Network security internal risk management

Abstract

Some embodiments help manage network security internal risks. The authorized user impact strut value is based on an impact signal representing an actual or potential impact of the user in the computing environment. The authorized user access strut value is based on an access signal representing actual or potential access of the user to the resource. An impact risk value is calculated as a weighted combination of strut values. In response, embodiments automatically adjust network security characteristics, such as security risk scores, security group membership, threat detection mechanisms, or alarm thresholds. In some cases, the impact risk is also based on accumulation of potential exudation anomaly access signals. In some cases, the impact risk is based on one or more values representing user public visibility, user social network impact, brand damage risk, resource task criticality, access request response speed or success rate, or known cyber-security attacks.

Description

Background Art

[0001] Attacks on computing systems can take many different forms, including some that are difficult to predict and that may vary from situation to situation. Therefore, one of the guiding principles of cybersecurity is "defense in depth." In practice, defense in depth is often performed by forcing an attacker to encounter multiple different kinds of security mechanisms at multiple different locations around or within a computing system. No single security mechanism can detect every cyber attack, or end every detected cyber attack. But sometimes combining and layering a sufficient number and variety of defenses will stop an attacker, or at least limit the scope of the damage caused by the attack.

[0002] To achieve defense in depth, network security professionals consider the different kinds of attacks that can be made against a computing system. They select defenses based on criteria such as which attacks are most likely to occur, which attacks are most likely to succeed, which attacks would be most harmful if successful, which defenses are deployed, which defenses can be deployed, and the cost and process changes and training involved in deploying specific defenses. Some defenses may not be feasible or cost-effective for a computing system. However, improvements in network security are still possible and worth pursuing. Summary of the invention

[0003] Some embodiments described herein address technical challenges associated with efficiently and effectively protecting computing systems from insider threats.In some embodiments, the unauthorized activity impact risk represents an impact of unauthorized activities of authorized users or future unauthorized activities of authorized users, or both.

[0004] In this document, the "activity" of a user refers to the activity of a user device or the activity of a user account, or the activity of software on behalf of a user or the activity of hardware on behalf of a user. The activity is represented by digital data or machine operations or both in a computing system. The "activity" within the scope of any claim based on this disclosure excludes human actions themselves. Therefore, software or hardware activities "on behalf of a user" refer to software or hardware activities on behalf of a user device or on behalf of a user account or on behalf of another computer mechanism or computing artifact, and therefore do not bring human behavior itself into the scope of any embodiment or any claim. Similarly, the "influence" of a user refers to the result or other condition of the activity of a user device, a user account, software on behalf of a user, or hardware on behalf of a user in a computing system; the influence is represented by digital data or machine operations or both; the influence or any other pillar value or any pillar signal within the scope of any claim based on this disclosure excludes human actions themselves; therefore, calculating the impact risk of a user means calculating the impact risk of software or hardware activities on behalf of a user, which is affected by human behavior itself excluded from the scope of any embodiment or any claim. Similarly, "digital data" means data in a computing system, not, for example, data written on paper or data in a person's mind.

[0005] In some embodiments, the unauthorized activity includes accidental (unintentional) activity or malicious activity or both. In some embodiments, the impact risk is calculated based on at least an authorized user impact pillar value and an authorized user access pillar value. The authorized user impact pillar value represents the degree of influence of the authorized user within the managed computing system or within the organization utilizing the managed computing system or both.

[0006] The authorized user access pillar value represents the degree of authorized access of the authorized user to the managed computing system resources. In some embodiments, exfiltration is tracked as a type of access. The network security characteristics of the managed computing system are adjusted based on at least the impact risk.

[0007] Other technical activities and features related to the teachings herein will also become apparent to those skilled in the art. The examples given are illustrative only. This disclosure is not intended to identify the key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. On the contrary, this disclosure is provided to introduce in a simplified form some technical concepts further described below in the specific embodiments. This innovation is defined by the claims that are properly understood, and if there is a conflict between this disclosure and the claims, the claims shall prevail. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] A more detailed description will be given with reference to the accompanying drawings. These drawings illustrate selected aspects only and are therefore not intended to be exhaustive in coverage or scope.

[0009] Figure 1 is a diagram showing aspects of a computer system and also showing configured storage media;

[0010] Figure 2 is a diagram illustrating aspects of a computing environment having one or more internal risk management enhancements taught herein;

[0011] Figure 3 is a block diagram illustrating an enhanced system configured with internal risk management functionality;

[0012] Figure 4 is a block diagram illustrating some aspects of internal risk management;

[0013] Figure 5 is a flowchart showing the steps in some internal risk management methods, with particular attention to the presentation of the various steps performed in different combinations and incorporating Figures 6 to 11 ;

[0014] Figure 6 is a flow chart illustrating steps in some internal risk management methods, with a particular focus on adjusting network security characteristics in response to calculated shock risk values;

[0015] Figure 7 is a flow chart illustrating steps in some internal risk management methods, with particular attention to adjusting shock risk calculations based on data signal availability (based on the physical presence of certain data or customer preferences for or against certain data, or both), data signal strength, data signal reliability, or a combination thereof;

[0016] Figure 8 is a flow chart illustrating steps in some internal risk management methods, with particular focus on providing a human-readable interpretation of a potential high impact user designation or providing a human-readable interpretation of a risk score based on or otherwise related to a calculated impact risk value;

[0017] Fig. 9 is a flow chart showing steps in a risk impact calculation, wherein access signals are obtained and added or weighted and added to calculate an access pillar value, impact signals are obtained and added or weighted and added to calculate an impact pillar value, and the two pillar values ​​are added or weighted and added to calculate a risk impact;

[0018] Fig.10 is a flow chart that also illustrates some of the steps in the internal risk management method;

[0019] Fig.11 is a flow chart also illustrating steps in some internal risk management methods; and

[0020] Fig.12 is a block diagram illustrating some additional aspects of internal risk management. DETAILED DESCRIPTION Overview

[0021] Innovations can extend beyond their origins, but understanding the origins of an innovation can help people understand it more fully. In the present context, some of the teachings described in this article are inspired by the technical challenges that Microsoft innovators are working to help administrators and security personnel control and maintain sensitive data.

[0022] Microsoft Innovators point to a feature that applies to many, if not all, organizations, including businesses, educational institutions, government agencies, and other organizations that utilize computing technology. Within a given organization, there are users with roles that provide them with more authorized access to highly sensitive information or more powerful privileges than regular users. Therefore, if these users accidentally or intentionally abuse or misuse their privileges, they can cause significant damage to the organization.

[0023] Some examples of these types of roles include: members of highly confidential projects (e.g., leasing projects), users with access to highly regulated pre-release financial information, highly privileged administrators who can access account secrets, can create or remove users, etc., and users who regularly access sensitive information (e.g., HR specialists with access to compensation data, government IDs, and other personally identifiable information (PII)). These are just a few examples among many.

[0024] Innovators have explored the possibility of managing insider risk. In a given situation, "managing" insider risk includes one or more of the following: identifying possible sources of security risk within the organization, identifying possible sequences of events and other aspects of risk scenarios involving such sources, assessing the potential impact of accidental or intentional damage in such scenarios, and developing tools and techniques for identifying, assessing, simulating, reducing, preventing, mitigating, investigating, or documenting such scenarios.

[0025] The innovators arrived at a view where insider risk is a combination of insiders (user roles, preconditions), insider motivations and other actor motivations (stressors), digital assets and their characteristics (e.g., sensitivity), and activities (e.g., data exfiltration, system takeover). The innovators determined that the scoring model would reflect these factors and patterns. The PHIU (Potential High Impact User) scoring model focuses on insiders (e.g., user roles) and is intended to identify users who are more capable than others of causing substantial harm to their organization because of their access to sensitive information, their impact on their organization, their privileges, their administrative access, or other factors.

