RU2811731C2 - Method for optimizing information security policies based on user behaviour patterns - Google Patents

Abstract

FIELD: information security.

SUBSTANCE: risk management tools in enterprise information security, as well as decision support systems in the field of information security. A method for optimizing information security policies based on user behaviour patterns includes the following actions: ranking assessment of the resources of user workstations available for information security tools (hereinafter referred to as IST); monitoring user behaviour, vulnerability index and behaviour anomalies in real time; detection of behaviour patterns; assessing complexity of information security policies; optimization of hardware and software information protection systems. To do this, all user workstations are first ranked according to the level of available hardware resources. Also, for workstations, an additive level of complexity of information security policies and the level of response of the information security service are introduced. Then, a list of user behaviour patterns is entered, i.e. such categories of users that require an increase in the level of information security policies or the level of response. Optimization criteria for these levels are introduced for the previously measured assessment of free hardware resources of workstations.

EFFECT: reduced level of requirements for enterprise information security hardware resources and reduced labour costs of information security officers and administrators in providing response measures to incidents identified by information security.

2 cl, 6 dwg

Description

Field of technology

The invention relates to risk management tools in enterprise information security, as well as to decision support systems in the field of information security, namely, it is a means of optimizing the operation of automated information security tools in accordance with the level of actual risk among different groups of users of the enterprise information infrastructure. The most promising areas of application of the method are various information security systems, such as leak protection systems, anti-virus systems, access control systems, event and incident management systems and others. This is especially true in medium-sized and large systemically important enterprises, banks, state-owned companies, large and medium-sized industrial enterprises, enterprises in the medical industry and the service sector.

State of the art

From the existing level of technology, information security systems are known that analyze security events and security incidents coming from the enterprise information infrastructure (IIP). Such subsystems include anti-virus and anti-phishing software, firewalls, user activity monitoring programs, hard drive and file storage scanners, event and incident management systems and other solutions. Each such system has many event processing and response rules, parameters and settings that determine with what care and to what extent they can work, all of this is usually called the security policy of information protection tools (IPS).

International and domestic standards recommend classifying threats and risks in detail. Due to their wide range, the security policy of information security often turns into a complex complex of many options for rules and settings. To ensure the functionality of information security policies, significant resources are spent on both user workstations and network equipment, slowing down their work. This can cause disruptions in the work of both individual employees and entire departments.

In addition to the lack of computing power, the problem of irrational use of labor resources of security officers and administrators is also relevant, since objectively assessing the type of threat and risk level of a specific workstation, user or group of users seems to be a costly task for a security officer, especially in large organizations. Therefore, information security services are forced to deliberately overestimate the risks of information leakage and assign the most stringent and complex information security policies to most users. For this reason, response measures are prescribed irrationally and, consequently, the labor costs of the information security service increase.

As you know, the main source of threats to information security is the user, his actions, motives and goals. And this, in turn, is manifested in his behavior. Systems now exist to evaluate user actions and identify associated risks. However, they have a number of disadvantages.

For example, the invention under patent No. US7865958B2 (application No. US36615009A) does not analyze the personal qualities of the user and his involvement in the business processes of the enterprise. This makes it difficult to identify users who stand out relative to other employees of the enterprise within a position, department or functional role (so-called outliers). But it is precisely such users who require special control from information security.

The technical solution described in application No. US201615253263A under patent No. US2016373477A1 uses the assessment of user behavior based on his actions. But such an assessment is based on manually predefined rules of the information security policy. Thus, the proposed method does not allow determining the normal behavior of each user and requires setting up a system of information security rules in advance. In addition, users are not classified into behavior categories (patterns) in real time, which does not allow for large-scale security measures and saving security staff resources.

The disadvantage of the technical solution described in application No. CN201710044237A under patent No. CN106845272A is the lack of consideration of the technical features of the hardware of user workstations, with a methodology for the corresponding optimal distribution of free resources necessary for user information security policies.

In the invention according to application No. 2012156444/08 (patent No. RU 2534935
C2) similar input data is used, but there is no assessment of the user's normal behavior profile in relation to other users. In addition, the list of risks considered is limited to the threats of viewing inappropriate content and time spent working on a PC. Thus, the existing solution is suitable for personal use, for example, by the parents of a child, but is not suitable for use on an industrial scale.

