Federated database for establishing and tracking risk of interactions with third parties
Introduced here are computer programs and computer-implemented techniques for generating and then managing a federated database that can be used to ascertain the risk in interacting with vendors. At a high level, the federated database allows knowledge regarding the reputation of vendors to be shared amongst different enterprises with which those vendors may interact. A threat detection platform may utilize the federated database when determining how to handle incoming emails from vendors.
1. A method comprising:
obtaining a first email that is addressed to an email account associated with a first enterprise;
establishing that the first email represents an instance of outreach by a first vendor;
accessing a federated database to identify a digital profile that is associated with the first vendor, wherein the federated database includes a plurality of digital profiles that are collectively associated with a plurality of different vendors, wherein at least some of the digital profiles include: (i) a classification indicative of risk in communicating with a corresponding vendor, and (ii) first information regarding how the classification was determined, wherein the information includes: (a) a record of email accounts with which contact has been initiated on behalf of the first vendor, (b) a record of email accounts with which contact was initiated by the first vendor, and (c) second information regarding a type of attack, if any, in which the corresponding vendor was found to be involved; and at least some of the first data includes some of at least one of the first information or second information and is generated by examining a second email addressed to a second enterprise, and wherein the first enterprise and second enterprise have opted to share content with the federated database; and
determining, based on the digital profile, how to handle the email.
2. The method of claim 1 , wherein when the digital profile indicates that the risk in communicating with the first vendor is high, said determining comprises implementing a filter so as to at least temporarily prohibit incoming emails from the first vendor from being received by employees of the first enterprise.
3. The method of claim 1 , wherein when the digital profile indicates that the risk in communicating with the first vendor is low, said determining comprises allowing the first email to reach an inbox of the email account.
4. The method of claim 1 , wherein said establishing is based on a determination that the first email is sent from an email address with a domain that is associated with the first vendor.
5. The method of claim 1 , further comprising:
applying a first model to the first email to produce a first output indicative of whether the first email is representative of a non-malicious email;
establishing, based on the first output, that the first email is representative of a malicious email; and
applying a second model to the first email to produce a second output indicative of whether the first email is representative of a given type of malicious email;
wherein said determining is further based on the first output and/or the second output.
6. The method of claim 1 , further comprising causing display of a notification by a computer program that specifies how the first email was handled.
7. The method of claim 6 , further comprising:
receiving, through the computer program, input indicative of a request to examine the digital profile that is associated with the first vendor; and
causing display of an interface by the computer program that includes a summary of the first vendor digital profile.
8. The method of claim 7 , wherein the summary includes a temporal record of past activities in which the first vendor was involved.
9. The method of claim 1 , wherein the record of email accounts with which contact has been initiated on behalf of the first vendor includes at least one email addressed to the first enterprise and at least one email addressed to the second enterprise.
10. A system, comprising:
a processor configured to:
obtain a first email that is addressed to an email account associated with a first enterprise;
establish that the first email represents an instance of outreach by a first vendor;
access a federated database to identify a digital profile that is associated with the first vendor, wherein
the federated database includes a plurality of digital profiles that are collectively associated with a plurality of different vendors;
at least some of the digital profiles, including the first vendor digital profile, include: (i) a classification indicative of risk in communicating with a corresponding vendor, and (ii) first information regarding how the classification was determined, wherein the information includes: (a) a record of email accounts with which contact has been initiated on behalf of the first vendor, (b) a record of email accounts with which contact was initiated by the first vendor, and (c) second information regarding a type of attack, if any, in which the corresponding vendor was found to be involved; and
at least some of the first data includes some of at least one of the first information or second information and is generated by examining a second email addressed to a second enterprise, and wherein the first enterprise and second enterprise have opted to share content with the federated database; and
determine, based on the digital profile, how to handle the email; and
a memory coupled to the processor and configured to provide the processor with instructions.
11. The system of claim 10 , wherein when the digital profile indicates that the risk in communicating with the first vendor is high, said determining comprises implementing a filter so as to at least temporarily prohibit incoming emails from the first vendor from being received by employees of the first enterprise.
12. The system of claim 10 , wherein when the digital profile indicates that the risk in communicating with the first vendor is low, said determining comprises allowing the first email to reach an inbox of the email account.
13. The system of claim 10 , wherein said establishing is based on a determination that the first email is sent from an email address with a domain that is associated with the first vendor.
14. The system of claim 10 , wherein the processor is further configured to:
apply a first model to the first email to produce a first output indicative of whether the email is representative of a non-malicious email;
establish, based on the first output, that the first email is representative of a malicious email; and
apply a second model to the first email to produce a second output indicative of whether the first email is representative of a given type of malicious email;
wherein said determining is further based on the first output and/or the second output.
15. The system of claim 10 , wherein the processor is further configured to cause display of a notification by a computer program that specifies how the email was handled.
16. The system of claim 15 , wherein the processor is further configured to:
receive, through the computer program, input indicative of a request to examine the digital profile that is associated with the first vendor; and
cause display of an interface by the computer program that includes a summary of the first vendor digital profile.
17. The system of claim 16 , wherein the summary includes a temporal record of past activities in which the first vendor was involved.
18. The system of claim 10 , wherein the record of email accounts with which contact has been initiated on behalf of the first vendor includes at least one email addressed to the first enterprise and at least one email addressed to the second enterprise.