[0026] Under an alternative approach, customers of the cloud service provider may, for example, manually define priority user groups and scope these groups to policy templates that focus on priority users. However, manual definition of priority user groups is cumbersome, cannot be maintained when users change job responsibilities or employers, and is prone to errors. For example, due to their very nature, rental projects (also known as "disclosure projects" or "skunk works" or "off the book" projects) are sometimes closely held secrets within an organization, so an administrator responsible for manually defining priority user groups does not necessarily know who is part of the rental project and what sensitive information the rental project involves.

[0027] Thus, some embodiments taught herein provide an automated method for identifying users in high-risk roles who may cause more harm to an organization due to the nature of their roles and access. More generally, some embodiments drive the detection and prioritization of the highest risk activities in an organization by enhancing the context around users, help manage noise by presenting alerts that are more likely to be risky or worrisome because they are performed by users who may have a more destructive impact on the organization, and establish contextually rich information about users for activities detected in the IRM. Some embodiments rank users with high impact potential (e.g., high position, high access privileges, high activity on sensitive information types (SITs)). Some embodiments increase the risk score weighting of higher ranked users, or automatically add higher ranked users to a priority user group, or both. Some embodiments increase the monitoring or triggering (or both) of (multiple) internal risk alerts based on (multiple) actions of higher ranked (multiple) users with higher potential impact.

[0028] These and other benefits will be apparent to those skilled in the art based on the teachings provided herein. Operating Environment

[0029] refer to Figure 1 , the operating environment 100 of the embodiment includes at least one computer system 102. Computer system 102 may or may not be a multiprocessor computer system. The operating environment may include one or more machines in a given computer system, which may be clustered, client-server networked, and / or peer-to-peer networked within cloud 136. Standalone machines are computer systems, and networks or other groups of cooperating machines are also computer systems. A given computer system 102 may be configured for end users, (e.g., using applications), for administrators, as a server, as a distributed processing node, and / or in other ways.

[0030] Human users 104 sometimes interact with computer system 102 user interface 124 via typed text, touch, voice, movement, computer vision, gestures, and / or other forms of I / O using display 126, keyboard 106, and other peripherals 106. In some embodiments, virtual reality or augmented reality or both are provided by system 102. Screen 126 is a removable peripheral 106 in some embodiments, and is an integrated part of system 102 in some embodiments. User interface 124 supports interaction between embodiments and one or more human users. In some embodiments, user interface 124 includes one or more of the following: a command line interface, a graphical user interface (GUI), a natural user interface (NUI), a voice command interface, or other user interface (UI) presentations presented or integrated as different options.

[0031] System administrators, network administrators, cloud administrators, security analysts and other security personnel, operators, developers, testers, engineers, auditors, and end users are each a specific type of human user 104. In some embodiments, automated agents, scripts, playback software, devices, etc. that run or otherwise serve on behalf of one or more people also have user accounts, such as service accounts. Sometimes, user accounts are created or otherwise provided as human user accounts, but in practice are used primarily or only by one or more services; such accounts are actual service accounts. Although a distinction can be made, "service accounts" and "machine-driven accounts" are used interchangeably herein without limitation to any particular vendor.

[0032] In some embodiments, storage devices or networking devices or both are considered peripheral devices, and in other embodiments, are considered part of system 102, depending on their removability from processor 110. In some embodiments, Figure 1 Other computer systems not shown interact with computer system 102 or with another system embodiment in a technical manner, for example, using one or more connections to cloud 136 and / or other networks 108 via a network interface device.

[0033] Each computer system 102 includes at least one processor 110. Similar to other suitable systems, the computer system 102 also includes one or more computer-readable storage media 112, also referred to as computer-readable storage devices 112. In some embodiments, the tool 122 includes a software application on the mobile device 102 or workstation 102 or server 102, as well as an API, a browser or web page, and corresponding software for a protocol such as HTTPS.

[0034] Storage media 112 appear in different physical types. Some examples of storage media 112 are volatile memory, non-volatile memory, fixed-position media, removable media, magnetic media, optical media, solid-state media, and other types of physical persistent storage media (as opposed to signals that propagate only or energy only). In particular, in some embodiments, a configured storage medium 114 such as a portable (i.e., external) hard drive, CD, DVD, memory stick, or other removable non-volatile storage medium becomes functionally a technical part of the computer system when inserted or otherwise installed, making its content available for interaction with the processor 110 and used by the processor 110. Removable configured storage media 114 is an example of a computer-readable storage medium 112. Some other examples of computer-readable storage media 112 include built-in RAM, ROM, hard disks, and other memory storage devices that are not easily removed by the user 104. In order to comply with current U.S. patent requirements, in any claim pending or granted in the United States, the computer-readable medium or computer-readable storage medium or computer-readable memory is not a signal itself or just energy.

[0035] The storage device 114 is configured with binary instructions 116 that are executable by the processor 110; "executable" is used in a broad sense herein to include, for example, machine code, interpretable code, bytecode, and / or code running on a virtual machine. The storage medium 114 is also configured with data 118 that is created, modified, referenced, and / or otherwise used for technical effect by executing the instructions 116. The instructions 116 and data 118 configure the memory or other storage medium 114 in which they reside; when the memory or other computer-readable storage medium is a functional part of a given computer system, the instructions 116 and data 118 also configure the computer system. In some embodiments, a portion of the data 118 represents real-world items, such as events, product characteristics, inventory, physical measurements, settings, images, readings, volumes, etc., represented in the system 102 hardware. Such data is also transformed through backup, recovery, submission, abort, reformatting, and / or other technical operations.

[0036] Although the embodiments are described as being implemented as software instructions executed by one or more processors in a computing device (e.g., a general-purpose computer, a server, or a cluster), such description is not meant to exhaust all possible embodiments. It will be understood by those skilled in the art that the same or similar functions may also be generally implemented in whole or in part directly in hardware logic to provide the same or similar technical effects. Alternatively, or in addition to software implementations, the technical functions described herein may be at least partially performed by one or more hardware logic components. For example, and without excluding other implementations, some embodiments include one or more of the following: hardware logic components 110, 128, such as field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip components (SOCs), complex programmable logic devices (CPLDs), and similar components. In some embodiments, for example, components are grouped into interactive functional modules based on the input, output, or technical effects of the components.

[0037] In addition to processor 110 (e.g., CPU, ALU, FPU, TPU, GPU and / or quantum processor), memory / storage medium 112, peripheral device 106 and display 126, some operating environments also include other hardware 128, such as batteries, buses, power supplies, wired and wireless network interface cards. The terms "screen" and "display" are used interchangeably herein. In some embodiments, display 126 includes one or more touch screens, a screen that responds to input from a pen or tablet computer, or a screen that operates only for output. In some embodiments, there are peripheral devices 106 (such as human user I / O devices (screens, keyboards, mice, tablet computers, microphones, speakers, motion sensors, etc.)) that are operably communicated with one or more processors 110 and memory 112.

[0038] In some embodiments, the system includes multiple computers connected by a wired and / or wireless network 108. The networking interface device 128 can provide access to the network 108 using, for example, network components such as packet switching network interface cards, wireless transceivers, or telephone network interfaces that are present in some computer systems. In some embodiments, virtualization of network interface devices and other network components (such as switches or routers or firewalls) also exists in, for example, software-defined networks or sandboxes or other secure cloud computing environments. In some embodiments, one or more computers are partially or completely "air-isolated" because they are disconnected or only intermittently connected to another networked device or remote cloud. In particular, the internal risk management function 210 can be installed on an air-isolated network and then updated periodically or occasionally using removable media 114, or not updated at all. Some embodiments also transmit technical data or technical instructions or both through direct memory access, removable or non-removable volatile or non-volatile storage media, or other information storage retrieval and / or transmission methods.