The technical solution closest to the claimed invention is the invention according to application No. US201113191201A (patent No. US9275065B1). The common features of the claimed invention and the said one are:

technical implementation of collecting user data from the workstation on a regular basis, close to real time;

the presence of a behavior profile characteristic of the user;

determination of deviation from the norm of user behavior (abnormal behavior);

the presence of a partially automatic mechanism for responding to behavioral anomalies;

integration with systems such as DataLeakPrevention (DLP).

At the same time, the main disadvantages of the technical solution under consideration (application No. US201113191201A (patent No. US9275065B1) are:

lack of relative assessment of user behavior in comparison with other users in order to differentiate the application of security measures to groups of users with different behavior;

the lack of a mechanism for automatically categorizing users for further optimization of information security policies, and the lack of appropriate ways to respond to information security systems in relation to incidents related to such groups;

lack of a way to optimize enterprise information security hardware resources.

All of the above technical solutions lack a way to optimize the computing resources of user workstations and information security hardware for certain user groups.

The present invention eliminates the indicated disadvantages of existing technical solutions and the above information security problems.

Consequently, the technical result of the claimed invention is to reduce the level of requirements for enterprise information security hardware resources, as well as to reduce the labor costs of security information officers and administrators in providing response measures to incidents detected by information security.

The claimed technical solution also makes it possible to reduce the level of requirements for enterprise information security hardware resources, which is achieved through the proposed method for optimizing the system of information security policies (ISIS) for any combination of user behavior patterns, the list and method of detection of which are defined in this application, and also allows reduce the labor costs of information security officers and administrators in providing response measures to incidents detected by information security through the use of ranking scales for assessing behavior indicators and automatically rebuilding information security policies for a particular category of users.

Disclosure of the invention

To solve the above problems, a method is proposed for optimizing hardware and software information security (IS) based on user behavior patterns, which includes:

ranking assessment of the resources of user workstations available for information security;

monitoring user behavior, vulnerability index and behavior anomalies in real time;

detection of behavior patterns;

assessing the complexity of information security policies;

optimization of hardware and software information protection systems.

To do this, all user workstations are first ranked according to the level of available hardware resources. Also, for workstations, an additive level of complexity of information security policies and the level of response of the information security service are introduced. Then a list of user behavior patterns is entered, i.e. such categories of users that require an increase in the level of information security policies or the level of response. For each category of users, the exact conditions for entering it are determined. These conditions use real-time user behavior metrics and dynamics. Then, for each category of users (pattern) and for an arbitrary combination of patterns, an additive increase in the level of complexity of information security policies and the level of response are determined. Criteria for optimizing these levels are introduced for the previously measured assessment of free hardware resources of workstations.

Brief description of drawings

Figure 1. A method for optimizing information security policies based on user behavior patterns. General scheme.

Figure 2. Diagram of the basic hardware and software of the information protection system.

Figure 3. Example of determining the workload threshold.

Figure 4. Example of a user behavior profile.

Figure 5. Method for detecting user patterns.

Figure 6. An example of determining the level of complexity of an information security policy and response measures for a specific user.

Carrying out the invention

In the modern information infrastructure of an enterprise, many automated information security systems (hereinafter referred to as ISIS) are used. An approximate diagram of the information protection system is presented in Figure 2. The most commonly used are the following:

antivirus systems (Antivirus);

antispam and anti-phishing solutions (Antispam);

firewalls (Firewall or NGFW);

prevention of information leaks (DataLeakPrevention);

Identity and access management (IAM/IDM) to enterprise information systems.

Each such system is characterized by the use of a system of security rules (policies), including conditions of use and methods of response. For example, for an anti-virus system the rules may sound like this:

if the workstation is located in the internal security loop, then synchronization with the anti-virus database should occur once a week;

if the workstation belongs to an employee working remotely, then the scan should be launched taking into account local time and the nature of the employee’s work.

Also, each automated information security system usually operates with the concept of an incident or violation, which is characterized by a level of severity or criticality. There may be several of them. Without losing the generality of the approach, we will use an implementation using two levels of severity or criticality: medium and high.

