PROTECTION AGAINST PHISHING OF TWO-FACTOR AUTHENTICATION CREDENTIALS
An apparatus comprises at least one processing device comprising a processor coupled to a memory. The processing device is configured to identify artifacts in a plurality of messages of an account of a user, and to replace the identified artifacts in the messages with respective modified artifacts while also maintaining in access-controlled storage at least information related to the identified artifacts. The processing device receives from a requestor a request for a given one of the identified artifacts that has been replaced with a corresponding modified artifact, determines a profile of the requestor based at least in part on the request, makes a security determination based at least in part on the determined profile, and takes at least one automated action based at least in part on the security determination.
1 . An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
said at least one processing device being configured:
to identify artifacts in a plurality of messages of an account of a user;
to replace the identified artifacts in the messages with respective modified artifacts while also maintaining in access-controlled storage at least information related to the identified artifacts;
to receive from a requestor a request for a given one of the identified artifacts that has been replaced with a corresponding modified artifact;
to determine a profile of the requestor based at least in part on the request;
to make a security determination based at least in part on the determined profile; and
to take at least one automated action based at least in part on the security determination.
2 . The apparatus of claim 1 wherein said at least one processing device implements an analysis unit of a security system.
3 . The apparatus of claim 1 wherein the plurality of messages comprise respective email messages of an email account of a user.
4 . The apparatus of claim 1 wherein the given artifact comprises an attachment of its corresponding message.
5 . The apparatus of claim 1 wherein replacing the identified artifacts with respective modified artifacts comprises replacing at least a subset of the identified artifacts with at least respective links to those identified artifacts.
6 . The apparatus of claim 1 wherein determining a profile of the requestor based at least in part on the request comprises determining the profile along each of a plurality of distinct dimensions including at least an automation dimension providing one or more indicators of automation associated with the request and one or more of a device dimension comprising device data associated with the request and an environmental dimension comprising environmental data associated with the request.
7 . The apparatus of claim 1 wherein the profile of the requestor is determined based at least in part on timing data relating to delivery of one of more of the messages and corresponding requests for one or more artifacts associated with the one or more messages.
8 . The apparatus of claim 1 wherein making a security determination based at least in part on the determined profile comprises:
comparing the determined profile with an additional profile stored in association with the given artifact; and
making the security determination based at least in part on a result of the comparing.
9 . The apparatus of claim 8 wherein the additional profile is encoded in the modified artifact.
10 . The apparatus of claim 1 wherein making a security determination based at least in part on the determined profile comprises:
computing a risk score for the request; and
identifying the request as an anomalous request responsive to the risk score exceeding a specified threshold.
11 . The apparatus of claim 1 wherein taking at least one automated action based at least in part on the security determination comprises granting or denying the request based at least in part on the security determination.
12 . The apparatus of claim 1 wherein taking at least one automated action based at least in part on the security determination comprises providing a deliberately falsified artifact in place of the corresponding identified artifact responsive to the request.
13 . The apparatus of claim 1 wherein taking at least one automated action based at least in part on the security determination comprises classifying the request as being associated with a particular type of attack.
14 . The apparatus of claim 1 wherein the given artifact is replaced with a corresponding modified artifact that comprises an encrypted version of the given artifact and the information related to the given artifact that is maintained in the access-controlled storage comprises a cryptographic key.
15 . A method comprising:
identifying artifacts in a plurality of messages of an account of a user;
replacing the identified artifacts in the messages with respective modified artifacts while also maintaining in access-controlled storage at least information related to the identified artifacts;
receiving from a requestor a request for a given one of the identified artifacts that has been replaced with a corresponding modified artifact;
determining a profile of the requestor based at least in part on the request;
making a security determination based at least in part on the determined profile; and
taking at least one automated action based at least in part on the security determination;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
16 . The method of claim 15 wherein the profile of the requestor is determined based at least in part on timing data relating to delivery of one of more of the messages and corresponding requests for one or more artifacts associated with the one or more messages.
17 . The method of claim 15 wherein making a security determination based at least in part on the determined profile comprises:
comparing the determined profile with an additional profile stored in association with the given artifact; and
making the security determination based at least in part on a result of the comparing.
18 . A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said at least one processing device:
to identify artifacts in a plurality of messages of an account of a user;
to replace the identified artifacts in the messages with respective modified artifacts while also maintaining in access-controlled storage at least information related to the identified artifacts;
to receive from a requestor a request for a given one of the identified artifacts that has been replaced with a corresponding modified artifact;
to determine a profile of the requestor based at least in part on the request;
to make a security determination based at least in part on the determined profile; and
to take at least one automated action based at least in part on the security determination.
19 . The computer program product of claim 18 wherein the profile of the requestor is determined based at least in part on timing data relating to delivery of one of more of the messages and corresponding requests for one or more artifacts associated with the one or more messages.
20 . The computer program product of claim 18 wherein making a security determination based at least in part on the determined profile comprises:
comparing the determined profile with an additional profile stored in association with the given artifact; and
making the security determination based at least in part on a result of the comparing.