[0039] Those skilled in the art will appreciate that the foregoing and other aspects presented herein in the context of an "operating environment" form part of some embodiments. The headings of this document are not intended to provide a strict classification of features into embodiment and non-embodiment feature sets.

[0040] One or more items are shown in outline form in the figures, or listed in brackets, to emphasize that they are not necessarily part of the operating environment or all embodiments shown, but are interoperable with the operating environment or items in some embodiments as discussed herein. This does not mean that any item that is not in outline or bracket form is necessarily required in any figure or any embodiment. In particular, Figure 1 is provided for convenience; Figure 1 The inclusion of an item does not imply that the item or described use of the item was known prior to the current innovation.

[0041] In any subsequent application claiming priority to the present application, reference numerals may be added to designate items disclosed in the present application. Such items may include, for example, software, hardware, procedures, methods, systems, functions, mechanisms, data structures, resources, or other items in a computing environment that are disclosed herein but are not associated with specific reference numerals herein. Corresponding drawings may also be added, for example, according to the present application. Figure 4 or Figure 5 Attached diagram of the lines. More about the system

[0042] Figure 2A computing system 102 is shown configured by one or more internal risk management enhancements taught herein, resulting in an enhanced system 202. In some embodiments, the enhanced system 202 includes a single machine, a local network of machines, machines in a particular building, machines used by a particular entity, machines in a particular data center, machines in a particular cloud, or another computing environment 100 suitably enhanced. Figure 2 Items of are discussed at various points herein, and additional details regarding them are provided in the discussion of the list of reference numbers later in this disclosure document.

[0043] Figure 3 An example enhanced system 202 is shown configured with internal risk management software 302 to provide functionality 210. Software 302 and other Figure 3 Items are discussed at various points herein, and additional details regarding them are provided in the discussion of the list of reference numbers later in this disclosure document.

[0044] Figure 4 Some aspects of internal risk management are shown. This is not a comprehensive overview of all aspects of internal risk management 208 or all aspects of internal risk management functionality 210. Nor is it a comprehensive overview of all aspects of environment 100 or system 202 or other contexts for internal risk management, or all internal risk management mechanisms that may be used in or with system 102. Figure 4 Items of are discussed at various points herein, and additional details regarding them are provided in the discussion of the list of reference numbers later in this disclosure document.

[0045] In some embodiments, enhancement system 202 is networked via interface 330. In some embodiments, interface 330 includes hardware such as a network interface card, software such as a network stack, API or sockets, a combination thereof such as a network connection, or a combination thereof.

[0046] In some embodiments, enhancement system 202 includes a managed computing system 202 (also referred to as a management computing system or management system) that is configured to manage internal risks to help protect managed systems 216. In some cases, management computing system 202 and managed systems 216 are separate in terms of the machines 101 they each include, while in other cases they overlap, with one system being completely contained within the other, or they extend together.

[0047] The following additional example embodiments are provided to help illustrate the relationship between the managing computing system 202, the managed computing system 216, and other aspects of some embodiments. This is a set of illustrative examples, not a comprehensive listing or summary of all embodiments.

[0048] Configuration Example 1 In these embodiments, the managing system 202 and the managed system 216 are co-extensive with respect to the machines 101 and with a local network 108 that uses private IP addresses and includes multiple machines 101. Furthermore, in these embodiments, the pillar values ​​310 used to calculate the impact risk 214 are not based on any event data representing any activity 410 or 412 occurring in any system 102 external to the systems 202 and 216.

[0049] Configuration Example 2 In these embodiments, the managing system 202 and the managed system 216 are co-extensive with respect to the machines 101 and with a local network 108 that uses private IP addresses and includes multiple machines 101. In these embodiments, at least one pillar value 310 used to calculate the impact risk 214 is based at least in part on event data representing activity 410 or 412 or both occurring in the system 102 that is external to the systems 202 and 216; the activity data is then imported into the managing system 202 and used in the impact risk 214 calculation 502. As a specific example, in some of these embodiments, the impact pillars 318, 310 are based 502 on data representing activity on a social network that is external to the systems 202 and 216.

[0050] Configuration Example 3 In these embodiments, the management system 202 includes at least one machine A 101 that is not part of the managed system 216. Machine A performs risk management 208 operations that are not performed within the managed system 216, or has functionality 210 that is not present within the managed system 216, or both. As a specific example, in some of these embodiments, machine A performs impact risk 214 calculations 502, and within the managed system 216, the impact risk 214 value is write-once (upon import from machine A) and thereafter is read-only unless and until the impact risk 214 value is recalculated by machine A.

[0051] The enhancement system 202 includes a digital memory 112 and at least one processor 110 in operable communication with the memory. In a given embodiment, the digital memory 112 is volatile or non-volatile or a hybrid. The at least one processor is configured to collectively perform internal risk management.

[0052] In some embodiments, an internal risk management computing system 202 is configured to manage internal risk for a managed computing system 216 including a resource 132, the internal risk management computing system comprising: a digital memory 112, at least a portion of which is external to the managed computing system; a processor 110 in operable communication with the digital memory, the processor configured to perform internal risk management operations, including automatically: calculating 502 an impact risk 214 of an authorized user 104 of the managed computing system, and adjusting 504 a network security feature 304 of the managed computing system based at least on the impact risk. In a variation, the digital memory is not external to the managed computing system. In some embodiments, the impact risk comprises a digital value representing an impact 212 of an unauthorized activity 410 of an authorized user, or future unauthorized activity 410 of an authorized user, or both.

[0053] In some embodiments, impact risk is calculated 502 based on at least the authorized user impact pillar values ​​318, 310 and the authorized user access pillar values ​​308, 310. In some embodiments, the authorized user impact pillar values ​​318 (also referred to as the impact pillar) represent the degree of influence 316 of the authorized user within the managed computing system 216 or within the organization 424 utilizing the managed computing system, or both. In some embodiments, the authorized user access pillar values ​​308 (also referred to as the impact pillar) represent the degree of authorized access 306 of the authorized user to the managed computing system resources. Depending on the embodiment, the access 306 is actual access (authorized or unauthorized), or potential but currently authorized access, or both.

[0054] Some embodiments include an internal risk management computing system 202 in combination with a managed computing system 216. Other embodiments include an internal risk management computing system 202 but not a managed computing system 216. In some embodiments, the internal risk management computing system 202 and the managed computing system 216 are co-extensive, e.g., an enhanced system that uses functionality 210 to manage its own internal risk.

[0055] In some embodiments that include an internal risk management computing system 202 combined with a managed computing system 216 (e.g., by including one system within another or through co-extensibility), the managed computing system 216 includes security controls 420 and security groups 322, and the security controls are applied differently to users who are members of the security groups and users who are not members of the security groups. In some of these embodiments, adjusting 504 includes at least one of: changing 506 user membership of the security group based at least on the impact risk, or modifying 508 application of the security control to at least one user based at least on the impact risk.

[0056] Other system embodiments are also described herein, which may be derived directly or as system versions of the described processes or configured media and are appropriately informed by the extensive discussion of computing hardware herein.

[0057] Although specific internal risk management architecture examples are shown in the figures, embodiments may depart from those examples. For example, in embodiments, items shown in different figures may be included together, items shown in the figures may be omitted, functions shown in different items may be combined into fewer items or a single item, items may be renamed, or items may be connected to each other differently.