The main source of threat and risk in information security is the user. Therefore, it is the characteristics of user behavior in the information infrastructure that mainly determine which system of rules should be used in relation to him.

At the same time, for the functioning of any system of information security rules, hardware is used: network equipment and user workstations. Any rule of the information security system is associated with information security functions that consume hardware resources. And the more complex and voluminous the system of information security rules, the more hardware resources are needed for its uninterrupted operation.

1. Rank assessment of user workstation resources available for information security

To optimize the technical infrastructure, user workstations and network hosts (servers) are subject to evaluation for performance and available resources. To do this, over a sufficient period, for example, one month, workload indicators are measured on each workstation and separately on network hosts:

memory usage,

use of permanent memory,

CPU load.

Next, the value of each indicator sufficient for the vast majority of work tasks is determined. The value of the workload threshold is considered sufficient if during 100-v% of the time the workstation is functioning the indicator does not go beyond it (see diagram). In particular, it is recommended to take v equal to 5%. An example of determining the workload threshold is presented in the diagram (Figure 3).

Thus, for each user, a profile of sufficient workload is determined, consisting of specific measured values of workload indicators.

Next, for each indicator, an assessment is made on a ranking scale relative to all other IIP users. This is done using an empirical distribution function that takes values from 0 to 1, or from 0 to 100%. This value is then subtracted from 100% to obtain the percentage of available resources for each load metric. The total value or index of available resources on a user's workstation is defined as the root of the sum of the squares of all workload profile metric rank values divided by the root of N, where N is the number of workload metrics.

2.Monitoring user behavior and behavior anomalies in real time

Users include:

- technical devices: printers, scanners, USB drives,

- robotic contacts: mailings, automatic notifications, etc.,

- participants in communications,

- workstation users.

In turn, communication participants can be divided into internal and external. Internal participants are defined by the SMPS security loop. All other communication participants are external to the IIP. We will call any exchange of information between communication participants an information message.

According to the method implemented using the computer program “Solar Dozor 7” (rt-solar.ru/dozor7, certificate of registration of the computer program No. 2020660833), based on the actions and communications of users, its main behavioral indicators are calculated and a profile of normal behavior is determined. Which means monitoring the actions and communications of each user in real time. The following sources for collecting initial data on user communications are considered:

- user workstation,

- central mail server,

- network hardware.

In this case, the assessment of the behavior of each user takes into account the behavior of all users operating in the IIP. This allows us to create a single ranking measurement scale for all employees. With its help, you can rank the behavior indicators of all users relative to each other. For each user, according to the method implemented using the “Solar Dozor 7” computer program:

- actual indicators of behavior,

- normal behavior indicators,

- framework of behavior (confidence interval of behavior indicators),

- user vulnerability index.

An example of a user behavior profile is presented in Figure 4.

3. Identifying the user's special contacts and special contacts profile

The interaction of communication participants A and B can be represented as the difference between the indicators of messages sent by A to B and the indicators of messages sent by B to A. For such interaction between A and B, the predominant frequencies that determine the regularity of communication can be identified. To qualitatively assess regularity, a ranking scale is used. Regularity is statistically normalized for all communication participants of the same type using an empirical distribution function and takes values from 0 to 1. If the values are close to zero, then the regularity is low, and if close to one, then it is high.

One of the properties of interaction between communication participants A and B is attention. Attention from A to B is defined as one divided by the median number of recipients for messages sent by A, where B is present in the recipients. A ranking scale is used to qualitatively assess attention. Attention is statistically normalized for all communication participants of the same type using an empirical distribution function and takes values from 0 to 1. If the values are close to zero, then attention is low, and if close to one, then it is high.

The difference in attention from A to B and the messages sent determine the balance of communication. It varies from -1 to 1. If the balance is -1, then A does not show attention to B, if it is 1, then A shows the maximum possible attention to B, if it is close to 0, then A and B interact equally.

The reciprocity of communication between participants A and B is determined by the minimum of attention from A to B and from B to A. For example, if the attention of A to B is 0.6, and the attention of B to A is 0.8, then the reciprocity is 0.6. Maximum attention between communication participants A and B is called communication potential. Next, using attention, reciprocity, balance and communication potential, the user's special contacts are determined:

- user's working ego network;

- private ego network of the user;

- unique (un)known user contacts.

