Cybersecurity threat management using impact scoring
Disclosed techniques include cybersecurity threat management using impact scoring. A plurality of cybersecurity threat protection applications is accessed. A first cybersecurity threat notification is received from one of the plurality of cybersecurity threat protection applications. An impact score is dynamically assigned to the first cybersecurity threat notification, wherein the assigning an impact score is based on information about a device for which the first cybersecurity threat notification was received. The impact score is weighted based on an evaluation of a user of the device for which the first cybersecurity threat notification was received. The weighting is further based on evaluation of device owners and evaluation of an asset. The information about a device and information about one or more users of the device comprise impact score metadata. The first cybersecurity threat notification is responded to, based on the impact score. The dynamically assigning includes the impact score metadata.
1 . A computer-implemented method for cybersecurity management comprising:
accessing a plurality of cybersecurity threat protection applications;
detecting, based on applying an anti-cryptojacking application, a cryptojacking event of a first device, wherein the cryptojacking event corresponds to mining cryptocurrency using the first device;
receiving a first cybersecurity threat notification from one of the plurality of cybersecurity threat protection applications based on the detected cryptojacking event;
dynamically assigning an impact score to the first cybersecurity threat notification using a machine learning neural network, wherein the assigning an impact score is based on information about the first device for which the first cybersecurity threat notification was received, wherein the information about the first device for which the first cybersecurity threat notification was received comprises a security metric that comprises a mean-time-to-respond to the threat notification for the device;
detecting, based on applying an insider threat protection application, an insider threat event of a second device, wherein the insider threat event corresponds to one or more users of the second device moving data from the first device to the second device;
receiving an additional cybersecurity threat notification based on the detected insider threat event, wherein the additional cybersecurity threat notification includes a management level designation for at least one of the one or more users of the second device, wherein the second device is distinct from the first device for which the first cybersecurity threat notification was received;
adjusting the impact score assigned to the first cybersecurity threat notification for the cryptojacking event of the first device based on the additional cybersecurity threat notification, wherein the adjusting comprises multiplying the impact score by a weighting value based on the management level designation for the at least one of the one more users of the second device received in the additional cybersecurity threat notification based on the detected insider threat event;
determining whether the impact score satisfies a threshold value; and
executing, based on a determination that the impact score satisfies the threshold value, a cryptojacking countermeasure to respond to the first cybersecurity threat notification.
2 . The method of claim 1 wherein the information about the device and information about one or more users of the device comprise impact score metadata.
3 . The method of claim 1 wherein the dynamically assigning includes impact score metadata.
4 . The method of claim 1 further comprising weighting the impact score based on an evaluation of the device for which the first cybersecurity threat notification was received.
5 . The method of claim 1 further comprising weighting the impact score based on an evaluation of a user of the device for which the first cybersecurity threat notification was received.
6 . The method of claim 1 further comprising weighting the impact score based on an evaluation of an owner of the device for which the first cybersecurity threat notification was received.
7 . The method of claim 1 further comprising weighting the impact score based on an evaluation of an asset for which the first cybersecurity threat notification was received.
8 . The method of claim 1 wherein the impact score is generated automatically.
9 . The method of claim 1 wherein the impact score is generated by human intervention.
10 . The method of claim 9 wherein the human intervention is performed with computer-assisted information.
11 . The method of claim 1 wherein the device comprises a group of devices.
12 . The method of claim 11 wherein the group of devices comprises a network infrastructure.
13 . The method of claim 11 wherein the group of devices comprises multiple end-user devices.
14 . The method of claim 11 wherein the group of devices comprises a portable, network-connected device.
15 . The method of claim 1 wherein the additional cybersecurity threat notification includes information regarding the device for which the first cybersecurity threat notification was received.
16 . The method of claim 1 wherein the additional cybersecurity threat notification includes impact score metadata.
17 . The method of claim 1 wherein the impact score informs one or more workflows controlling cybersecurity threat management.
18 . The method of claim 1 wherein the information about a device for which the first cybersecurity threat notification was received includes a management level designation for the device or a user of the device.