[0058] Examples are provided in this disclosure to help illustrate various aspects of the present technology, but the examples given within this document do not describe all possible embodiments. A given embodiment may include additional or different kinds of internal risk management functions, for example, as well as different technical features, aspects, security controls, mechanisms, rules, standards, expressions, hierarchies, sequences of operations, data structures, environments or system characteristics, or other internal risk management functions 210 teachings described herein, and may vary from the specific illustrative examples provided. Process (also called method)

[0059] The method (also referred to as a "process" in the legal sense of the word) is presented in various ways herein, both in the text and in the drawings. Figure 5 A series of methods 500 are shown that are performed or aided by some enhancement system, such as some system 202 or another functional 210 enhancement system as taught herein. Figures 1 to 4 An internal risk management architecture with implicit or explicit actions is shown, for example, steps for acquiring, calculating, comparing, combining, and otherwise processing data 118, where data 118 includes, for example, support pillars 310, support pillar signals 314, scores 426, alerts 428, insights 432, events 410 or 412, thresholds 430, detection results 408 or 414, or explanations 326, as well as other examples disclosed herein.

[0060] Unless otherwise indicated, the technical processes shown in the figures or otherwise disclosed are automatically performed by, for example, the augmented system 202. The relevant processes may also be performed partially automatically and partially manually, in the sense that human actions are involved, for example, in some embodiments, the person 104 types a value for the system 202 to use as a text string when displaying 516 interpretation 326. However, no process contemplated as innovative herein is entirely manual or purely mental; none of the claimed processes can be performed solely in a human mind or on paper. Any claim interpretation to the contrary is directly inconsistent with this disclosure.

[0061] In a given embodiment, zero or more of the illustrated steps of a process may be repeated, and the process may be operated using different parameters or data. Figure 5 , Fig.10 and Fig.11 The order of the layout from top to bottom is different. Figures 5 to 11 The text examples of the embodiments provided herein and the text descriptions of the embodiments provided herein are supplementary. Figure 5 , Fig.10 or Fig.11 In the event of any alleged inconsistency, lack of clarity, or excessive breadth resulting from any aspect or interpretation of the present disclosure, the text of the present disclosure shall prevail. Figure 5 , Fig.10 or Fig.11 that aspect or interpretation of a method or data flow diagram. Arrows in a method or data flow diagram indicate permissible flows; arrows pointing in more than one direction therefore indicate that flow can proceed in more than one direction. Steps may be performed serially, in a partially overlapping manner, or completely in parallel within a given flow. In particular, the order in which the action items of flowchart 500, 1000, or 1100 are traversed to indicate the steps performed during a process may vary from one execution of the process to another execution of the process. The flowchart traversal order may also vary from one process embodiment to another. Steps may also be omitted, combined, renamed, regrouped, performed on one or more machines, or otherwise differ from the process shown, so long as the process performed is operable and complies with at least one claim of an application or patent that includes the present disclosure or claims priority thereto. If a skilled person considers that the process is consistent with the present disclosure, the skilled person may provide a method or data flow diagram with a method or data flow diagram that is consistent with the present disclosure. Figure 5 , Fig.10 or Fig.11 To the extent that a given sequence of steps S is not operable consistent with any of the diagrams in the claims, then that sequence S is not within the scope of any claim. Any assertion to the contrary is contrary to the present disclosure.

[0062] Some embodiments provide or utilize a method for internal risk management of network security, the method being performed (executed) by a computing system for an authorized user, the method comprising: automatically calculating 510 an impact pillar value 318 based on at least one impact signal 320, the impact pillar value representing a degree of influence 316 of the authorized user; automatically calculating 510 an access pillar value 308 based on at least one access signal 312, the access pillar value representing an access authorization 130 or 134 (in this example, access 306 means accessible or actual access or both) of an authorized user who is authorized to access 306 a computing system resource 132; automatically calculating 502 an impact risk 214 based at least on the pillar value 310; and automatically adjusting 504 a network security feature 304 based at least on the impact risk.

[0063] In some embodiments, the influence signal 320 represents at least one of: the authorized user's position 1218 within the organization's hierarchy; the authorized user's title or role 1218 within the organization; a count of people within the organization who report to the authorized user; or the authorized user's administrative role 1218 within the computing environment.

[0064] In some embodiments, access signal 312 represents at least one of: a count of computing system resources accessed by an authorized user; a count of computing system resources to which an authorized user is authorized to access; a count of computing system resources of a specified sensitivity that have been accessed by an authorized user; or a count of computing system resources of a specified sensitivity to which an authorized user is authorized to access.

[0065] In some embodiments, the method is further characterized by at least one of the following: automatically calculating the impact pillar value includes: calculating a weighted combination in which at least two impact signals have different weights; automatically calculating the access pillar value includes: calculating a weighted combination in which at least two access signals have different weights; or automatically calculating the impact risk includes: calculating a weighted combination in which the pillar values ​​have different weights.

[0066] In some embodiments, impact risk is also automatically calculated based on additional pillar values ​​310, which represent at least one of the following: public visibility of the authorized user 1202; a measurement of the authorized user's influence on social networks 1204; the risk of damaging the organization's brand 1206; the mission criticality of computing system resources accessible to the authorized user 1208; the authorized user's membership in the computing system security group 322; network security attacks on the authorized user 1216; the authorized user's exfiltration activities 406; the success rate 1214 for the authorized user to receive access to the computing system resources; or the access request response rate 1212 for the authorized user's request 1210 to access the computing system resources 132.

[0067] In some variations, the access pillar 308 or the impact pillar 318 is omitted from the calculation of the impact risk. In some of these variations, the impact risk is calculated based on at least one or more of the different pillars 310 listed above, i.e., public visibility 1202; social network influence 1204; brand damage risk 1206; mission criticality 1208; security group 322 membership; network security attack history 1216; exfiltration activity 406; access request success rate 1214; or access request response speed 1212.

[0068] In some embodiments, the method includes automatically displaying a human-readable explanation of the calculation basis utilized in calculating 502 the impact risk, such as by displaying one or more of the support pillars 310 text descriptions, pillar values, signal 314 text descriptions, or signal values.

[0069] In some embodiments, the method includes automatically adjusting 504 network security features based at least on impact risk by doing at least one of: automatically increasing 536, 508 a risk score 426 in a network security tool 122 with an alert function; automatically disabling 528, automatically suspending 528, or automatically deleting 528 an account 532 in a computing environment; automatically changing 506 membership of an authorized user in a computing system security group 322; automatically turning on 508, 530 a specific security threat detection mechanism 534; automatically turning off 508, 530 a specific security threat detection mechanism 534; automatically changing 508, 538 a specific security alert threshold 430; or training 524 a machine learning model 526 using training data 118, wherein at least a quarter of the training data includes impact signals 320, access signals 312, pillar values ​​310, or impact risks 214, as measured by data size or training data example count, or both.

[0070] In some embodiments, automatically calculating 502 risk of impact 214 is also based on at least cumulative potential exfiltration anomaly 520 access signal 312 that indicates detection 518 of an abnormal cumulative potential exfiltration 406 of data by an authorized user.

[0071] In some embodiments, the method includes detecting 518 an abnormal cumulative potential exfiltration 406 of data by an authorized user at least in part by comparing 522 the potential exfiltration activity of the authorized user with a first activity of a first peer group 404 of the authorized user and comparing 522 with a second activity of a second peer group 404 of the authorized user.

[0072] In some embodiments, the method includes: calculating 512 a weighted combination by: calculating an average risk score for each algorithm (signal or support or both) for a tenant or organization or other entity, for each user's score, finding the distance from the average, normalizing the distance from the average, for each risk score for the user, assigning a weight, calculating a weighted risk score, calculating an average of the weighted risk scores defined as the RawScore for internal debugging, and normalizing the weighted risk score and returning it as a user risk score, e.g., a PHIU score 426 or an HPU score 426 (these are the same herein; different terms are used internally at different points in the innovative development process). In a variant, calculating the average of the weighted risk scores defined as the RawScore for internal debugging is omitted. In a variant, normalizing the distance from the average is performed using a min-max normalizer.