As an implementation option, it is recommended to use the specified values as percentages.

Among all communication participants, other communication participants fall into the working close circle of communication (ego-network) of a communication participant if:

- regularity of communication with them exceeds 60%;

- the balance of communication with them is below 40%;

- reciprocity of communication with them exceeds 60%;

- they do not apply to unknown user contacts.

A communication participant in the user’s close social circle (ego network) is internal if it belongs to the IIP. Otherwise it is external.

A unique (unknown) contact of a communication participant is another communication participant if:

- the potential for communication with him is greater than zero,

- all other participants have zero communication potential with him.

A communication participant from unknown user contacts is internal if it belongs to the IIP. Otherwise it is external.

Among all communication participants, other communication participants fall into the non-working close circle of a communication participant if:

- they are unknown contacts,

- regularity of communication with them exceeds 60%,

- the balance of communication with them is below 40%,

- reciprocity of communication with them exceeds 60%.

4. The following describes the conditions for detecting patterns of user behavior important for information security. The detection method is shown in figure 4

As an implementation option, it is recommended to use the specified changes in the complexity level of information security policies and the level of response.

401. Users with suspicious behavior in accordance with the proposed method include the following patterns:

- users with an abnormal surge of external activity;

- users with abnormally large sending of protected information;

- users with signs of insider activity;

- users with signs of dismissal.

Below are the criteria (a combination of logically related conditions) for falling into these patterns. As well as measures to adapt the information security policy, including increasing the level of complexity of information security policies and the level of response of the information security service.

Pattern Condition set Policy complexity level Response level Users with an abnormal surge in external activity Presence of an anomaly “Surge in external activity” over the past 30 days Antivirus: -
Antispam: +1
Firewall: -
DLP: +1
IAM/IDM: -
Total: +2 Antivirus: -
Antispam: +1
Firewall: +1
DLP: +1
IAM/IDM: -
Total: +3 Users with abnormally large uploads of protected information Presence of the anomaly “Spike in sending information objects” over the last 30 days Antivirus: -
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: -
Total: +1 Antivirus: -
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: -
Total: +1 Users with signs of insider activity Normal "business range"> 2.5
AND
Presence of a non-empty private ego network
AND
Normal "external activity"> 0.0
AND
(
Normal "Getting information"objects"> 0.0
OR
Normal “Sending info. objects"> 0.0
) Antivirus: -
Antispam: -
Firewall: +1
DLP: +1
IAM/IDM: +1
Total: +3 Antivirus: -
Antispam: -
Firewall: +1
DLP: +1
IAM/IDM: +1
Total: +3

For the pattern of users with signs of leaving, four variants of the quitter model are used.

Resigning model Condition set Policy complexity level Response level An employee who conducts exclusively internal activities. The dismissal is planned. Normal "external activity" = 0.0
AND
Normal "Internal Activity"> 1.0
AND
Gradual decline in normal “internal activity” > 0.5
AND
Narrowing of the work schedule > 30% per month.
AND
Anomaly “Occurrence of external activity” for 30 days
AND
(
Anomaly “Unexpected external unknowns - sometimes” for 30 days
OR
Anomaly
"Unexpected information object"
) Antivirus: -
Antispam: -
Firewall: -
DLP: -
IAM/IDM: +1
Total: +2 Antivirus: +1
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +3 Likewise. But no layoffs are planned. Normal "external activity" = 0.0
AND
Normal "Internal Activity"> 1.0
AND
Actual "external activity" and "internal activity" are unstable over 30 days
AND
Anomaly “Occurrence of external activity” for 30 days
AND
(
Anomaly “Unexpected external unknowns - sometimes” for 30 days
OR
Anomaly
"Unexpected information object"
) Antivirus: -
Antispam: -
Firewall: -
DLP: -
IAM/IDM: +1
Total: +1 Antivirus: -
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +2 An employee who usually conducts both external and internal activities. The dismissal is planned. Normal "external activity"> 1.0
AND
Gradual decline in normal “external activity” > 0.5
AND
Gradual decline in normal “internal activity” > 0.5
AND
(
Anomaly “disappearance of external activity” for 30 days
OR
Anomaly “Unexpected external unknowns - sometimes” for 30 days
OR
Anomaly
"Unexpected information object"
) Antivirus: -
Antispam: -
Firewall: +1
DLP: +1
IAM/IDM: +1
Total: +3 Antivirus: +1
Antispam: -
Firewall: +1
DLP: +1
IAM/IDM: +1
Total: +4 Likewise. But no layoffs are planned. Normal "external activity"> 1.0
AND
Normal "internal activity"> 1.0
AND
Actual "external activity" and "internal activity" are unstable over 30 days
AND
(
Anomaly “disappearance of external activity” for 30 days
OR
Anomaly “Unexpected external unknowns - sometimes” for 30 days
OR
Anomaly
"Unexpected information object"
) Antivirus: -
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +3 Antivirus: -
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +3

