Systems and methods for context-based mitigation of computer security risks
An apparatus includes a processor operatively coupled to a memory. The processor receives a first set of risk assessment rules including first user privilege criteria and first device criteria. The first device criteria includes a computing device patch level, a network type, and/or a password policy. The processor identifies a user-specific security risk based on the first set of risk assessment rules and applies a privilege mitigation measure based on the user-specific security risk without being in communication with a management server. The processor later receives a second, updated set of risk assessment rules at the computing device. Upon detecting another login of the user, the processor identifies an updated user-specific security risk based on the updated set of risk assessment rules, and applies a modified privilege mitigation measure based on the updated user-specific security risk, again without being in communication with the management server.
1. An apparatus, comprising:
a processor; and
a memory operatively coupled to the processor, the processor configured to:
detect, at a first time, a first login event of a user of a computing device;
receive, in response to detecting the first login event, a first set of risk assessment rules at the computing device, the first set of risk assessment rules including:
first user privilege criteria associated with the user;
a plurality of privilege mitigation measures; and
first device criteria including at least one of a patch level of the computing device, a network type of the computing device, or a password policy, at least one privilege mitigation measure from the plurality of privilege mitigation measures associated with the first user privilege criteria;
identify a first user-specific security risk based on the first user privilege criteria and the first device criteria;
apply, via the computing device and at a second time, a first privilege mitigation measure from the plurality of privilege mitigation measures based on the first user-specific security risk, the processor not in communication with a management server at the second time;
receive a second set of risk assessment rules at the computing device, the second set of risk assessment rules including at least one of second user privilege criteria different from the first user privilege criteria or second device criteria different from the first device criteria;
detect, at a third time subsequent to the first time, a second login event of the user of the computing device;
identify, based on the at least one of the second user privilege criteria and the second device criteria, a second user-specific security risk different from the first user-specific security risk; and
apply, via the computing device and at a fourth time, a second privilege mitigation measure from the plurality of privilege mitigation measures, the second privilege mitigation measure different from the first privilege mitigation measure and based on the second user-specific security risk, the processor not in communication with the management server at the fourth time.
2. The apparatus of claim 1 , wherein:
the processor is configured to identify the first user-specific security risk further based on the first login event,
the first login event includes a failed login attempt, and
the first privilege mitigation measure includes locking out the user from an application running on the computing device.
3. The apparatus of claim 1 , wherein the processor is configured to receive the second set of risk assessment rules at the computing device in response to detection of a new vulnerability associated with the computing device.
4. The apparatus of claim 1 , wherein:
the first device criteria include the network type of the computing device, and
the first privilege mitigation measure includes disabling network access for the user if the network type of the computing device is a public network.
5. The apparatus of claim 1 , wherein:
the first device criteria include the network type of the computing device,
the first privilege mitigation measure includes sending an alert to the user if the network type of the computing device is a public network, and
the alert advises the user that a network is public.
6. The apparatus of claim 1 , wherein the processor is configured to:
identify the first user-specific security risk by:
detecting a user privilege level of the user of the computing device; and
detecting, based on the first set of risk assessment rules, a vulnerable software application to which the user has access, and apply the first privilege mitigation measure by at least one of:
modifying the user privilege level of the user;
disallowing software from being installed on the computing device until an update to the vulnerable software application is installed; or
disallowing the vulnerable software application from running until a security fix has been applied to the computing device.
7. The apparatus of claim 1 , wherein the processor is configured to:
identify the first user-specific security risk by:
detecting that the user has access to a security-sensitive file; and
detecting that the computing device is on a public network, and
apply the first privilege mitigation measure by at least one of:
disallowing access to the security-sensitive file;
disabling network access for the computing device until the computing device is not connected to a public network; or
disabling the computing device.
8. The apparatus of claim 1 , wherein the processor is configured to identify the first user-specific security risk by:
detecting a user privilege level of the user of the computing device; and
detecting that one or more user account settings associated with the user violate a group policy.
9. The apparatus of claim 1 , wherein the processor is configured to apply the first privilege mitigation measure by repairing user account settings associated with the user to comply with a group policy.
