Systems and methods for context-based mitigation of computer security risks
An apparatus includes a processor operatively coupled to a memory. The processor receives a first set of risk assessment rules including first user privilege criteria and first device criteria. The first device criteria include a computing device patch level, a network type, and/or a password policy. The processor identifies a user-specific security risk based on the first set of risk assessment rules and applies a privilege mitigation measure based on the user-specific security risk without being in communication with a management server. The processor later receives a second, updated set of risk assessment rules at the computing device. Upon detecting another login of the user, the processor identifies an updated user-specific security risk based on the updated set of risk assessment rules, and applies a modified privilege mitigation measure based on the updated user-specific security risk, again without being in communication with the management server.
1. A method of context-based privilege mitigation, the method comprising:
detecting a login event of a user of a computing device;
receiving, by the computing device from a management server, a risk assessment rule that includes risk criteria and a plurality of privilege mitigation measures associated with the risk criteria, the risk assessment rule being communicated from the management server in response to the detection of the login event at the computing device, and the risk assessment rule indicates that a software application is vulnerable to an exploit;
evaluating, by an agent on the computing device, information on the computing device that is relevant to the risk criteria;
determining that the user has elevated privileges on the computing device;
detecting, by the computing device, a vulnerable software application to which the user has access, the vulnerable software application being flagged by the risk assessment rule;
identifying, by the computing device, a particular privilege mitigation measure of the plurality of privilege mitigation measures, wherein the particular privilege mitigation measure is mapped to the detected vulnerable software application; and
applying, by the computing device, the particular privilege mitigation measure on the computing device, the particular privilege mitigation measure including an action that reduces a user privilege level of the user and prevents software from being used on the computing device by the user until a desired update to the vulnerable software application has been installed.
2. The method of claim 1 , wherein the risk criteria include user privilege criteria, device criteria, and application criteria applicable to detection of the vulnerable software application.
3. The method of claim 2 , wherein:
the device criteria include at least one of:
a patch level of the computing device,
a network type of the computing device, or
a password policy; and
the particular privilege mitigation measure is associated with the user privilege criteria.
4. The method of claim 1 , wherein:
the risk criteria are a first risk criteria;
the login event is a first login event;
the vulnerable software application is a first security risk;
the action is a first action;
the particular privilege mitigation measure is a first privilege mitigation measure; and
the method further comprises:
receiving a second risk assessment rule including a second risk criteria and the plurality of privilege mitigation measures associated with the second risk criteria;
detecting a second login event of the user of the computing device;
determining a second security risk associated with the second login event based at least partially on the second risk criteria;
identifying a second privilege mitigation measure of the plurality of privilege mitigation measures, wherein the second privilege mitigation measure is mapped to the second security risk based on the second risk criteria and the second privilege mitigation measure includes a second action to decrease the second security risk that is different from the first action; and
applying the second privilege mitigation measure on the computing device.
5. The method of claim 1 , further comprising receiving a second risk assessment rule in response to detection of a new vulnerability associated with the computing device.
6. The method of claim 4 , wherein:
the second risk criteria include a network type of the computing device; and
the second privilege mitigation measure includes one or both of:
disabling network access for the user responsive to the network type of the computing device being a public network; and
sending an alert to the user responsive to the network type of the computing device being a public network that advises the user that the network is public.
7. The method of claim 4 , wherein the applying the second privilege mitigation measure includes:
patching;
privilege management;
whitelisting;
blacklisting;
automatically repairing a group policy associated with the user;
causing installation of an update on the computing device; or repairing user account settings associated with the user to comply with a group policy.
8. The method of claim 4 , wherein:
the computer device is in operable communication with a network, and
the identification of the second security risk is performed in response to:
a detected change in the network; or
a detected group policy violation.
9. A non-transitory computer-readable medium having encoded therein programming code executable by one or more processors to perform or control performance of operations of context-based privilege mitigation, the operations comprising:
detecting a login event of a user of a computing device;
receiving, by the computing device from a management server, a risk assessment rule that includes risk criteria and a plurality of privilege mitigation measures associated with the risk criteria, the risk assessment rule being communicated from the management server in response to the detection of the login event at the computing device, and the risk assessment rule indicates that a software application is vulnerable to an exploit;
evaluating, by an agent on the computing device, information on the computing device that is relevant to the risk criteria;
determining that the user has elevated privileges on the computing device;
detecting, by the computing device, a vulnerable software application to which the user has access, the vulnerable software application being flagged by the risk assessment rule;
identifying, by the computing device, a particular privilege mitigation measure of the plurality of privilege mitigation measures, wherein the particular privilege mitigation measure is mapped to the detected vulnerable software application; and
applying, by the computing device, the particular privilege mitigation measure on the computing device, the particular privilege mitigation measure including an action that reduces a user privilege level of the user and prevents software from being used on the computing device by the user until a desired update to the vulnerable software application has been installed.
10. The non-transitory computer-readable medium of claim 9 , wherein the risk criteria include user privilege criteria, device criteria, and application criteria applicable to detection of the vulnerable software application.
11. The non-transitory computer-readable medium of claim 10 , wherein:
the device criteria include at least one of:
a patch level of the computing device,
a network type of the computing device, or
a password policy; and
the particular privilege mitigation measure is associated with the user privilege criteria.
12. The non-transitory computer-readable medium of claim 9 , wherein:
the risk criteria are a first risk criteria;
the login event is a first login event;
the vulnerable software application is a first security risk;
the action is a first action;
the particular privilege mitigation measure is a first privilege mitigation measure; and
the operations further comprise:
receiving a second risk assessment rule including a second risk criteria and the plurality of privilege mitigation measures associated with the second risk criteria;
detecting a second login event of the user of the computing device;
determining a second security risk associated with the second login event based at least partially on the second risk criteria;
identifying a second privilege mitigation measure of the plurality of privilege mitigation measures, wherein the second privilege mitigation measure is mapped to the second security risk based on the second risk criteria and the second privilege mitigation measure includes a second action to decrease the second security risk that is different from the first action; and
applying the second privilege mitigation measure on the computing device.
13. The non-transitory computer-readable medium of claim 9 , wherein the operations further comprise receiving a second risk assessment rule in response to detection of a new vulnerability associated with the computing device.
14. The non-transitory computer-readable medium of claim 12 , wherein:
the second risk criteria include a network type of the computing device; and
the second privilege mitigation measure includes one or both of:
disabling network access for the user responsive to the network type of the computing device being a public network; and
sending an alert to the user responsive to the network type of the computing device being a public network that advises the user that the network is public.
15. The non-transitory computer-readable medium of claim 12 , wherein the applying the second privilege mitigation measure includes:
patching;
privilege management;
whitelisting;
blacklisting;
automatically repairing a group policy associated with the user;
causing installation of an update on the computing device; or
repairing user account settings associated with the user to comply with a group policy.
16. The non-transitory computer-readable medium of claim 12 , wherein:
the computer device is in operable communication with a network, and
the identification of the second security risk is performed in response to:
a detected change in the network; or
a detected group policy violation.