System and method for comprehensive data loss prevention and compliance management
A system and method to identify and prevent cybersecurity attacks on modern, highly-interconnected networks, to identify attacks before data loss occurs, using a combination of human level, device level, system level, and organizational level monitoring.
1. A system for comprehensive data loss prevention and compliance management, comprising:
a computing system comprising a processor and a memory;
an observation and state estimation subsystem comprising a first plurality of programming instructions stored in the memory and operating on the processor, wherein the first plurality of programming instructions, when operating on the processor, cause the computing system to:
produce a cyber-physical graph representing a plurality of connected resources on a network, wherein:
the connected resources comprise one or more of people, devices, systems, and organizations within the network;
the cyber-physical graph comprises nodes representing the connected resources, with each node having one or more properties associated with the connected resource represented by that node;
the cyber-physical graph comprises edges representing logical or physical relationships between pairs of the connected resources; and
the cyber-physical graph includes information about sensitive data stored on one or more of the connected resources; and
an activity monitoring subsystem comprising a second plurality of programming instructions stored in the memory and operating on the processor, wherein the second plurality of programming instructions, when operating on the processor, cause the computing system to:
collect data from a plurality of sources within the network, wherein the plurality of sources includes one or more of: system endpoints, infrastructure servers, perimeter security devices, and network security monitoring tools;
analyze the collected data to identify sensitive data stored on one or more of the connected resources;
update the cyber-physical graph to include information about the identified sensitive data and its location; and
generate expected behavior data of at least some of the plurality of connected resources on the network by applying a behavioral model to nodes of the cyber-physical graph;
generate actual behavior data of at least some of the plurality of connected resources on the network from time-series data comprising a record of network events and the respective times at which each network event occurred;
detect a deviation between the actual behavior data and the expected behavior data for a first node by comparing properties of the expected behavior data of the first node with properties of the actual behavior data of the first node;
when a deviation is detected, transmit data relevant to the deviation to a risk analysis and scoring subsystem; and
the risk analysis and scoring subsystem comprising a third plurality of programming instructions stored in the memory and operating on the processor, wherein the third plurality of programming instructions, when operating on the processor, cause the computing system to:
receive data relevant to the deviation;
analyze severity of a threat posed by the deviation using at least one analysis algorithm; and
generate a risk score based on a plurality of factors that indicate the severity of the threat.
2. The system of claim 1 , wherein the risk analysis and scoring subsystem further generates an impact assessment score for each affected connected resource by determining an impact on the network using the cyber-physical graph.
3. The system of claim 2 , wherein the impact assessment score further comprises the calculation of the overall impact of a cyberattack, wherein the calculation is based at least in part on the impact assessment score for each connected resource affected by the cyberattack.
4. The system of claim 1 , wherein the detection of deviations is based in part on a comparison of relationships between the connected resources against known security vulnerabilities.
5. The system of claim 4 , wherein the risk score is based at least in part on the results of the comparison against known security vulnerabilities.
6. The system of claim 1 , wherein the observation and state estimation subsystem is further configured to produce a visualization based at least in part on at least a portion of the time-series data, wherein the visualization illustrates changes to the time-series data over time.
7. A method for comprehensive data loss prevention and compliance management, comprising the steps of:
monitoring a plurality of connected resources on a network;
producing a cyber-physical graph representing the plurality of connected resources, wherein:
the connected resources comprise one or more of people, devices, systems, and organizations within the network;
the cyber-physical graph comprises nodes representing the connected resources, with each node having one or more properties associated with the connected resource represented by that node;
the cyber-physical graph comprises edges representing logical or physical relationships between pairs of the connected resources on the network; and
the cyber-physical graph includes information about sensitive data stored on one or more of the connected resources;
collecting data from a plurality of sources within the network, wherein the plurality of sources includes one or more of: system endpoints, infrastructure servers, perimeter security devices, and network security monitoring tools;
analyzing the collected data to identify sensitive data stored on one or more of the connected resources;
updating the cyber-physical graph to include information about the identified sensitive data and its location;
generating expected behavior data of at least some of the plurality of connected resources on the network by applying a behavioral model to nodes of the cyber-physical graph;
generating actual behavior data of at least some of the plurality of connected resources on the network from time-series data comprising a record of network events and the respective times at which each network event occurred;
detecting a deviation between the actual behavior data of a first node and the expected behavior data of the first node; and
when the deviation is detected:
analyzing severity of a threat posed by the deviation using at least one analysis algorithm;
generating a risk score based on a plurality of factors that indicate the severity of the threat; and
displaying the risk score in text and graphical form.
8. The method of claim 7 , further comprising the step of generating an impact assessment score for each affected connected resource by determining an impact on the network using the cyber-physical graph.
9. The method of claim 8 , wherein the impact assessment score further comprises the calculation of the overall impact of a cyberattack, wherein the calculation is based at least in part on the impact assessment score for each connected resource affected by the cyberattack.
10. The method of claim 7 , wherein the detection of deviations is based in part on a comparison of relationships between the connected resources against known security vulnerabilities.
11. The method of claim 10 , wherein the risk score is based at least in part on the results of the comparison against known security vulnerabilities.
12. The method of claim 7 , further comprising the step of producing a visualization based at least in part on at least a portion of the time-series data, wherein the visualization illustrates changes to the time-series data over time.