402. Users with irregular working hours include employees who work at night, as well as employees who work on weekends. In the first case, these may be workers with shift work, and in the second, employees who use their rest time to work.

Below are the criteria (a combination of logically related conditions) for falling into these patterns. As well as measures to adapt the information security policy, including increasing the level of complexity of information security policies and the level of response of the information security service.

Pattern Condition set Policy complexity level Response level Work at night The daily activity frame crosses the night time from 22:00 to 6:00, with regularity once a week for at least three weeks. Antivirus: -
Antispam: -
Firewall: -
DLP: -
IAM/IDM: +1
Total: +1 Antivirus: -
Antispam: -
Firewall: -
DLP: -
IAM/IDM: +1
Total: +1 Work on weekends The daily activity frame crosses the employee’s non-working days, with regularity once a week for at least three weeks. Antivirus: -
Antispam: -
Firewall: -
DLP: -
IAM/IDM: +1
Total: +1 Antivirus: -
Antispam: -
Firewall: -
DLP: -
IAM/IDM: +1
Total: +1

403. Users susceptible to phishing and credential compromise include:

- super popular users who have significantly more incoming communications than all other users;

- users who have a large number of unknown (unique) incoming contacts;

- users who have non-empty private ego networks.

Below are the criteria (a combination of logically related conditions) for falling into these patterns. As well as measures to adapt the system of information security rules to fit into the user’s pattern. The following information security rules correspond to them, and a standard set of automated information security systems is considered as an implementation option:

Pattern Condition set Policy complexity level Response level Super popular Normal “popularity” > 4.0 Antivirus: -
Antispam: +1
Firewall: +1
DLP: -
IAM/IDM: +1
Total: +3 Antivirus: -
Antispam: +1
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +3 With a large number of unknown (unique) incoming external contacts Number of unknown contacts > 10 Antivirus: +1
Antispam: +1
Firewall: +1
DLP: -
IAM/IDM: -
Total: +3 Antivirus: +1
Antispam: +1
Firewall: +1
DLP: -
IAM/IDM: -
Total: +3 With private ego networks Number of contacts in private ego network > 0 Antivirus: -
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: -
Total: +1 Antivirus: +1
Antispam: -
Firewall: +1
DLP: +1
IAM/IDM: -
Total: +3

404. Identification of robotic users and orphaned work accounts, so-called. "dead souls"

Below are the criteria (a combination of logically related conditions) for falling into these patterns. As well as measures to adapt the information security policy, including increasing the level of complexity of information security policies and the level of response of the information security service.

Pattern Condition set Policy complexity level Response level Robots, technical newsletters and machines Presence of an anomaly “Surge in external activity” over the past 30 days Antivirus: -
Antispam: +1
Firewall: -
DLP: +1
IAM/IDM: -
Total: +2 Antivirus: -
Antispam: +1
Firewall: +1
DLP: +1
IAM/IDM: -
Total: +3 Orphan work accounts, so-called. "dead Souls" Maximum value of actual “Internal activity” for 60 days > 0.0
AND
Maximum value of actual “External Activity” for 60 days > 0.0 Antivirus: -
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +2 Antivirus: -
Antispam: -
Firewall: -
DLP: -
IAM/IDM: -
Total: -

405. Identification of users who most often accumulate or distribute protected information.

Below are the criteria (a combination of logically related conditions) for falling into these patterns. As well as measures to adapt the information security policy, including increasing the level of complexity of information security policies and the level of response of the information security service.

