Enterprise security measures
A system for managing security within an enterprise includes a computing device that receives a vulnerability, generates a user score for each user within the enterprise and generates a threat score for the vulnerability. A user device score may also be generated for each device associated with a user. Based on the user score and the threat score, a composite score is generated. After acquiring a security measure, the security measure is implemented based on the composite score and, at times, the user score.
1. A computer-implemented method, comprising:
determining a sequence of priority of distribution of remediation of a vulnerability to computing devices of an enterprise, each of the computing devices being associated with at least one of a plurality of users, each of the computing devices being associated with at least one of a plurality of computing systems of the enterprise, the sequence of priority being based on:
first rankings, according to increasing risk based on the vulnerability, of the computing devices, each of the computing devices being assigned a different one of the first rankings, the first rankings of the computing devices being based on device characteristics of the computing devices, the device characteristics including at least one of: types of machines of the computing devices; types of networks accessible by the computing devices; and whether statuses of the computing devices are internal-facing or external-facing; and
second rankings, according to increasing risk based on the vulnerability, of the plurality of users, each of the plurality of users being assigned a different one of the second rankings, the second rankings of the plurality of users being based on:
behavioral data including behavioral patterns and access patterns of at least one of the plurality of users; and
access types of the plurality of computing systems; and
sequentially remediating the vulnerability to the computing devices based on the sequence of priority.
2. The computer-implemented method of claim 1 , wherein the plurality of computing systems includes a back-end server.
3. The computer-implemented method of claim 2 , wherein the back-end server is not directly associated with any of the plurality of users.
4. The computer-implemented method of claim 1 ,
wherein determining the sequence of priority includes:
determining a number of the computing devices affected by the vulnerability; and
determining, based on the number of the computing devices and types of the computing devices affected by the vulnerability, a number of the plurality of users affected by the vulnerability.
5. The computer-implemented method of claim 1 , wherein the remediation includes publishing a security patch.
6. The computer-implemented method of claim 5 , wherein publishing the security patch includes sending a reminder to update after a predetermined period of time.
7. The computer-implemented method of claim 1 , further comprising:
activating a security module to lock out a device capability of one of the computing devices associated with the at least one of the plurality of users if the at least one of the plurality of users does not perform the remediation within a first predetermined time period.
8. The computer-implemented method of claim 7 , further comprising:
deactivating access to data if the at least one of the plurality of users does not perform the remediation within a second predetermined time period.
9. The computer-implemented method of claim 1 , further comprising:
determining compliance of the at least one of the plurality of users with the remediation; and
implementing, based on the compliance, an additional security measure.
10. An electronic computing device, comprising:
a processing unit; and
system memory, the system memory including instructions that, when executed by the processing unit, cause the electronic computing device to:
determine a sequence of priority of distribution of remediation of a vulnerability to computing devices of an enterprise, each of the computing devices being associated with at least one of a plurality of users, each of the computing devices being associated with at least one of a plurality of computing systems of the enterprise, the sequence of priority being based on:
first rankings, according to increasing risk based on the vulnerability, of the computing devices, each of the computing devices being assigned a different one of the first rankings, the first rankings of the computing devices being based on device characteristics of the computing devices, the device characteristics including at least one of: types of machines of the computing devices; types of networks accessible by the computing devices; and whether statuses of the computing devices are internal-facing or external-facing; and
second rankings, according to increasing risk based on the vulnerability, of the plurality of users, each of the plurality of users being assigned a different one of the second rankings, the second rankings of the plurality of users being based on:
behavioral data including behavioral patterns and access patterns of the at least one of the plurality of users; and
access types of the plurality of computing systems; and
sequentially remediate the vulnerability to the computing devices based on the sequence of priority.
11. The electronic computing device of claim 10 , wherein the plurality of computing systems includes a back-end server.
12. The electronic computing device of claim 11 , wherein the back-end server is not directly associated with any of the plurality of users.
13. The electronic computing device of claim 10 ,
wherein determine the sequence of priority includes:
determine a number of the computing devices affected by the vulnerability; and
determine, based on the number of the computing devices and types of the computing devices affected by the vulnerability, a number of the plurality of users affected by the vulnerability.
14. The electronic computing device of claim 10 , wherein the remediation includes publication of a security patch.
15. The electronic computing device of claim 14 , wherein the publication of the security patch includes sending of a reminder to update after a predetermined period of time.
16. The electronic computing device of claim 10 , wherein the instructions, when executed by the processing unit, cause the electronic computing device to:
activate a security module to lock out a device capability of one of the computing devices associated with the at least one of the plurality of users if the at least one of the plurality of users does not perform the remediation within a first predetermined time period.
17. The electronic computing device of claim 16 , wherein the instructions, when executed by the processing unit, cause the electronic computing device to:
deactivate access to data if the at least one of the plurality of users does not perform the remediation within a second predetermined time period.
18. The electronic computing device of claim 10 , wherein the instructions, when executed by the processing unit, cause the electronic computing device to:
determine compliance of the at least one of the plurality of users with the remediation; and
implement, based on the compliance, an additional security measure.