[0073] In some embodiments, the method includes applying 1002 role-based access controls 420 to requests to view impact risks. For example, in some accesses to the PHIU, the data (scores or underlying data 310 and 314 or both) is controlled by fine-grained RBAC so that analysts and incident investigators can only view users, alerts, and cases for users that they are authorized to view.

[0074] In some embodiments, the method includes marking 1004 the authorized user with a potential high impact user designation 408 based on the impact risk 214 exceeding a specified threshold 430, and maintaining 1016 the designation after the impact risk falls below the specified threshold. In some embodiments, the designation of a user as a PHIU is irreversible within a time frame defined by the policy. For example, if a user is detected as a PHIU on the first day, and is no longer a PHIU on the third day, the designation is not removed. The reason is that the user has the influence or access, or both, to cause increased harm in the time corresponding to the designated vicinity of the activity. Configured storage media

[0075] Some embodiments include a configured computer-readable storage medium 112. Some examples of storage medium 112 include disks (magnetic, optical, or other), RAM, EEPROM or other ROM, and other configurable memory, particularly including computer-readable storage media (which is not merely propagating signals). In some embodiments, the configured storage medium is particularly a removable storage medium 114, such as a CD, DVD, or flash memory. Whether the general purpose memory is removable and whether it is volatile depends on the embodiment, which can be configured in an embodiment using items such as internal risk management software 302, impact risk 214, support pillars 310, support pillar signals 314, security groups 322, weighted combinations of support pillars or signals or both 324, interpretations 326, detectors 534, designations 408, alerts 428, insights 432, thresholds 430, roles 134, and privileges 130, in the form of data 118 and instructions 116, read from the removable storage medium 114 and / or another source such as a network connection to form a configured storage medium. As disclosed herein, the configured storage medium 112 enables the computer system 202 to perform the technical process steps for internal risk management. Therefore, the figures help illustrate the configured storage medium embodiments and process (also called method) embodiments and system and process embodiments. In particular, Figure 5 Any process steps shown in or otherwise taught herein may be used to help configure a storage medium to form a configured storage medium embodiment.

[0076] Some embodiments use or provide computer-readable storage devices 112, 114 configured with data 118 and instructions 116 that, when executed by a processor 110, cause a computing system to perform a method of internal risk management in a cloud computing environment 136, 100, or another computing environment 100. The method includes any one or more of the steps disclosed herein, performed in any order. Additional Observations

[0077] Additional support for the discussion of internal risk management functionality 210 herein is provided under various headings. However, all of them are intended to be understood as integral and integral to the discussion of the conceptual embodiments of the present disclosure.

[0078] The skilled artisan will recognize that not every part of the present disclosure or any specific detail therein is required to satisfy legal standards, such as enabling, written description, or best mode. Any apparent conflict with any other patent disclosure, even if that patent is from the owner of the present innovation, has no effect in interpreting the claims set forth in this patent disclosure. With this understanding, examples and observations are provided herein with respect to all parts of the present disclosure. High potential users, also known as potential high impact users

[0079] Consider an organization 424 with many employees. Every day is a risk day, not only from external cyber threats, but sometimes from within. An important question is how to proactively identify the damage that users may cause when participating in an attack 212. This identification of high potential users with adverse effects gives the organization lead time to deal with such high potential users (HPUs) 402.

[0080] In some embodiments, each user is assigned a ranking 214 based on how much potential damage the user could cause to the organization if they were to participate in an attack (actively or passively or both). This impact ranking does not measure the likelihood of a user attack, but rather quantifies an estimate of how much damage 212 an attack involving the user (i.e., an attack conducted by the user or with the authorization 130 or 134 granted to the user) could cause.

[0081] In some embodiments, the algorithm that calculates 502 the impact ranking or calculates the underlying impact risk score 426 provides flexibility to the end user by allowing the end user (e.g., security personnel) to receive an explainable HPU score 426 for each user in the organization 424 (e.g., each cloud tenant). In some embodiments, the algorithm is adjustable 542 because it provides flexibility by allowing the end user to adjust 542 the weights 332 of the signals that contribute to the pillar values, or adjust 542 the weights 332 of the pillar values, or both. Regarding explainability, some embodiments provide a direct usable score 426, and some embodiments provide an explanation 326 as to why user x has a higher HPU score than user y; some embodiments provide both. In some embodiments, the algorithm is flexible because new signals 314 or pillars 310 can be easily added 1018. In some embodiments, the algorithm is flexible because it is easy to adjust 542 the weights of the signals or pillars or both.

[0082] Some embodiments utilize HPU scores by increasing 508 the risk value of users with high HPU scores. As a result, internal risk management (IRM) analysts and investigators can prioritize their review and response activities. For example, in some embodiments, this risk value increase is achieved through dynamic 538 thresholds or score boosters 422. If the user is an HPU, some embodiments add 536, 508 boosters 422 to any policy scores, for example, applying boosters to alert 428 scores by adding on top of the highest scoring insights 432 to calculate an overall risk score for alerts and alert severity. If the user is an HPU, some embodiments reduce 538, 508 one or more alert thresholds 430 for an activity.

[0083] In some embodiments, the algorithm calculates 502 the HPU score as a sum or other combination 324 of the weighted pillar values ​​310 (e.g., the weighted access pillar value 308 and the weighted influence pillar value 318). In some embodiments, one or more of the weighted pillar values ​​are themselves calculated 510 as a sum or other combination 324 of the weighted signal values ​​314. For example, in some embodiments, the access pillar value 308 is calculated 510 as a combination of the weighted access signal values ​​312, the influence pillar value 318 is calculated 510 as a combination of the weighted influence signal values ​​320, and so on for any other pillar values ​​310.

[0084] In one particular example, the access pillar value is weighted at 40% and the impact pillar value is weighted at 60% in determining the combination of risk impact 214. Other embodiments or configurations use different weighting values.

[0085] In some embodiments, the access pillar value 308 represents and quantifies how much data access 306 a particular user or a particular set of users has to sensitive information in the organization 424 or a specified computing environment 100 or both.

[0086] In some embodiments, the influence pillar value 318 represents and quantifies how much influence 316 (also referred to as power) a particular user or a particular set of users has in the organization 424 or a given computing environment 100 or both.

[0087] In some embodiments, influence 316 is not necessarily a direct influence in the computing system. For example, a chief executive officer (CEO) may choose not to have a computing system management role 134, but still have a great influence in the CEO's organization. In some embodiments, influence 316 includes influence directly within computing system 216, such as an management role 134 or greater privileges 130 than other users of system 216. Various embodiments measure one or both influences for PHIU detection.

[0088] In some embodiments, impact signal 320 includes a blast radius signal, such as a signal queried from Kusto, such as { Data Explorer(usmpe->BlastRadius)}Query:BlastRadius where TenantId== <value>tenant join kind=leftouter UserAlias ​​on UserId (a mark of Microsoft Corporation). In some embodiments, the influence signal 320 includes a numeric field "Level from top" that provides hierarchical information. In some embodiments, the influence signal 320 includes a numeric field "Report Count" 1220 that represents the cumulative number of reporters under the employee. In some embodiments, the influence signal 320 includes a Boolean value whose value specifies whether the user is an administrator. In some embodiments, the influence signal 320 includes an administrator role ID set that indicates the user's administrator role(s) 134 (if any).

[0089] In some embodiments, the access signal 312 includes inferred file access 306 from the rich audit log(s), the sensitivity label identification(s) 416, or both. In some embodiments, the access signal 312 includes a total number of files accessed, e.g., a count of unique files accessed based on a file ID such as an ObjectID. In some embodiments, the access signal 312 includes category data based on a count of categories 418 of sensitive data accessed.

