Security violation assessment tool to compare new violation with existing violation

1. A security violation assessment tool comprising:

a memory configured to store:

a plurality of entries, wherein each entry comprises:

a classification of one or more system violations, wherein each system violation comprises a deviation from a baseline, the baseline being assigned to a specific user of a system;

an indication of whether the one or more system violations is a threat to the system, wherein the threat to the system is one or more of:

a loss of confidentiality of the system;

a loss of integrity of the system;

a loss of availability of the system;

a loss of accountability of the system;

a damage to a reputation of the system;

a non-compliance issue; and

a violation of privacy; and

an identification of one or more components of the system threatened by the one or more system violations; and

a plurality of existing system violations, wherein each existing system violation indicates:

a previous deviation from a baseline and comprises at least a classification of the existing system violation; and

an identification of one or more components threatened by the existing system violation;

an identification engine configured to:

receive a notification of a new system violation;

classify, based on characteristics of the new system violation, the new system violation as one or more of:

an access violation;

a configurational violation;

an unauthorized modification;

a usage violation; and

an unsecured surface violation; and

identify a component of the system threatened by the new violation, wherein the threatened component is part of at least:

an application stack of the system;

a middleware stack of the system;

a database stack of the system;

an operating system stack of the system;

a hardware stack of the system; and

a network stack of the system;

an evaluation engine configured to:

compare the new system violation in combination with one or more of the plurality of existing system violations to the plurality of entries; and

determine, based on the comparison of the new system violation and the one or more plurality of existing system violations to the plurality of entries, whether the new system violation threatens the system; and

a notification engine configured to flag for review the new system violation in combination with the one or more of the plurality of existing system violations in response to a determination that the new system violation in combination with the one or more of the plurality of existing system violations threatens the system.

2. The security violation assessment tool of claim 1 , wherein:

the new system violation is performed by a first user of the system;

the first user is assigned a first baseline, wherein the first baseline corresponds to activities on the system that the first user is approved to participate in; and

activity of the first user that deviates from the baseline triggers the new system violation.

3. The security violation assessment tool of claim 1 , further comprising a verification engine configured to:

receive input indicating whether the new system violation in combination with the one or more of the plurality of existing system violations is a threat to the system; and

update the plurality of rules based on the received input.

4. A method comprising:

receiving a notification of a new system violation;

classifying, based on characteristics of the new system violation, the new system violation as one or more of:

an access violation;

a configurational violation;

an unauthorized modification;

a usage violation; and

an unsecured surface violation;

identifying a component of a system threatened by the new violation, wherein the threatened component is part of at least:

an application stack of the system;

a middleware stack of the system;

a database stack of the system;

an operating system stack of the system;

a hardware stack of the system; and

a network stack of the system;

comparing the new system violation in combination with one or more of a plurality of existing system violations to a plurality of entries, wherein:

each of the plurality of existing system violations indicates:

a previous deviation from a baseline and comprises at least a classification of the existing system violation; and

an identification of one or more components threatened by the existing system violation; and

each of the plurality of entries comprises at least:

a classification of one or more system violations, wherein each system violation comprises a deviation from a baseline, the baseline being assigned to a specific user of the system;

an indication of whether the one or more system violations is a threat to the system, wherein the threat to the system is one or more of:

a loss of confidentiality of the system;

a loss of integrity of the system;

a loss of availability of the system;

a loss of accountability of the system;

a damage to a reputation of the system;

a non-compliance issue; and

a violation of privacy; and

an identification of one or more components of the system threatened by the one or more system violations; and

determining, based on the comparison of the new system violation and the one or more plurality of existing system violations to the plurality of entries, whether the new system violation threatens the system; and

flagging for review the new system violation in combination with the one or more of the plurality of existing system violations in response to a determination that the new system violation in combination with the one or more of the plurality of existing system violations threatens the system.

5. The method of claim 4 , wherein:

the new system violation is performed by a first user of the system;

the first user is assigned a first baseline, wherein the first baseline corresponds to activities on the system that the first user is approved to participate in; and

activity of the first user that deviates from the baseline triggers the new system violation.

6. The method of claim 4 , further comprising:

receiving input indicating whether the new system violation in combination with the one or more of the plurality of existing system violations is a threat to the system; and

updating the plurality of entries based on the received input.

7. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

receive a notification of a new system violation;

classify, based on characteristics of the new system violation, the new system violation as one or more of:

an access violation;

a configurational violation;

an unauthorized modification;

a usage violation; and

an unsecured surface violation;

identify a component of a system threatened by the new violation, wherein the threatened component is part of at least:

an application stack of the system;

a middleware stack of the system;

a database stack of the system;

an operating system stack of the system;

a hardware stack of the system; and

a network stack of the system;

compare the new system violation in combination with one or more of a plurality of existing system violations to a plurality of entries, wherein:

each of the plurality of existing system violations indicates:

a previous deviation from a baseline and comprises at least a classification of the existing system violation; and

an identification of one or more components threatened by the existing system violation;

each of the plurality of entries comprises at least:

a classification of one or more system violations, wherein each system violation comprises a deviation from a baseline, the baseline being assigned to a specific user of the system; and

an indication of whether the one or more system violations is a threat to the system, wherein the threat to the system is one or more of:

a loss of confidentiality of the system;

a loss of integrity of the system;

a loss of availability of the system;

a loss of accountability of the system;

a damage to a reputation of the system;

a non-compliance issue; and

a violation of privacy; and

an identification of one or more components of the system threatened by the one or more system violations;

determine, based on the comparison of the new system violation and the one or more plurality of existing system violations to the plurality of entries, whether the new system violation threatens the system; and

flag for review the new system violation in combination with the one or more of the plurality of existing system violations in response to a determination that the new system violation in combination with the one or more of the plurality of existing system violations threatens the system.

8. The media of claim 7 , wherein:

the new system violation is performed by a first user of the system;

the first user is assigned a first baseline, wherein the first baseline corresponds to activities on the system that the first user is approved to participate in; and

activity of the first user that deviates from the baseline triggers the new system violation.

9. The media of claim 7 , further comprising:

receiving input indicating whether the new system violation in combination with the one or more of the plurality of existing system violations is a threat to the system; and

updating the plurality of rules based on the received input.