System and method for automated sensitive information discovery, monitoring and remediation
A system for automated sensitive information discovery, monitoring, and remediation using an agent associated to a data source and including: a module detecting the occurrence of events indicative of access to data; an module identifying the events classified as potentially threatening; a module extracting data associated to each potentially threatening event; and a module performing data analysis of the extracted data and determining a sensitivity score for the data to file associated to the potentially threatening event. The system also comprises a central platform in data communication with the agent and including: a module analyzing data received from the agent and identifying a potential security risk relative to one of a user or group of users associated to the data source, the data source, a specific file or a specific data type stored on the data source; and a control module triggering remediation actions upon detection of a security risk.
1. A system for automated sensitive information discovery, monitoring, and remediation, the system comprising:
at least one agent stored in a memory of a computing device operating as a data source or in data communication with the data source, the at least one agent being a software unit and defining instructions which, when executed by a processor, can perform tasks in a background, the at least one agent comprising:
a data source monitoring module monitoring activity of the data source and detecting an occurrence of events indicative of access to data using the data source or stored on the data source;
an event filtering module filtering the events detected by the data source monitoring module and identifying events classified as potentially threatening events regarding sensitive information stored on the data source or accessed using the data source;
a data extraction module performing data extraction of one of data and a file associated to each one of the events classified as potentially threatening events and generating extracted data therefrom; and
a file analysis module performing data analysis of the extracted data associated to each one of the events classified as potentially threatening events and determining a sensitivity score indicative of a level of sensitivity thereof;
a central platform in data communication with the at least one agent, the central platform being a software unit stored in a memory of a central computing device and defining instructions which, when executed by a processor of the central computing device, can perform computer-implemented tasks, the central platform comprising:
a trend recognition module receiving the sensitivity score associated to each one of the events classified as potentially threatening events from the file analysis module and quantifying a sensitivity level of overall data held on or accessed by a specific user or group of users using the data source, the trend recognition module analyzing the sensitivity score associated to each one of the events classified as potentially threatening events in combination with additional contextual and historical data relative to one of the specific user or group of users associated to the data source, the data source, a specific file type stored on the data source and a specific data type stored on the data source, to identify a potential security risk relative to the data source or to the specific user or group of users associated to the data source when an overall potential security risk is greater than a predetermined threshold for the data source or the specific user or group of users associated to the data source, the predetermined threshold being adapted to the specific user or group of users associated to the data source and being representative of a quantity of sensitive information the specific user or group of users associated to the data source is allowed to access; and
a control module triggering remediation actions relative to the one of the specific user or group of users associated to the data source, the data source, the specific file type stored on the data source and the specific data type stored on the data source, upon detection of a potential security risk.
2. The system of claim 1 , wherein the file analysis module is configured to generate metadata regarding the extracted data, the metadata being communicated to the trend recognition module and being used by the trend recognition module to identify the potential security risk relative to the data source or to the specific user or group of users associated to the data source.
3. The system of claim 1 , wherein the contextual and historical data includes at least one of events frequencies, a global sensitivity score for the specific user or group of users associated to the data source, a data location, behavioral patterns associated to the one of the specific user or group of users associated to the data source, the data source, the specific file type stored on the data source and the specific data type stored on the data source, a type of changes performed on a file associated to one of the events classified as potentially threatening events, a number of files associated to the specific user or group of users associated to the data source and a data type associated to the to one of the events classified as potentially threatening events.
4. The system of claim 1 , wherein the file analysis module is configured to determine the sensitivity score indicative of the level of sensitivity of the extracted data from the one of the data and the file associated to each one of events classified as potentially threatening events using at least one of a comparison of Term Frequency Inverse Document Frequency (TF-IDF) vectors generated for the corresponding data or the files and at least one reference file and a correlation analysis between sensitive information identified with Regular Expressions (REGEXs) and user identifiers.
5. The system of claim 1 , wherein the control module of the central platform is configured to determine remediation actions based on predetermined scenarios defining the remediation actions to be taken for specific situations.
6. The system of claim 1 , wherein the central platform comprises a display module displaying data relative to the events classified as potentially threatening events and corresponding sensitivity score on a display screen of the computing device.
7. The system of claim 1 , wherein the remediation actions include at least one of network access restriction, modification of file access rights, file encryption, user session termination, alert generation and user education recommendations.