[0090] In some embodiments, access signal 312 includes not only resources 132 actually accessed, but also accessible resources that have not yet been accessed (at least according to access logs or similar records of actual accesses that are examined, if any). Otherwise, actor A who has access to 10,000 files but has touched 10 files would be considered less risky than another actor B who has access to 100 and has touched 99 files, which is not an optimal assessment; in this example, it is better to consider A to be more dangerous than B in terms of impact 212.

[0091] In some embodiments, the PHIU identification 408 is an enrichment of insider risk activities and is not meant to identify the users themselves as risks in a compromising manner. The identification of users as PHIUs does not in itself mean that those users are insider risks themselves. It means that the use of their privileges (whether accidental or malicious or both) has a greater potential for damage 212. It does not mean that damage will occur. In terms of the risk caused by the users themselves, PHIUs with very high risk scores 214, despite the opportunity and motivation to abuse their privileges or make destructive mistakes, have a long history of trustworthiness and reliability and are reasonably considered to be less risky than non-PHIUs whose loyalty and capabilities are low or unknown.

[0092] Some embodiments include a machine learning model 526 or a statistical model or both. In some embodiments, the machine learning model features or the statistical model features or both include a count of unique files accessed by a user, a count of unique file sensitivities labeled 416 or 418 as "general," and a count of unique file sensitivities labeled 416 or 418 as "confidential." In some embodiments, the sensitivity labels are inferred and subject to a confidence threshold, such as 0.85. In some embodiments, the file counts are divided into buckets, such as a bucket representing the number of confidential files a user has in a bucket representing a file count of zero, or in a bucket representing a file count of 1 to 3, or in a bucket representing a file count of 4 to 6, and so on. These count delimiters (0, 1 to 3, 4 to 6, etc.) are examples only; in other cases, buckets are defined with different count delimiters.

[0093] Some embodiments are based on one or more of the following assumptions: users with greater access to sensitive data than others may be targeted or able to exfiltrate sensitive data; users with administrative privileges can cause more damage than other users; and although users with hierarchical powers do not necessarily have direct access to sensitive files, they can cause lateral damage by using the powers of those who report to them.

[0094] With respect to feature engineering, in some embodiments, signals 314 are processed individually and a statistical p-value is calculated for each signal. In some embodiments, the HPU score is a composite linear function of the influence and data access that a user has. In some embodiments, access is simply actual access, while in other embodiments, access represents accessible resources, including resources 132 that have not necessarily been actually accessed so far. In some embodiments, the scoring algorithm provides the importance of certain signals over other signals by adjusting weights. Some embodiments utilize Fisher scores, but this method sometimes produces a multi-node distribution without any direct lookup to obtain the final p-value. Some embodiments utilize the Stouffer method to convert individual p-values ​​into z-scores so that two or more normally distributed data can be combined to obtain the final p-value. In some embodiments, percentages are reported 516 as a basis for explaining to the end user why the algorithm scored user X higher than user Y.

[0095] Some embodiments assign weights within each leg based on a measure of signal reliability. In some embodiments, the assignment 542 of weights 332 is performed as follows. For each leg, a base weight is obtained 1020 for each signal. Each signal is classified 1022 as a variable weight signal or a fixed weight signal. For each variable weight signal, the strength of the signal is obtained 1024, a new weight for the signal is set 1026, for example, based on finding a decay in the signal weight using a ratio, and if the new value is smaller, any residual value is stored 1028. Finally, any residual values ​​are distributed 542 equally between the fixed weight signals (multiple).

[0096] Some embodiments allocate 542 weights between pillars based on pillar reliability. In some embodiments, the allocation of weights is performed as follows. For each pillar, the reliability strength of the pillar is calculated 1030 as the sum of the pillar signals (signal strength x signal base weight) ("x" here represents multiplication), the new weight of the pillar is calculated 1032 as its base weight at the pillar at x strength, and any residual value is stored 1028 if the new value is smaller. The final weight is set 542 to a ratio of the new weight based on availability. Any residual value is saved 1028 as a percentage of unavailability. The lower the residual, the higher the data availability.

[0097] In some embodiments, for example, if the data is less reliable or has fewer sources, a cutoff is used when setting 542 the weights. For example, if only actual access data is available and sensitivity is not used, an embodiment may only use the top 0.1% of access data for the HPU score. However, if more access data and sensitivity data are available, some embodiments increase the cutoff to use the top 1%.

[0098] As a specific architecture example, in an environment utilizing Microsoft software, a data flow proceeds as follows. Enriched audit logs, Microsoft Information Protection (MIP) lookup results, and Microsoft Sensitive Information Types (SIT) 418 lookup results are analyzed to infer 1034 which resources 132 (e.g., which sites) have been accessed by a user. Impact signals such as blast radius, level from the top, counts of reported persons 1220, and administrator role data are analyzed to infer 1036 the organizational authority of the user. Access resource reasoning and organizational authority reasoning undergo feature engineering, for example, in accordance with familiar data science techniques for cleaning and organizing given data, and the results are fed into the HPU scoring algorithm described herein. The HPU scoring algorithm generates a ranked list of HPU candidates. In some embodiments, the HPU scoring algorithm alternatively or also generates a trained HPU scoring reasoning engine, such as a statistical or machine learning model.

[0099] Some embodiments also utilize one or more of the following data sources as input to the algorithm.

[0100] Prioritized content, i.e., customers can specify content to be scored higher, such as specified sharing sites, content with specific sensitivity labels, content of specific sensitivity types.

[0101] Data representing actual accesses to actual files, rather than speculative accesses.

[0102] Data representing access to a parent site that supports inference of access to highly confidential or confidential assets.

[0103] Threat vulnerability scores or security scores generated by other tools.

[0104] Security group membership.

[0105] Data representing access to sensitive email messages.

[0106] Data representing access to financial plans and records.

[0107] Historical attack information about the user, e.g., whether the user has been the target of phishing or other attacks. In some embodiments, this attack information is Boolean (has been or has not been targeted), and in some embodiments, it is more granular (e.g., has been targeted N times in the past 6 months, or has been targeted N times since the most recent job role change).

[0108] Whether the user is a social media influencer. In some embodiments, the social media influence data is Boolean (e.g., the user is authorized or not authorized to post on behalf of the organization), and in some embodiments it is more granular (e.g., the user has N thousand followers, the user has posted on behalf of the organization an average of K times in the past 30 days, the user has sent or received N communications in the past week, the user does not necessarily speak on behalf of the organization but has mentioned the organization's name N times in public releases in the past month, the user has mentioned the organization or organization officials or organization product names N times in the past six months, etc.). As with other example lists herein, zero or more of the listed examples are part of a given embodiment, depending on the embodiment.

[0109] Some embodiments use actual access events (logs) or use potential access events (e.g., which pages a user has access to). Some embodiments iterate through the sites and enumerate the authorized users of each site to populate a data structure representing the sites and their authorized users, and then use information such as the number of sites the user is authorized to access and the sensitivity label of each site when calculating the user access pillar value.

[0110] Some embodiments provide 516 explanations for HPU scores that are different from machine learning scores that do not come with a human-readable explanation of the reasons that led to the score. As an example, such an explanation 326 for a hypothetical user X is as follows: X has been identified as a possible high potential user because X has accessed more files with sensitive information types than ordinary users, X is in a global management role, and X is at the top of the organizational hierarchy. In variations, some or all of the relevant actual values ​​are shown, such as file counts for X and for ordinary users. For example, the explanation 326 includes the following statement: "This user is in the top 17% of the organization for accessing sensitive information." In some embodiments, when a user is detected as a PHIU and has a booster applied, a visual indicator is displayed in the alert overview showing that the user is a priority user and the top reasons for deriving the explainability. Some reasons 328 are, for example, access to sensitive content with a label, access to sensitive content with a sensitive information type, level from the top in the organization, administrator role (role name), cumulative reports involving the user, or membership in a group named as a priority user. In some embodiments, for example, these top reasons 328 are passed from the PHIU model to the user interface.