Pattern Condition set Policy complexity level Response level Workstations and users most often accumulate protected information Normal Information Asset Sending > 4.0
AND
(
Normal "external activity"> 0.0
OR
Normal "internal activity"> 0.0
) Antivirus: -
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +2 Antivirus: -
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +2 Workstations and users of the most other most other disseminating protected information Normal Information Asset Sending > 4.0
AND
(
Normal “Popularity” > 0.0 Antivirus: +1
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +3 Antivirus: +1
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +3

406.Identification of users with high involvement in business processes.

Below are the criteria (a combination of logically related conditions) for falling into these patterns. As well as measures to adapt the information security policy, including increasing the level of complexity of information security policies and the level of response of the information security service.

Pattern Condition set Policy complexity level Response level Workstations and users with high involvement in business processes Normal Information Asset Sending > 4.0
AND
(
Normal “Popularity” > 0.0
) Antivirus: +1
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +3 Antivirus: +1
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +3

407. Identification of users with a predominance of external activity.

Below are the criteria (a combination of logically related conditions) for falling into these patterns. As well as measures to adapt the information security policy, including increasing the level of complexity of information security policies and the level of response of the information security service.

Pattern Condition set Policy complexity level Response level Users with a predominance of external activity Normal “Internal activity” < 0.8*Normal “External activity”
AND
(
Normal “External Activity” >2.5 Antivirus: -
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +2 Antivirus: -
Antispam: -
Firewall: -
DLP: -
IAM/IDM: -
Total: -

408. Definition of users - new employees.

Below are the criteria (a combination of logically related conditions) for falling into these patterns. As well as measures to adapt the information security policy, including increasing the level of complexity of information security policies and the level of response of the information security service.

Pattern Condition set Policy complexity level Response level New employees There was no normal “Internal activity” until 1.5 months ago
AND
There is no normal “External activity” until 1.5 months ago
AND
There is no normal “Popularity” until 1.5 months ago
AND
(Current normal "Internal Activity"> 0.0
OR
Current normal "External Activity"> 0.0 Antivirus: -
Antispam: -
Firewall: -
DLP: -
IAM/IDM: -
Total: - Antivirus: +1
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: +1
Total: +2

409. Identification of users with typical use of instant messengers or mail.

Below are the criteria (a combination of logically related conditions) for falling into these patterns. As well as measures to adapt the information security policy, including increasing the level of complexity of information security policies and the level of response of the information security service.

Pattern Condition set Policy complexity level Required level of response The predominance of mail in communications (Normal current “Internal activity in mail” + Normal current “External activity in mail”) >1.5*(Normal current “Internal activity in messengers” + Normal current “External activity in messengers”) Antivirus: -
Antispam: -
Firewall: -
DLP: -
IAM/IDM: -
Total: - Antivirus: -
Antispam: -
Firewall: -
DLP: +1
IAM/IDM: -
Total: - The predominance of instant messengers in communications (Normal current “Internal activity in messengers” + Normal current “External activity in messengers”) > 1.5*(Normal current “Internal activity in mail” + Normal current “External activity in mail”) Antivirus: +1
Antispam: -
Firewall: +1
DLP: +1
IAM/IDM: +1
Total: +4 Antivirus: +1
Antispam: -
Firewall: +1
DLP: +1
IAM/IDM: -
Total: +3

5. Assessing the complexity of the policy and the level of response of automated information security systems for a specific user based on characteristic behavior patterns

So, based on the rules outlined above, a set of characteristic behavior patterns is determined for each user in real time. Next, for a set of patterns, the total level of complexity of the information security policy is determined by the usual summation over a set of user patterns. Then the required total level of response of the information security service is determined by the usual summation over a set of user patterns.

Then these two values, using an empirical (sample) distribution function for all users, are brought to a single ranking scale, taking values from 0 to 1, or from 0% to 100%, see Figure 5. In this way, the level of complexity of policies and the required level are calculated response.

