Systems and methods for detecting and thwarting attacks on an IT environment
Systems and methods for detecting and thwarting attacks on a computing system. The methods comprise: collecting timestamped data from different software products comprising a unified end point management product, an SBC/ADV product, an application delivery controller product, a content collaboration product, and/or a software defined WAN product; analyzing the collected timestamped data to determine if an observed user behavior matches a learned normal user behavior of an authorized user associated with a user account; determining a risk classification level associated with a credential used by a user to log into the user account, when the observed user behavior does not match the learned normal user behavior of the authorized user; and causing at least one security related action to be performed when the risk classification level is greater than a threshold level or the risk classification level is one of a top N highest risk classification levels.
1. A method for detecting and thwarting attacks on a computing system, comprising:
collecting, by a first computing device, timestamped data from a plurality of different software products comprising at least two of a unified end point management product, a Server Based Computing (“SBC”) and App and Desktop Virtualization (“ADV”) product, an application delivery controller product, a content collaboration product, and a software defined wide area network product;
analyzing, by the first computing device, the collected timestamped data to determine if an observed user behavior matches a learned normal user behavior of an authorized user associated with a user account;
in response to the observed user behavior not matching the learned normal user behavior of the authorized user, triggering a first increase to a risk value associated with a credential used by a user of a second computing device to log into the user account when a first criteria is met;
triggering a second increase of the risk value when a second criteria is met, the second criteria being different from the first criteria;
determining an updated risk classification level which is based on both the first and second increase; and
causing at least one security related action to be performed by the first computing device or the second computing device when the risk classification level is greater than a threshold level or the risk classification level is one of a top N highest risk classification levels.
2. The method according to claim 1 , wherein the timestamped data specifies at least one of a newly observed user behavior, the second computing device's location, the second computing device's unique identifier, and a device type.
3. The method according to claim 2 , wherein the newly observed user behavior is defined by at least one of a type of network the second computing device is connecting from, a type of input device being used by a user of the second computing device, a type of user-software interaction, and a type of action caused by the user-software interaction.
4. The method according to claim 1 , wherein the second criteria is met when the credential is being used from two distant geographic locations at the same time.
5. The method according to claim 1 , wherein the second criteria is met when the second computing device is a non-enterprise issued device.
6. The method according to claim 1 , wherein the second criteria is met when data is being provided to a peripheral device of the second computing device.
7. The method according to claim 1 , wherein the at least one security related action further comprises at least one of disconnecting the second computing device from the enterprise system, presenting a multi-factor challenge to the user of the second computing device, disconnecting the session established with the second computing device, activating session recording for the second computing device, and remotely causing data to be deleted from the second computing device.
8. The method according to claim 1 , wherein the at least one security related action comprises terminating access to the user account from the second computing device while another use of the credential to remain logged into the user account via a third computing device is unaffected by the at least one security related action.
9. The method according to claim 1 , wherein the first criteria is met when, based on the analyzing, at least one of the following is determined: (i) the second computing device identifier is blacklisted or unusual, (ii) the credential is being used from two distant geographic locations at the same time, or (iii) the credential is being used again from a different geographic location within a given time period from a last use of the credential.
10. A system, comprising:
a processor; and
a non-transitory computer-readable storage medium comprising programming instructions that are configured to cause the processor to implement a method for detecting and thwarting attacks on the system, wherein the programming instructions comprise instructions to:
collect timestamped data from a plurality of different software products comprising at least two of a unified end point management product, a Server Based Computing (“SBC”) and App and Desktop Virtualization (“ADV”) product, an application delivery controller product, a content collaboration product, and a software defined wide area network product;
analyze the collected timestamped data to determine if an observed user behavior matches a learned normal user behavior of an authorized user associated with a user account;
determine a risk classification level associated with a credential used by a user of a computing device to log into the user account, when a first criteria is met, the first criteria being met when the observed user behavior does not match the learned normal user behavior of the authorized user;
trigger a first increase to a risk value associated with a credential used by a user of a second computing device to log into the user account when a first criteria is met;
trigger a second increase of the risk value when a second criteria is met, the second criteria being different from the first criteria;
determine a risk classification level which is based on both the first and second increase; and
cause at least one security related action to be performed by the system or the computing device when the risk classification level is greater than a threshold level or the risk classification level is one of a top N highest risk classification levels.
11. The system according to claim 10 , wherein the timestamped data specifies at least one of a newly observed user behavior, the computing device's location, the computing device's unique identifier, and a device type.
12. The system according to claim 11 , wherein the newly observed user behavior is defined by at least one of a type of network the computing device is connecting from, a type of input device being used by a user of the computing device, a type of user-software interaction, and a type of action caused by the user-software interaction.
13. The system according to claim 10 , wherein the second criteria is met when the credential is being used from two distant geographic locations at the same time.
14. The system according to claim 10 , the second criteria is met when the credential is being used again from a different geographic location within a given time period from a last use of the credential.
15. The system according to claim 10 , wherein the second criteria is met when data is being provided to a peripheral device of the computing device.