[0111] Here, as elsewhere herein, it is assumed that appropriate privacy and regulatory compliance mechanisms are deployed and are appropriately utilized. For example, a cloud tenant that wishes to obtain the enhanced security benefits of its constituent users' HPU scores can choose to share access signal data and influence signal data with the cloud service provider or with another entity that processes the signal data to calculate an HPU score on behalf of the tenant. In some embodiments, the tenant is also notified 1038 that without access to the data, HPU detection may be less accurate or otherwise limited than if more data were available to the tool 302 to calculate the HPU score.

[0112] In some embodiments, PHIUs (e.g., users with HPU scores above a specified threshold) are automatically added to a Priority User Group (PUG) 322, which is an example of a security group 322 whose members receive 1040 a security review that is more recent, deeper, more granular, more extensive in terms of time or resources or both, or otherwise greater than at least some non-members of the security group 322. In some embodiments, granular role-based access control (RBAC) is applied 1002 to security group member activity data.

[0113] In some embodiments, the IRM tool 122 settings control screen or other user interface 124 includes an option to enable or disable a risk score booster for a policy alert. Some example booster 422 conditions include "activity is above the user's usual activity for that day", and "user is a member of a priority user group", "user is detected as a potential high impact user". In some embodiments, only one of the following boosters is applied: member of a priority user group, or potential high impact user. In other embodiments, both booster conditions are applied.

[0114] In some embodiments, the IRM tool setup control screen or other user interface 124 provides 1038 a message such as "With your organization- Active Tier - compared to the rest of the users, if they are Active Members of the Role are detected as potential high impact users based on their access to sensitive tagged information and sensitive information types." (Trademark of Microsoft Corporation)

[0115] In some embodiments, the IRM tool setup control screen or other user interface 124 provides 1038 a message such as "NOTE: If you select this risk enhancer, you agree to share Blast radius information. If your organization does not use Microsoft Information Protection labels or Active If the detection level is too low, the detection accuracy may be lower." (Trademark of Microsoft Corporation).

[0116] In some embodiments and situations, for a proper subset of policies for which the user is in scope, the user is an HPU, and the user status is listed accordingly for each individual policy. Thus, for each policy for which the user is in scope, the user can be marked as an HPU (or not).

[0117] In some embodiments, the identification of a user as a PHIU is irreversible within a policy time frame. If a user is detected 408 as a PHIU on day one, and on day three they no longer meet the criteria for the initial identification as a PHIU, the identification as a PHIU is still maintained 1016 as is. The user has the power or authority to cause increased harm in the time around the activity performed. Similarly, the score of the alert is not reduced, so the PHIU booster is not removed from the alert after the user is out of scope of the policy. In summary, in these examples, if the user is identified as a PHIU within their policy time frame, they will remain 1016 a PHIU until their policy time frame ends. Some embodiments update 516 the PHIU explanation reason in the interface to reflect the most recent reason for the user being considered a PHIU.

[0118] In some embodiments, if a booster is received because the user was in a PUG 322 and was later removed from the PUG membership, embodiments do not remove the booster (the booster is maintained 1042). Some embodiments symbolically represent 1044 the PUG they are a part of to indicate that the former membership caused the booster to be applied. If a user receives a booster because they were in more than one PUG and they were subsequently removed from one of those PUGs, some embodiments show 1046 the current PUG(s) they are still in.

[0119] In some embodiments, the access signal is computationally derived 1048 from all file events in the enriched audit log. In some embodiments, the access signal 312 includes a sensitivity label 416 or a sensitivity information type 418 or both.

[0120] In some embodiments, the influence signal is computationally derived 1048 from one or more of: cumulative reports or cumulative direct reports, directory service organizational hierarchy, directory service organizational role, or directory service administrative role. In some cases, the administrator identification looks 1048 at the type of permissions associated with the administrator role and applies 1048 the score, e.g., a user with the necessary permissions to reset a password for a user or app receives a higher score. In some cases, the administrator identification also looks 1048 at the service principals that the user owns.

[0121] In a specific example, based on using one or more of the following events (or similar events in other environments) from having The file activity patterns of 1034 users in the workload’s rich audit logs are examined to infer the files accessed by 1034 users, and 1048 access pillars are computationally derived:

[0122] "FileRead", "FileSensitivityLabelChanged", "FileCopiedToClipboard", "FileDeleted", "FileDownloaded", "FileCopiedToRemovableMedia", "FilePrinted", "FileCreateOnRemovableMedia", "FileCreat ed", "FileCopiedToNetworkShare", "FileSyncDownloadedFull", "FileAccessed", "FileUploadedToCloud", "SensitivityLabelRemoved", "FileRenamed", "SlimFilePrinted" or "FileCreateOnNetworkShare".

[0123] Some embodiments utilize 518 the exfiltration detection infrastructure to generate and store research detections that include a list of prioritized users for each tenant and the reason why the user was marked 1004 as high priority. Some embodiments read from the research detection storage.

[0124] Some embodiments filter out 1006 users that are not in scope. Some embodiments parse 1050 the information into user insights with a new insight category (e.g., UserEnrichmentInsight) and send 1050 via an insight event hub. Some embodiments run 540 the PHIU job periodically, such as once a day, and resend insights to the coordinator periodically (e.g., every hour). Some embodiments update 514 the user PHIU status to show objects that are found to be PHIU in scope or policy, or both. Some embodiments filter out 1008 boosters in policies that are not used for scoring (e.g., InsiderRiskCaseClosed). Some embodiments include a feedback mechanism to provide 1102 feedback 1104 from users in general or from administrators in particular based on the PHIU identification.

[0125] In a specific example, an embodiment obtains 1106 blast radius data, such as via an API, e.g. BlastRadius value. This embodiment alternatively or also uses a secure key to retrieve 1106 the blast radius data from a secure storage device. This data is then made available, for example, using other storage devices, and using 1106 a helper class to call between languages ​​such as Python and Scala at conversion points.

[0126] Some embodiments aggregate 1108 access data. In particular, some reuse sensitivity label and sensitivity type aggregations and re-aggregate them over a period of time (e.g., the past 30 days). In a specific example, an embodiment filters 1010 and reads only activities that have sensitivity labels or sensitivity type information for all users within the last 30 days. The embodiment then extracts 1110 relevant information about each activity. For sensitivity label 416 activities, the embodiment groups 1112 by user, label name, and whether the label is prioritized or ranked in the top 10% in the sensitivity label priority order. For sensitivity type 428 activities, the embodiment counts 1108 the number of sensitivity types on each activity and sets it as the sensitivity type count. The embodiment then groups 1112 by user and sums 1108 the sensitivity type counts over the window (e.g., 30 days). The result is input for the PHIU model 526.

[0127] In a specific example, some embodiments include a CEAD job that feeds data to perform a Cumulative Exudation Anomaly Detection (CEAD) test and an HPU booster job that feeds data to perform an HPU test. The CEAD test and the HPU test are used as research tests for a research insight generation job, the results of which go to the insight event hub and orchestrator. The example includes an enhance research insight generation job to format it into a UserEnrichmentInsight insight. The research insight generation job in this example runs every hour, so that using the corresponding triggers, the PHIU booster insights are sent every hour and the CEAD insights are sent every 24 hours.

[0128] In some embodiments, the weight calculation step 542 is performed once per tenant. This will assign a weight 332 which will be used to show the availability of the input signal received for that tenant. It is assumed in this example that the weights do not change across daily runs of the PHIU model. The weights may be cached, for example, for snapshots.