8. The system of claim 1 , wherein the system includes a configuration module configured to receive parameters regarding one of security protocols, policies and sensitivity parameters of the system, the configuration module generating configuration data defining the parameters of the system as configured therein, the configuration data being transmitted to the at least one agent, the event filtering module being configured to perform filtering of the events detected by the data source monitoring module using a set of filtering parameters initially defined using the configuration module.
9. The system of claim 1 , wherein the central platform is configured to generate a hash value for each version of each file stored on the data source and wherein the data source monitoring module is configured to use the generated hash value to perform detection of changes in a file stored on the data source for detecting the occurrence of events indicative of access to data using the data source or stored on the data source.
10. The system of claim 1 , wherein the data source is one of an endpoint computing device and a cloud storage.
11. The system of claim 1 , wherein the at least one agent comprises a remediation action module configured to implement corresponding remediation actions on the data source.
12. A computer implemented method for automated sensitive information discovery, monitoring and remediation, the method comprising the steps of:
monitoring activity of a corresponding data source;
detecting an occurrence of events indicative of access to data using the data source or stored on the data source;
identifying events indicative of a potentially threatening access to sensitive information by a user;
identifying the events classified as potentially threatening events regarding sensitive information stored on the data source or accessed using the data source;
performing data extraction of one of data and a file associated to each one of the events classified as potentially threatening events and generating extracted data therefrom;
performing data analysis of the extracted data associated to each one of events classified as potentially threatening events and determining a sensitivity score indicative of a level of sensitivity thereof;
communicating the events classified as potentially threatening events and the sensitivity score of the one of the data and the file associated to each one of the events classified as potentially threatening events to a central platform storing information over time and
generating therefrom additional contextual and historical data relative to one of a specific user or group of users associated to the data source, the data source, a specific file type stored on the data source and a specific data type stored on the data source;
quantifying a sensitivity level of overall data held on or accessed by the specific user or group of users using the data source;
analyzing the sensitivity score associated to each one of the events classified as potentially threatening events in combination with the additional contextual and historical data relative to the one of the specific user or group of users associated to the data source, the data source, the specific file type stored on the data source and the specific data type stored on the data source, to identify a potential security risk relative to the data source or to the specific user or group of users associated to the data source when an overall potential security risk is greater than a predetermined threshold for the data source or the specific user or group of users associated to the data source, the predetermined threshold being adapted to the specific user or group of users associated to the data source and being representative of a quantity of sensitive information the specific user or group of users associated to the data source is allowed to access; and
triggering remediation actions relative to the one of the specific user or group of users associated to the data source, the data source, the specific file type stored on the data source and the specific data type stored on the data source, upon detection of the potential security risk.
13. The method of claim 12 , further comprising the steps of generating metadata regarding the extracted data and communicating the metadata associated to each one of the events classified as potentially threatening events to the central platform.
14. The method of claim 12 , wherein the contextual and historical data includes at least one of events frequencies, a global sensitivity score for the specific user or group of users associated to the data source, a data location, behavioral patterns associated to the one of the specific user or group of users associated to the data source, the data source, the specific file type stored on the data source and the specific data type stored on the data source, a type of changes performed on a file associated to one of the events classified as potentially threatening events, a number of files associated to the specific user or group of users associated to the data source and a data type associated to the to one of the events classified as potentially threatening events.
15. The method of claim 12 , wherein the step of determining the sensitivity score indicative of the level of sensitivity of the one of the data and the file associated to each one of the events classified as potentially threatening events is performed using at least one of a comparison of Term Frequency Inverse Document Frequency (TF-IDF) vectors generated for the corresponding one of the data and the file and at least one reference file and a correlation analysis between sensitive information identified with Regular Expressions (REGEXs) and user identifiers.
16. The method of claim 12 , wherein the step of triggering remediation actions includes determining remediation actions based on predetermined scenarios defining the remediation actions to be taken for specific situations.
17. The method of claim 12 , wherein the remediation actions include at least one of network access restriction, modification of file access rights, file encryption, user session termination, alert generation and user education recommendations.
18. The method of claim 12 , further comprising generating a hash value for each version of each file stored on the data source and wherein the step of detecting the occurrence of events includes using the generated hash value to perform detection of changes in a file stored on the data source.
19. The method of claim 12 , further comprising implementing corresponding remediation actions on the data source.
20. A computer-readable memory having recorded thereon statements and instructions for execution by a computer, said statements and instructions comprising code means for performing the steps of the method of claim 12 .