System and method for comprehensive data loss prevention and compliance management
A system and method to identify and prevent cybersecurity attacks on modern, highly-interconnected networks, to identify attacks before data loss occurs, using a combination of human level, device level, system level, and organizational level monitoring.
1. A system for comprehensive data loss prevention and compliance management, comprising:
a computing device comprising a processor and a memory;
an observation and state estimation module comprising a first plurality of programming instructions stored in the memory and operating on the processor, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:
monitor a plurality of connected resources on a network; and
produce a cyber-physical graph representing the plurality of connected resources, wherein:
the connected resources comprise one or more of people, devices, systems, and organizations within the network;
the cyber-physical graph comprises nodes representing the connected resources, which each node having one or more properties containing descriptive information for the connected resource represented by that node; and
the cyber-physical graph comprises edges representing the logical relationships between the plurality of connected resources and the physical relationships between any connected resources comprising a hardware device;
an activity monitoring engine comprising a second plurality of programming instructions stored in the memory and operating on the processor, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
generate expected behavior data of the connected resources within the network by applying a behavioral model to each node of the cyber-physical graph;
generate actual behavior data of the connected resources within the network from time-series data comprising a record of network events and the respective times at which each network event occurred;
detect deviations of the actual behavior data from the expected behavior data by comparing the expected behavior data properties of each node with the actual behavior properties of that node; and
when deviations are detected, send information about the deviation to a risk analysis and scoring engine; and
the risk analysis and scoring engine comprising a third plurality of programming instructions stored in the memory and operating on the processor, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:
receive deviation information from the activity monitoring engine;
analyze the severity of a threat posed by the deviation using at least one analysis algorithm; and
generate a risk score based on a plurality of factors which indicate the severity of the threat.
2. The system of claim 1 , wherein the risk analysis and scoring engine further generates an impact assessment score for each affected connected resource by determining an impact on the network using the cyber-physical graph.
3. The system of claim 2 , wherein the impact assessment score further comprises the calculation of the overall impact of a cyberattack, wherein the calculation is based at least in part on the impact assessment score for each connected resource affected by the cyberattack.
4. The system of claim 1 , wherein the detection of deviations is based in part on a comparison of relationships between the connected resources against known security vulnerabilities.
5. The system of claim 4 , wherein the risk score is based at least in part on the results of the comparison against known security vulnerabilities.
6. The system of claim 1 , wherein the observation and state estimation module is further configured to produce a visualization based at least in part on at least a portion of the time-series data, wherein the visualization illustrates changes to the data over time.
7. A method for comprehensive data loss prevention and compliance management, comprising the steps of:
monitoring a plurality of connected resources on the network;
producing a cyber-physical graph representing the plurality of connected resources, wherein:
the connected resources comprise one or more of people, devices, systems, and organizations within the network;
the cyber-physical graph comprises nodes representing the connected resources, which each node having one or more properties containing descriptive information for the connected resource represented by that node; and
the cyber-physical graph comprises edges representing the logical relationships between the plurality of connected resources and the physical relationships between any connected resources comprising a hardware device;
generating expected behavior data of the connected resources-within the network by applying a behavioral model to each node of the cyber-physical graph;
generating actual behavior data of the connected resources within the network from time-series data comprising a record of network events and the respective times at which each network event occurred;
detecting deviations of the actual behavior data from the expected behavior data by comparing the expected behavior data properties of each node with the actual behavior properties of that node; and
when deviations are detected:
analyzing the severity of the threat posed by the deviation using at least one analysis algorithm;
generating a risk score based on a plurality of factors which indicate the severity of the threat; and
displaying the risk score in text and graphical form.
8. The method of claim 7 , wherein the risk analysis and scoring engine further generates an impact assessment score for each affected connected resource by determining an impact on the network using the cyber-physical graph.
9. The method of claim 8 , wherein the impact assessment score further comprises the calculation of the overall impact of a cyberattack, wherein the calculation is based at least in part on the impact assessment score for each connected resource affected by the cyberattack.
10. The method of claim 7 , wherein the detection of deviations is based in part on a comparison of relationships between the connected resources against known security vulnerabilities.
11. The method of claim 10 , wherein the risk score is based at least in part on the results of the comparison against known security vulnerabilities.
12. The method of claim 7 , wherein the observation and state estimation module is further configured to produce a visualization based at least in part on at least a portion of the time-series data, wherein the visualization illustrates changes to the data over time.
13. The system of claim 1 , further comprising a time series database module comprising a fourth plurality of programming instructions stored in the memory and operating on the processor, wherein the fourth plurality of programming instructions, when operating on the processor, cause the computing device to:
monitor a plurality of network events on a network; and
produce time-series data comprising a record of a network event and the time at which the event occurred.