10. The apparatus of claim 1 , wherein the processor is configured to apply the first privilege mitigation measure by at least one of:
automatically repairing a group policy associated with the user; or
causing installation of an update on the computing device.
11. The apparatus of claim 1 , wherein the processor is configured to apply the first privilege mitigation measure by at least one of patching, privilege management, whitelisting, or blacklisting.
12. The apparatus of claim 1 , wherein the processor is configured to report an enforcement activity to a management server after applying the first privilege mitigation measure.
13. The apparatus of claim 1 , wherein:
the processor is in operable communication with a network, and
the processor is configured to identify the first user-specific security risk in response to a detected change in the network.
14. The apparatus of claim 1 , wherein the processor is configured to identify the first user-specific security risk in response to a detected group policy violation.
15. The apparatus of claim 1 , wherein:
the processor is configured to detect, based on the first user privilege criteria, that the user has access to a security-sensitive file,
the first device criteria includes the network type of the computing device,
the network type of the computing device is a public network, and
the first privilege mitigation measure includes disallowing access, by the user, to the security-sensitive file.
16. An apparatus, comprising:
a processor; and
a memory operatively coupled to the processor, the processor configured to:
detect, at a first time, a first login of a user on a computing device;
receive a first set of risk assessment rules including user privilege criteria associated with the user of the computing device, the user privilege criteria including a user privilege level for the user;
detect, in response to detecting the first login, and based on the first set of risk assessment rules, a vulnerable software application to which a user has access;
reduce the user privilege level in response to detecting the vulnerable software application;
receive, at a second time after the first time, a second set of risk assessment rules associated with the user of the computing device;
detect, at a third time after the second time, a second login of the user on the computing device; and
raise the user privilege level in response to detecting the second login and based on the second set of risk assessment rules.
17. The apparatus of claim 16 , wherein:
the processor is further configured to detect that a patch has been installed on the computing device,
the patch is associated with the vulnerable software application, and
the raising the user privilege level is further based on detecting the patch.
18. The apparatus of claim 16 , wherein the processor is further configured to:
detect, based on the user privilege criteria, that one or more user account settings associated with the user violate a group policy, and
apply a first privilege mitigation measure that includes repairing the one or more user account settings associated with the user to comply with the group policy.
19. A method, comprising:
detecting, by a processor in operable communication with a network, and at a first time, a first login event of a user of a computing device;
identifying, at the processor and in response to the detecting the first login event of the user, a first set of risk assessment rules, the first set of risk assessment rules including:
first user privilege criteria associated with the user;
a plurality of privilege mitigation measures; and
first application criteria including at least one of a vendor of a software application running on the computing device, a version of the software application, a patch level of the software application, or a risk of exposure for the software application, at least one privilege mitigation measure from the plurality of privilege mitigation measures associated with the first user privilege criteria;
identifying, via the processor, a first user-specific security risk based on the first user privilege criteria and the first application criteria;
applying, via the computing device and at a second time, a first privilege mitigation measure from the plurality of privilege mitigation measures based on the first user-specific security risk, the processor not in communication with a management server at the second time; identifying, by the processor, a second set of risk assessment rules, the second set of risk assessment rules including at least one of a second user privilege criteria different from the first user privilege criteria or a second application criteria different from the first application criteria;
detecting, via the processor and at a third time subsequent to the first time, a second login event of the user of the computing device;
identifying, via the processor, a second user-specific security risk that is different from the first user-specific security risk and based on the at least one of the second user privilege criteria or the second application criteria; and
applying, via the computing device and at a fourth time, a second privilege mitigation measure from the plurality of privilege mitigation measures, the second privilege mitigation measure different from the first privilege mitigation measure and based on the second user-specific security risk, the processor not in communication with the management server at the fourth time.
20. The method of claim 19 , wherein:
the first privilege mitigation measure includes sending an alert to the user, and
the alert includes recommending a software update.
21. The method of claim 19 , wherein the first privilege mitigation measure includes sending an alert to the user, and initiating an update to the software application.