System and methods for reducing an organization's cybersecurity risk by determining the function and seniority of employees
Systems, methods, and apparatuses directed to implementations of an approach and techniques for more effectively preparing for, detecting, and responding to cybersecurity threats directed at people or at groups of people. Embodiments are directed to classifying or segmenting employees by “predicting” what are believed to be two attributes of an employee that contribute to making them at a higher risk of being a target of a cybersecurity attack. These attributes are the employee's seniority level (e.g., employee, contractor, manager, executive, board member) and the employee's primary function or role in an organization (e.g., HR, Legal, Operations, Finance, Marketing, Sales, R&D, etc.
1. A method of reducing the cybersecurity risk of an organization, comprising:
inputting information about an employee's job characteristics into a trained machine learning model, the trained model operating to respond to the input by producing an output indicating one or more of the employee's seniority level and the employee's role in the organization;
based on the output of the trained model, determining that the employee belongs to a group of employees having access to data, networks, or systems containing proprietary information;
identifying one or more cybersecurity procedures or protocols that have been applied to members of the group of employees having access to data, networks, or systems containing proprietary information to reduce the cybersecurity risk to the organization; and
applying at least one of the one or more identified cybersecurity procedures or protocols to the employee.
2. The method of claim 1 , wherein the employee's job characteristics include the employee's title and department.
3. The method of claim 1 , further comprising inputting at least a portion of the information about the employee's job characteristics into a first trained machine learning model operating to respond to an input by producing an output indicating an employee's seniority level and inputting at least a portion of the information about the employee's job characteristics into a second trained machine learning model operating to respond to an input by producing an output indicating the employee's role in the organization.
4. The method of claim 3 , wherein the first trained machine learning model and the second trained machine learning model are combined into a single model.
5. The method of claim 1 , wherein the trained machine learning model outputs a plurality of possible results for the employee's role, along with a confidence level for each result.
6. The method of claim 5 , further comprising:
calculating an entropy-based reliability measure associated with the top-k outputs of the trained model;
comparing the calculated measure to a predetermined threshold value; and
based on the comparison, determining whether to accept or reject the top ranked output of the trained model as a valid indication of the employee's role.
7. The method of claim 6 , wherein the entropy-based reliability measure is of the form 1−[entropy of top-k values of model output/max entropy value of top-k values].
8. The method of claim 1 , wherein determining that the employee belongs to a group of employees having access to data, networks, or systems containing proprietary information further comprises determining that the employee has a senior position in the organization's legal, finance, product, sales, operations, or research and development department.
9. The method of claim 8 , wherein determining that the employee has a senior position further comprises determining that the employee is one of a manager, executive or member of a board of directors.
10. The method of claim 1 , wherein the one or more cybersecurity procedures or protocols that have been applied to members of the group of employees having access to data or systems containing proprietary information include:
denying access to the systems, networks, or data from externally controlled networks;
enforcing stronger identification protocols for the employee;
preventing copying of proprietary data to a portable memory device without authorization from another employee; and
implementing a firewall policy limiting access to a specific website.
11. The method of claim 1 , further comprising training the machine learning model using job characteristic data for a plurality of people and a label identifying the correct seniority level or role of each person.
12. An apparatus comprising:
at least one electronic processor;
an electronic non-transitory data storage element including a set of computer-executable instructions that, when executed by the electronic processor, cause the apparatus to
input information about an employee's job characteristics into a trained machine learning model, the trained model operating to respond to the input by producing an output indicating one or more of the employee's seniority level and the employee's role in the organization;
based on the output of the trained model, determining that the employee belongs to a group of employees having access to data, networks, or systems containing proprietary information;
identify one or more cybersecurity procedures or protocols that have been applied to members of the group of employees having access to data, networks, or systems containing proprietary information to reduce the cybersecurity risk to the organization; and
apply at least one of the one or more identified cybersecurity procedures or protocols to the employee.
13. The apparatus of claim 12 , wherein the employee's job characteristics include the employee's title and department.
14. The apparatus of claim 12 , further comprising inputting at least a portion of the information about the employee's job characteristics into a first trained machine learning model operating to respond to an input by producing an output indicating an employee's seniority level and inputting at least a portion of the information about the employee's job characteristics into a second trained machine learning model operating to respond to an input by producing an output indicating the employee's role in the organization.
15. The apparatus of claim 12 , wherein the trained machine learning model outputs a plurality of possible results for the employee's role, along with a confidence level for each result.
16. The apparatus of claim 15 , wherein the instructions further cause the apparatus to:
calculate an entropy-based reliability measure associated with the top-k outputs of the trained model;
compare the calculated measure to a predetermined threshold value; and
based on the comparison, determine whether to accept or reject the top ranked output of the trained model as a valid indication of the employee's role.
17. The apparatus of claim 12 , wherein determining that the employee belongs to a group of employees having access to data, networks, or systems containing proprietary information further comprises determining that the employee has a senior position in the organization's legal, finance, product, sales, operations, or research and development department.
18. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
input information about an employee's job characteristics into a trained machine learning model, the trained model operating to respond to the input by producing an output indicating one or more of the employee's seniority level and the employee's role in the organization;
based on the output of the trained model, determining that the employee belongs to a group of employees having access to data, networks, or systems containing proprietary information;
identify one or more cybersecurity procedures or protocols that have been applied to members of the group of employees having access to data, networks, or systems containing proprietary information to reduce the cybersecurity risk to the organization; and
apply at least one of the one or more identified cybersecurity procedures or protocols to the employee.
19. The non-transitory computer-readable medium of claim 18 , wherein the employee's job characteristics include the employee's title and department.
20. The non-transitory computer-readable medium of claim 18 , wherein the trained machine learning model outputs a plurality of possible results for the employee's role, along with a confidence level for each result, and further, wherein the instructions further cause the computing device to:
calculate an entropy-based reliability measure associated with the top-k outputs of the trained model;
compare the calculated measure to a predetermined threshold value; and
based on the comparison, determine whether to accept or reject the top ranked output of the trained model as a valid indication of the employee's role.