing a multivariate security policy, the multivariate security policy comprising a plurality of security policy elements;
assigning each of the plurality of security policy elements a corresponding risk score value, the corresponding risk score values of the plurality of security policy elements providing a multivariate risk score;
detecting a violation of the multivariate security policy, the violation of the multivariate security policy occurring when a respective risk score value of the multivariate risk score meets or exceeds a particular multivariate risk score;
associating an entity with the respective risk score value associated with the cause of the violation; and,
adaptively remediating a risk associated with the entity, the adaptively remediating the risk performing a remediation operation commensurate with a characteristic of the risk, the characteristic of the risk being represented by at least one respective scoring value, the remediation operation mitigating an effect of the risk, the adaptively mitigating the risk being performed via one of a protected endpoint and a security analytics system, the protected endpoint comprising an endpoint agent executing on a hardware processor of an endpoint device, the security analytics system executing on a hardware processor of an information handling system.
2. The method of claim 1 , further comprising:
configuring the multivariate security policy by setting parameters of a plurality of variables.
3. The method of claim 2 , wherein:
the multivariate security policy comprises a rule and an action associated with a particular user; and,
each of the plurality of variables is associated with the rule and the action of the multivariate security policy for the particular user.
4. The method of claim 3 , wherein:
at least some of the plurality of variables comprise risk-adaptive user behavior factors.
5. The method of claim 1 , wherein:
detecting the violation of a multivariate security policy comprises analyzing a plurality of combinations of variables and events.
6. The method of claim 5 , wherein:
analyzing the plurality of combinations of variables and events comprise at least one of analyzing two sets of variables associated with a single entity;
analyzing two sets of variables associated with two entities; and,
analyzing one set of variables associated with two entities.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code for adaptively remediating multivariate risk by performing a multivariate risk remediation operation, the multivariate risk remediation operation improving processor efficiency by adaptively remediating a risk, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
providing a multivariate security policy, the multivariate security policy comprising a plurality of security policy elements;
assigning each of the plurality of security policy elements a corresponding risk score value, the corresponding risk score values of the plurality of security policy elements providing a multivariate risk score;
detecting a violation of the multivariate security policy, the violation of the multivariate security policy occurring when a respective risk score value of the multivariate risk score meets or exceeds a particular multivariate risk score;
associating an entity with the respective risk score value associated with the cause of the violation; and,
adaptively remediating a risk associated with the entity, the adaptively remediating the risk performing a remediation operation commensurate with a characteristic of the risk, the characteristic of the risk being represented by at least one respective scoring value, the remediation operation mitigating an effect of the risk, the adaptively mitigating the risk being performed via one of a protected endpoint and a security analytics system, the protected endpoint comprising an endpoint agent executing on a hardware processor of an endpoint device, the security analytics system executing on a hardware processor of an information handling system.
8. The system of claim 7 , wherein the instructions executable by the processor are further configured for:
configuring the multivariate security policy by setting parameters of a plurality of variables.
9. The system of claim 8 , wherein:
the multivariate security policy comprises a rule and an action associated with a particular user; and,
each of the plurality of variables is associated with the rule and the action of the multivariate security policy for the particular user.
10. The system of claim 9 , wherein:
at least some of the plurality of variables comprise risk-adaptive user behavior factors.
11. The system of claim 7 , wherein:
detecting the violation of a multivariate security policy comprises analyzing a plurality of combinations of variables and events.
12. The system of claim 11 , wherein:
analyzing the plurality of combinations of variables and events comprise at least one of analyzing two sets of variables associated with a single entity;
analyzing two sets of variables associated with two entities; and,
analyzing one set of variables associated with two entities.
13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
providing a multivariate security policy, the multivariate security policy comprising a plurality of security policy elements;
assigning each of the plurality of security policy elements a corresponding risk score value, the corresponding risk score values of the plurality of security policy elements providing a multivariate risk score;
detecting a violation of the multivariate security policy, the violation of the multivariate security policy occurring when a respective risk score value of the multivariate risk score meets or exceeds a particular multivariate risk score;
associating an entity with the respective risk score value associated with the cause of the violation; and,
adaptively remediating a risk associated with the entity, the adaptively remediating the risk performing a remediation operation commensurate with a characteristic of the risk, the characteristic of the risk being represented by at least one respective scoring value, the remediation operation mitigating an effect of the risk, the adaptively mitigating the risk being performed via one of a protected endpoint and a security analytics system, the protected endpoint comprising an endpoint agent executing on a hardware processor of an endpoint device, the security analytics system executing on a hardware processor of an information handling system.
14. The non-transitory, computer-readable storage medium of claim 13 , wherein the computer executable instructions are further configured for:
configuring the multivariate security policy by setting parameters of a plurality of variables.
15. The non-transitory, computer-readable storage medium of claim 14 , wherein:
the multivariate security policy comprises a rule and an action associated with a particular user; and,
each of the plurality of variables is associated with the rule and the action of the multivariate security policy for the particular user.
16. The non-transitory, computer-readable storage medium of claim 15 , wherein:
at least some of the plurality of variables comprise risk-adaptive user behavior factors.
17. The non-transitory, computer-readable storage medium of claim 13 , wherein:
detecting the violation of a multivariate security policy comprises analyzing a plurality of combinations of variables and events.
18. The non-transitory, computer-readable storage medium of claim 17 , wherein:
analyzing the plurality of combinations of variables and events comprise at least one of analyzing two sets of variables associated with a single entity;
analyzing two sets of variables associated with two entities; and,
analyzing one set of variables associated with two entities.
19. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are deployable to a client system from a server system at a remote location.
20. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are provided by a service provider to a user on an on-demand basis.