Data security
A communications system for providing secure access to a digital resource of a group of digital resources accessible via a communications network, the system comprising: a data processing hub accessible via an IP (internet protocol) address; and a plurality of user equipment (UEs) useable to communicate via the communications network, each configured to have a cyber secure isolated environment (CISE) isolated from ambient software in the UE, and comprising a secure web browser (SWB); wherein the hub and CISE are configured so that digital resources in motion and at rest in CISE are visible to the hub.
1. A communications system for providing secure access to a group of digital resources accessible via the internet, the system comprising:
a data processing hub accessible via an IP (internet protocol) address;
a plurality of user equipment (UEs) useable to communicate with websites via the internet, each of the plurality of UEs configured to have a cyber isolated secure environment (CISE) isolated from ambient software in the UE, and the CISE of each UE comprising a secure web browser (SWB) that the corresponding UE is required to use to access one or more of the group of digital resources; and
a security policy implemented to protect the group of digital resources, wherein the security policy is a function of characterizing features that characterize communications between websites and users who communicate with the websites using the UEs;
wherein the hub and each CISE are configured so that any one or more of the group of digital resources in motion and at rest in each CISE are visible to the hub and each CISE and each SWB monitors communications between its corresponding UE and a given website and vets the communications responsive to the security policy, wherein the SWB vets communications responsive to the security policy comprises the SWB processing at least one of the characterizing features using a neural network to estimate a risk of cyber damage to one or more of the group of digital resources associated with the communications and wherein if the estimated risk is greater than a predetermined threshold the hub and/or the SWB undertakes an action to mitigate the risk.
2. The communications system according to claim 1 wherein at least a first of the CISEs comprises at least one shared secure service that communicates with the corresponding SWB via a secure channel and is isolated from the ambient software.
3. The communications system according to claim 2 wherein the first CISE comprises at least one software application that communicates with the corresponding SWB via the secure channel, is wrapped to conform with security constraints defined by the security policy and is isolated from the ambient software.
4. The communications system according to claim 1 wherein the security policy is a function of a set of features characterizing at least the given website.
5. The communications system according to claim 4 wherein the security policy is a function of a URL associated with the given website.
6. The communications system according to claim 4 wherein the set of features comprises features characterizing a plurality of websites.
7. The communications system according to claim 4 wherein the hub processes monitored communications between two or more of the plurality of the UEs with the given website to determine features in the set of features characterizing the given website.
8. The communications system according to claim 7 wherein the security policy is a function of a set of features characterizing a user.
9. The communications system according to claim 8 wherein the hub and/or the SWB monitors interaction of the user with the SWB when operating the SWB to communicate with the given website to determine a feature of the set of features characterizing the user.
10. The communications system according to claim 9 wherein the hub and/or the SWB monitors interaction of at least one other user using a SWB in a UE of the plurality of UEs when operating the SWB to communicate with the given website to determine a feature of the set of features characterizing the user.
11. The communications system according to claim 9 wherein the hub and/or the SWB monitors browsing behavior of a plurality of users of the UEs to determine a feature of the set of features characterizing the user.
12. The communications system according to claim 11 wherein the CISE comprises a secure sandbox.
13. The communications system according to claim 12 wherein vetting communications responsive to the security policy comprises:
generating an emulation of the given website based on the set of features characterizing the given website;
generating an avatar of the user based on the set of features characterizing the user;
staging an interaction of the avatar and emulation in the sandbox; and
based on the staged interaction determining a probability of an interaction between the user and the given website resulting in cyber damage to one or more of the group of digital resources.
14. The communications system according to claim 1 wherein the security policy is a function of features characterizing metadata associated with communication sessions between the user and the given website.
15. The communications system according to claim 14 wherein the security policy is a function of features characterizing metadata associated with communication sessions between the user and at least one website other than the given website.
16. The communications system according to claim 15 wherein the security policy is a function of features characterizing metadata associated with communication sessions between at least one other user and the given website.
17. The communications system according to claim 16 wherein the security policy is a function of features characterizing metadata associated with communication sessions between the at least one other user and the at least one website other than the given website.
18. The communications system according to claim 1 wherein the security policy is a function of features characterizing a cyberattack landscape in which the UE is operating.