DETERMINING A THREAT SEVERITY ASSOCIATED WITH AN EVENT
Systems and techniques for assessing a risk associated with a data loss prevention (DLP) policy violation are described. Characteristics of data associated with the DLP policy violation and user information associated with a participant associated with the DLP policy violation may be determined. An expertise and a position of the participant may be determined and correlated with the one or more characteristics of the data to determine a risk assessment associated with the DLP policy violation. After determining that the risk assessment satisfies a threshold, a subject matter expert may be determined based on the characteristics of the data, and an alert may be sent to the subject matter expert requesting review of the DLP policy violation.
1 . A computer-implemented method, comprising:
determining that a data loss prevention (DLP) policy violation has occurred;
determining one or more characteristics of data associated with the DLP policy violation;
determining user information associated with a participant associated with the DLP policy violation, the user information including a user identifier associated with the participant, an expertise of the participant, and a position of the participant;
correlating the expertise and the position of the participant with the one or more characteristics of the data to create a correlation factor;
determining a risk assessment associated with the DLP policy violation based on the correlation factor;
determining that the risk assessment satisfies a threshold;
determining a subject matter expert based on at least one of the one or more characteristics of the data; and
sending an alert to the subject matter expert to review the DLP policy violation.
2 . The computer-implemented method of claim 1 , wherein the one or more characteristics of the data include:
a classification comprising one of a public document classification, an internal document classification, a confidential document classification, or a restricted document classification;
a topic associated with the data; and
a privilege level to access the data.
3 . The computer-implemented method of claim 1 , wherein determining the expertise of the participant associated with the DLP policy violation comprises:
identifying documents associated with the participant, the documents accessible via external data sources and enterprise data sources;
identifying communications associated with the participant; and
analyzing the documents and the communications to determine the expertise of the participant.
4 . The computer-implemented method of claim 3 , wherein the external data sources include a patent publication database and a technical publication database.
5 . The computer-implemented method of claim 1 , further comprising:
displaying to the subject matter expert, via a user interface, a plurality of actions;
receiving a selection of an action from the plurality of actions; and
performing the action.
6 . The computer-implemented method of claim 5 , wherein the action comprises modifying credentials associated with the participant to prevent the participant from performing an additional DLP policy violation.
7 . The computer-implemented method of claim 1 , wherein the alert includes:
the one or more characteristics of the data associated with the DLP policy violation; and
the expertise and the position of the participant, wherein the position includes a current title of the participant and an indication of a placement of the participant in a hierarchical organization.
8 . One or more non-transitory computer-readable media storing instructions that are executable by one or more processors to perform operations comprising:
determining that a data loss prevention (DLP) policy violation has occurred;
determining one or more characteristics of data associated with the DLP policy violation;
determining user information associated with a participant associated with the DLP policy violation;
determining an expertise and a position of the participant;
correlating the expertise and the position of the participant with the one or more characteristics of the data to create a correlation factor;
determining a risk assessment associated with the DLP policy violation based on the correlation factor;
determining that the risk assessment satisfies a threshold;
determining a subject matter expert based on at least one of the one or more characteristics of the data; and
sending an alert to the subject matter expert to review the DLP policy violation.
9 . The one or more non-transitory computer-readable media of claim 8 , wherein the one or more characteristics of the data include:
a classification characteristic comprising one of a public document classification, an internal document classification, a confidential document classification, or a restricted document classification;
a topic associated with the data; and
a privilege level to access the data.
10 . The one or more non-transitory computer-readable media of claim 8 , wherein determining the expertise of the participant associated with the DLP policy violation comprises:
identifying documents associated with the participant, the documents accessible via external data sources and enterprise data sources;
identifying communications associated with the participant; and
analyzing the documents and the communications to determine the expertise of the participant.
11 . The one or more non-transitory computer-readable media of claim 10 , wherein the external data sources include a patent publication database and a technical publication database.
12 . The one or more non-transitory computer-readable media of claim 8 , the operations further comprising:
displaying to the subject matter expert, via a user interface, a plurality of actions;
receiving a selection of an action from the plurality of actions; and
modifying credentials associated with the participant to prevent the participant from performing an additional DLP policy violation.
13 . The one or more non-transitory computer-readable media of claim 8 , wherein the alert includes:
the one or more characteristics of the data associated with the DLP policy violation; and
the expertise and the position of the participant, wherein the position includes a current title of the participant and an indication of a placement of the participant in a hierarchical organization.
14 . A server, comprising:
one or more processors; and
one or more non-transitory computer-readable media storing instructions that are executable by the one or more processors to perform operations comprising:
determining that a data loss prevention (DLP) policy violation has occurred;
determining one or more characteristics of data associated with the DLP policy violation;
determining user information associated with a participant associated with the DLP policy violation;
determining an expertise and a position of the participant;
correlating the expertise and the position of the participant with the one or more characteristics of the data to create a correlation factor;
determining a risk assessment associated with the DLP policy violation based on the correlation factor;
determining that the risk assessment satisfies a threshold;
determining a subject matter expert based on at least one of the one or more characteristics of the data; and
sending an alert to the subject matter expert to review the DLP policy violation.
15 . The server of claim 14 , wherein the one or more characteristics of the data include:
a classification characteristic comprising one of a public document classification, an internal document classification, a confidential document classification, or a restricted document classification;
a topic associated with the data; and
a privilege level to access the data.
16 . The server of claim 14 , wherein determining the expertise of the participant associated with the DLP policy violation comprises:
identifying documents associated with the participant, the documents accessible via external data sources and enterprise data sources;
identifying communications associated with the participant; and
analyzing the documents and the communications to determine the expertise of the participant.
17 . The server of claim 16 , wherein:
the external data sources include a patent publication database and a technical publication database; and
the enterprise data sources include a directory service, an internal document database, an email service, an instant messaging service, and a conferencing service.
18 . The server of claim 14 , further comprising:
displaying to the subject matter expert, via a user interface, a plurality of actions;
receiving a selection of an action from the plurality of actions; and
performing the action.
19 . The server of claim 18 , wherein the action comprises modifying credentials associated with the participant to prevent the participant from performing an additional DLP policy violation.
20 . The server of claim 14 , wherein the alert includes:
the one or more characteristics of the data associated with the DLP policy violation; and
the expertise and the position of the participant, wherein the position includes a current title of the participant and an indication of a placement of the participant in a hierarchical organization.