Using an entity behavior profile when performing human-centric risk modeling operations
A system, method, and computer-readable medium for performing a security operation. The security operation includes: monitoring an entity, the monitoring observing at least one electronically-observable data source; identifying a security related activity, the security related activity being of analytic utility; accessing an entity behavior profile based upon the security related activity, the entity behavior profile comprising a collection of information uniquely describing an identity and behavior of the entity; identifying a risk associated with the entity using a human-centric risk modeling framework, the human-centric risk modeling framework enabling quantification of a human-centric factor associated with the entity, the human-centric factor comprising a motivation factor, a stressor factor and an organizational dynamics stressor factor, the human-centric factor having an associated effect on the entity, the motivation factor representing a motivation for enacting an entity behavior, the stressor factor representing an issue influencing the user entity behavior, the organizational stressor factor representing an event occurring within an organization affecting the entity behavior; and, performing a security operation based upon the risk associated with the entity, the security operation using the human-centric risk modeling framework and the entity behavior profile, the security operation being performed by at least one of an endpoint device and a security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system.
1. A computer-implementable method for performing a security operation, comprising:
monitoring an entity, the monitoring observing at least one electronically-observable data source;
identifying a security related activity of the entity, the security related activity being of analytic utility;
accessing an entity behavior profile based upon the security related activity, the entity behavior profile comprising a collection of information uniquely describing an identity and behavior of the entity;
identifying a risk associated with the entity using a human-centric risk modeling framework, the human-centric risk modeling framework enabling quantification of a human-centric factor associated with the entity, the human-centric factor comprising a motivation factor, a stressor factor and an organizational dynamics stressor factor, the human-centric factor having an associated effect on the entity, the motivation factor representing a motivation for enacting an entity behavior, the stressor factor representing an issue influencing the user entity behavior, the organizational stressor factor representing an event occurring within an organization affecting the entity behavior; and,
performing a security operation based upon the risk associated with the entity, the security operation using the human-centric risk modeling framework and the entity behavior profile, the security operation being performed by at least one of an endpoint device and a security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system.
2. The method of claim 1 , wherein:
the entity behaviors comprise at least one of a user entity behavior and a non-user entity behavior.
3. The method of claim 2 , wherein:
an entity behavior has an associated attribute, the associated attribute comprising at least one of a user entity attribute associated with the user entity behavior and a non-user entity attribute associated with the non-user entity behavior.
4. The method of claim 1 , wherein:
the human-centric risk modeling framework comprises at least one of a user entity behavior, a security risk use case, a kill chain phase, a security risk persona, a user entity predisposition, a security vulnerability scenario, a concerning behavior and a contextual modifier.
5. The method of claim 4 , wherein:
the concerning behavior comprises an associated concerning behavior score, the security risk persona comprises an associated persona baseline risk score, and the user entity behavior comprises the security related activity.
6. The method of claim 1 , wherein:
the security operation uses the entity behavior profile to determine whether an event is of analytic utility.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
monitoring an entity, the monitoring observing at least one electronically-observable data source;
identifying a security related activity of the entity, the security related activity being of analytic utility;
accessing an entity behavior profile based upon the security related activity, the entity behavior profile comprising a collection of information uniquely describing an identity and behavior of the entity;
identifying a risk associated with the entity using a human-centric risk modeling framework, the human-centric risk modeling framework enabling quantification of a human-centric factor associated with the entity, the human-centric factor comprising a motivation factor, a stressor factor and an organizational dynamics stressor factor, the human-centric factor having an associated effect on the entity, the motivation factor representing a motivation for enacting an entity behavior, the stressor factor representing an issue influencing the user entity behavior, the organizational stressor factor representing an event occurring within an organization affecting the entity behavior; and,
performing a security operation based upon the risk associated with the entity, the security operation using the human-centric risk modeling framework and the entity behavior profile, the security operation being performed by at least one of an endpoint device and a security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system.
8. The system of claim 7 , wherein:
the entity behaviors comprise at least one of a user entity behavior and a non-user entity behavior.
9. The system of claim 8 , wherein:
an entity behavior has an associated attribute, the associated attribute comprising at least one of a user entity attribute associated with the user entity behavior and a non-user entity attribute associated with the non-user entity behavior.
10. The system of claim 7 , wherein:
the human-centric risk modeling framework comprises at least one of a user entity behavior, a security risk use case, a kill chain phase, a security risk persona, a user entity predisposition, a security vulnerability scenario, a concerning behavior and a contextual modifier.
11. The system of claim 10 , wherein:
the concerning behavior comprises an associated concerning behavior score, the security risk persona comprises an associated persona baseline risk score, and the user entity behavior comprises the security related activity.
12. The system of claim 11 , wherein:
the security operation uses the entity behavior profile to determine whether an event is of analytic utility.
13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
monitoring an entity, the monitoring observing at least one electronically-observable data source;
identifying a security related activity of the entity, the security related activity being of analytic utility;
accessing an entity behavior profile based upon the security related activity, the entity behavior profile comprising a collection of information uniquely describing an identity and behavior of the entity;
identifying a risk associated with the entity using a human-centric risk modeling framework, the human-centric risk modeling framework enabling quantification of a human-centric factor associated with the entity, the human-centric factor comprising a motivation factor, a stressor factor and an organizational dynamics stressor factor, the human-centric factor having an associated effect on the entity, the motivation factor representing a motivation for enacting an entity behavior, the stressor factor representing an issue influencing the user entity behavior, the organizational stressor factor representing an event occurring within an organization affecting the entity behavior; and,
performing a security operation based upon the risk associated with the entity, the security operation using the human-centric risk modeling framework and the entity behavior profile, the security operation being performed by at least one of an endpoint device and a security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system.
14. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the entity behaviors comprise at least one of a user entity behavior and a non-user entity behavior.
15. The non-transitory, computer-readable storage medium of claim 14 , wherein:
an entity behavior has an associated attribute, the associated attribute comprising at least one of a user entity attribute associated with the user entity behavior and a non-user entity attribute associated with the non-user entity behavior.
16. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the human-centric risk modeling framework comprises at least one of a user entity behavior, a security risk use case, a kill chain phase, a security risk persona, a user entity predisposition, a security vulnerability scenario, a concerning behavior and a contextual modifier.
17. The non-transitory, computer-readable storage medium of claim 16 , wherein:
the concerning behavior comprises an associated concerning behavior score, the security risk persona comprises an associated persona baseline risk score, and the user entity behavior comprises the security related activity.
18. The non-transitory, computer-readable storage medium of claim 17 , wherein:
the security operation uses the entity behavior profile to determine whether an event is of analytic utility.
19. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are deployable to a client system from a server system at a remote location.
20. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are provided by a service provider to a user on an on-demand basis.