19 . The method of claim 1 wherein the information about a device for which the first cybersecurity threat notification was received includes a usage location designation.
20 . The method of claim 1 wherein the information about a device for which the first cybersecurity threat notification was received includes a security clearance designation for the device or a user of the device.
21 . A computer program product embodied in a non-transitory computer readable medium for cybersecurity management, the computer program product comprising code which causes one or more processors to perform operations of:
accessing a plurality of cybersecurity threat protection applications;
detecting, based on applying an anti-cryptojacking application, a cryptojacking event of a first device, wherein the cryptojacking event corresponds to mining cryptocurrency using the first device;
receiving a first cybersecurity threat notification from one of the plurality of cybersecurity threat protection applications based on the detected cryptojacking event;
dynamically assigning an impact score to the first cybersecurity threat notification using a machine learning neural network, wherein the assigning an impact score is based on information about the first device for which the first cybersecurity threat notification was received, wherein the information about the first device for which the first cybersecurity threat notification was received comprises a security metric that comprises a mean-time-to-respond to the threat notification for the first device;
detecting, based on applying an insider threat protection application, an insider threat event of a second device, wherein the insider threat event corresponds to one or more users of the second device moving data from the first device to the second device;
receiving an additional cybersecurity threat notification based on the detected insider threat event, wherein the additional cybersecurity threat notification includes a management level designation for at least one of the one or more users of the second device, wherein the second device is distinct from the first device for which the first cybersecurity threat notification was received;
adjusting the impact score assigned to the first cybersecurity threat notification for the cryptojacking event of the first device based on the additional cybersecurity threat notification, wherein the adjusting comprises multiplying the impact score by a weighting value based on the management level designation for the at least one of the one more users of the second device received in the additional cybersecurity threat notification based on the detected insider threat event;
determining whether the impact score satisfies a threshold value; and
executing, based on a determination that the impact score satisfies the threshold value, a cryptojacking countermeasure to respond to the first cybersecurity threat notification.
22 . The computer program product of claim 21 , wherein the computer program product comprises code which causes the one or more processors to perform further operations of:
weighting the impact score based on an evaluation of the device for which the first cybersecurity threat notification was received.
23 . A computer system for cybersecurity comprising:
a memory which stores instructions;
one or more processors coupled to the memory wherein the one or more processors, when executing the instructions which are stored, are configured to:
access a plurality of cybersecurity threat protection applications;
detect, based on applying an anti-cryptojacking application, a cryptojacking event of a first device, wherein the cryptojacking event corresponds to mining cryptocurrency using the first device;
receive a first cybersecurity threat notification from one of the plurality of cybersecurity threat protection applications based on the detected cryptojacking event;
dynamically assign an impact score to the first cybersecurity threat notification using a machine learning neural network, wherein the assigning an impact score is based on information about the first device for which the first cybersecurity threat notification was received, wherein the information about the first device for which the first cybersecurity threat notification was received comprises a security metric that comprises a mean-time-to-respond to the threat notification for the first device;
detecting, based on applying an insider threat protection application, an insider threat event of a second device, wherein the insider threat event corresponds to one or more users of the second device moving data from the first device to the second device;
receiving an additional cybersecurity threat notification based on the detected insider threat event, wherein the additional cybersecurity threat notification includes a management level designation for at least one of the one or more users of the second device, wherein the second device is distinct from the first device for which the first cybersecurity threat notification was received;
adjusting the impact score assigned to the first cybersecurity threat notification for the cryptojacking event of the first device based on the additional cybersecurity threat notification, wherein the adjusting comprises multiplying the impact score by a weighting value based on the management level designation for the at least one of the one more users of the second device received in the additional cybersecurity threat notification based on the detected insider threat event;
determine whether the impact score satisfies a threshold value; and
execute, based on a determination that the impact score satisfies the threshold value, a cryptojacking countermeasure to respond to the first cybersecurity threat notification.
24 . The computer system of claim 23 , wherein the one or more processors, when executing the instructions which are stored, are further configured to:
weight the impact score based on an evaluation of the device for which the first cybersecurity threat notification was received.