6. Optimization of hardware resources available for information security

Based on point 1, the actual index of available resources is determined for each user, and based on points 4, 5, the required level of policy complexity is determined. The difference between the complexity level of information security policies and the index of available resources should tend to zero. If the level of policy complexity is significantly higher than the index of available resources, then this indicates a lack of hardware capacity for the uninterrupted operation of automated information security systems. If, on the contrary, the available resource significantly exceeds the required policy complexity, then we can say that the hardware capacity is being wasted. In both cases, we have to talk about irrational use of hardware resources.

For all users, the value of the discrepancy between the index of available resources and the complexity of policies is calculated as the root of the sum (for all users) of the squares of the difference between the index of available resources and the level of policy complexity for each user.

As control measures, it is recommended to redistribute the hardware resources of the enterprise information infrastructure so that this value tends to zero.

7. Optimization of labor costs for implementing information protection measures

Traditional management of information security in an enterprise includes assigning a risk level to each user in each information protection system. Each such risk level can be associated with a level of response from the information security service. This depends on the user’s location in special control groups, the user’s special access rights, the specifics of business processes, etc. Usually there are from 3 to 5 levels. It is worth noting that this method is relevant for any number of such levels.

In this way, for each user, the current level of response in the enterprise can be assessed. To do this, response levels are summed up for all information security systems and then this value is ranked among all users using an empirical distribution function. This determines the actual current level of response, taking values from 0 to 1, or from 0% to 100%.

Based on points 4 and 5, the required level of response is determined for each user and his behavior patterns. The difference between the current level of response and the required level of response should tend to zero. If the required level of response is significantly higher than the current level of response, this indicates that the information security measures taken are insufficient. If, on the contrary, the current level of response significantly exceeds the required level, then we can talk about excessive labor costs of the information security service. In both cases, we have to talk about the irrational use of labor resources of the information security service.

For all users, the discrepancy between the current response measures and the required response measures is calculated as the root of the sum (for all users) of the squared differences between the current response level and the required response level for each user.

As control measures, it is recommended to change the operating mode of the information security system, increasing the speed of incident processing for users with a higher required level and reducing it for users with a lower required level of response. The criterion for the success of the control measures taken is the reduction of the discrepancy discussed in this paragraph.

Claims (2)

1. A method for tracking user actions to change hardware and software information security tools based on user behavior patterns, which includes the following actions: conduct a ranking assessment of the hardware resources of user workstations available for information security tools; at each workstation and individual network nodes, workload indicators are measured, indicators of sufficient workload and the amount of free hardware resources are determined; in this case, for each indicator an assessment is made on a ranking scale by comparing their values measured for all users using an empirical distribution function; monitor user behavior and behavior anomalies in real time; identify special contacts in user communications that require the attention of the information security service; For this purpose, communicators with predetermined values of communication properties are determined; For this purpose, they use the calculation of ranked statistics of messages sent between the user and other participants in communications; at the same time, indicators of the user’s behavior and the profile of his contacts are measured; for this purpose, actually observed communications between the user and all participants in communications are measured, taking into account the direction of messages, the number of recipients, the intensity and frequency of communications; the measured values are ordered on a rank scale by comparing the measured values for all users; depending on the current and collected values of behavior indicators measured on a rank scale and the composition of the contact profile, the user is assigned to one or another set of behavior patterns; then, for behavioral patterns characteristic of the user, the level of complexity of the system of rules of information security policies in the enterprise is established on a ranking scale by comparing the level values measured for all users; Then, for each user, the level of available hardware resources and the required level of complexity of the system of information security policy rules are compared, and then the hardware resources are redistributed in such a way as to minimize the difference between these levels. 2. The method according to claim 1, in which detection of behavioral patterns includes the following actions: determining criteria for detecting the most vulnerable user behavior patterns from a security point of view, consisting of combinations of logically related conditions for the presence of behavioral anomalies and predetermined values of behavior indicators; assign for each pattern a change in the complexity level of the system of conditions and rules for processing the flow of incidents for policies of information security tools using the system of conditions for processing the flow of incidents; assign for each pattern a change in the level of response of automated information security tools.