[0129] In a particular example, the embodiment data flow includes a flow from the insight 432 event hub to HPU detections (per user) where InsightCategory=UserEnrichmentInsight to the data client coordinator to the HPU insights to a database collection of raw user insights with InsightType=HighPriorityUser. In this particular example, the embodiment data flow also includes a flow from the UserInsightProcessor to a filter that filters 1008 the HPU boosters from the raw insights (unscored) to be processed. If an HPU is discovered, the data flow updates all active objects in scope and updates the risk user entity to specify a priority using the discovered cause. The data flow then scores the user insights; when scoring objects in scope, if the object is marked as prioritized, the booster is applied.

[0130] In some embodiments, when the risky user designation expires 1052, an embodiment resets 1054 the PHIU status for the user. After the user designation expires and the user returns to scope, an embodiment waits for a signal from the PHIU output to start boosting the user's score again. Some embodiments also expire the PHIU status if the user object in scope expires.

[0131] In some embodiments, the percentage attribute in the PHIU interpretation 326 indicates what percentage of users have more activity than the user for a given feature. For example, MIP_Priority_Rank=0.008 means that the user ranks in the top 0.008% of users in terms of the total number of files accessed using a priority MIP ("MIP" refers to one or more sensitivity labels 416 applied to resources in some computing environments). In some embodiments, the percentages are divided into buckets, for example, SIT_4_6_Rank (implemented as a double) indicates the percentage of users who have accessed more files with 4 to 6 unique SITs than the user ("SIT" refers to a sensitivity information type 418 value applied to resources in some computing environments).

[0132] In a specific example, the access pillar signal 312 (also referred to as access input) and corresponding implementation data types in an embodiment include TenantId: string, UserId: string (representing the user primary name (UPN)), AadUserId: string (null if the user is not in scope, AAD refers to Active ), SIT_0_Count: long integer, SIT_1_3_Count (from 30-day historical aggregation), SIT_4_6_Count, ..., SIT_10_12_Count, SIT_G_12_Count, MIP_Priority_Count, MIP_Infered_Priority_Count.

[0133] In a specific example, the impact pillar signals 320 (also referred to as impact inputs) and corresponding implementation data types in an embodiment include TenantId: string, AadUserId: string, Level_From_Top: number, Cumulative_Report_Count, Admin_Roles (list of strings), Is_Admin (Boolean).

[0134] In a particular example, a final set of inputs to the impact risk 214 calculation 502 include: TenantId, UserId (UPN), Level_From_Top (obtained from blast radius data), Cumulative_Report_Count (from blast radius), Is_Admin (from blast radius), Admin_Roles (list of strings) (from blast radius) (extra 'pass' column), MIP_Priority_Count (from 30 day historical aggregation), MIP_Inferred_Priority_Count (from 30 day historical aggregation), SIT_0_Count, SIT_1_3_Count (from 30 day historical aggregation), SIT_4_6_Count, . . . , SIT_10_12_Count, SIT_G_12_Count.

[0135] In a particular example, the weight contract specifies a weight 332 for each tenant to be calculated once and persisted in the storage device. In this example, these weights and some associated data include TenantId, Level_From_Top_Weight (from blast radius), Cumulative_Report_Count_Weight (from blast radius), Is_Admin_Weight (from blast radius), MIP_Priority_Count_Weight (from 30-day historical aggregation), MIP_Inferred_Priority_Count_Weight (from 30-day historical aggregation), SIT_0_Count_Weight, SIT_1_3_Count_Weight (from 30-day historical aggregation), SIT_4_6_Count_Weight, ..., SIT_10_12_Count_Weight, SIT_G_12_Count_Weight, Influence_Weight, Access_Weight, CreateTime.

[0136] Some embodiments include or utilize a cumulative exfiltration anomaly detection (CEAD) detector 414, 534 that detects exfiltration activity performed by a user over a period of time and over different exfiltration methods 406. The CEAD detector flags complex insider risk activities performed by insiders who take a more methodical approach to exfiltrating sensitive content from their organization (e.g., "low and slow" exfiltrations). As used herein, "exfiltration" means sending data from a computing system inside an organization to a location outside of that computing system. Depending on the circumstances, an exfiltration may be authorized or unauthorized, and may be intentional or accidental.

[0137] In some embodiments, the CEAD function operates as follows. The CEAD detector calculates 1114 the median exfiltration activity (by exfiltration activity type and total exfiltration activity) for the customer's tenant over the last 30 days, calculates 1114 the cumulative exfiltration (by exfiltration activity type and total exfiltration activity) for the user over the last 30 days, identifies 1114 the standard deviation of the tenant median of activity for the user across exfiltration activity type and total exfiltration activity over the 30 days, feeds 1114 the result through a calibration function, and assigns 1116 a CEAD score 426. Some embodiments present 1056 insights 432 for CEAD risk, and if the CEAD score meets the alert threshold 430, some embodiments generate 540 an alert 428.

[0138] Some embodiments calculate 522 the user's distance from the organizational mean for exudate activity over time. Some embodiments add 522 a CEAD calculation 1114 or (OR) 116 to compare the user's cumulative activity to one or more user peer groups 404. In some embodiments, comparison results from multiple peer groups are combined in a given embodiment by summing, by weighted combination, by separate comparisons to thresholds, or otherwise.

[0139] As an example, a user in a sales organization frequently sends emails with attachments to external recipients to facilitate close deals with clients. Rather than measuring the exfiltration activity of a user who rarely needs to send emails to external recipients, some embodiments measure the cumulative exfiltration of the user relative to a peer group 404 of other sales employees with similar activity patterns.

[0140] In some embodiments, a user's peer groups 404 are identified based on one or more criteria. In some embodiments, a user has multiple peer groups based on, for example, organizational distance (e.g., users working on product X), the user's role (e.g., engineers working on product X), or users accessing similar resources (e.g., users accessing a shared site for product X). More specifically, some embodiments identify one or more of the following peer groups, or similar peer groups 404.

[0141] Peer Group #1: Organization or Management Chain - Identify peer groups based on organizational distance, based on peers of the user, peers of the user's manager, reports to, and reports to. Variants use proper subsets of the listed bases.

[0142] Peer Group #2: Role Name - Peer groups were identified based on similar job titles using vector-based cosine similarity. Organizational distance was also considered.

[0143] Peer Group #3: Users who access similar resources - Peer groups are identified based on public online sites visited. Some embodiments remove 1118 public sites from this calculation to remove noise from generic sites, such as search engine sites or a company's human resources site.

[0144] In one example scenario, M is an IRM analyst at a hypothetical example company, Contoso. M is reviewing an alert generated for J. J is a data scientist at Contoso. J's alert is generated due to cumulative exfiltration activity. M sees that J's exfiltration volume is moderate and about the same as the organization average. However, J's volume is nearly twice the average for J's peer group 404. When M looks more closely at J's activity, M sees that J has a large upload to cloud activity, exfiltrating pre-release features onto J's personal cloud service. Thus, the comparison 522 to a peer group that is smaller than the organization detects an anomalous exfiltration that a simple comparison to the organization average would miss.

[0145] In another example scenario, M moves to the alert generated for C. C is a salesperson. C's alert is also generated due to cumulative exfiltration activity. M sees that C's exfiltration volume is above the organizational average. However, C's volume is about the same as C's peer group average. Now M is not so worried, and from a quick scan it can be seen that most of C's activity is related to contract negotiations with clients, which is expected for C's job. Therefore, the false positive that a simple comparison to the organizational average would result in is avoided in the comparison 522 of a peer group that is smaller than the organization.

[0146] In some embodiments, the CEAD detector generates 1120 peer groups for the user and calculates the user's CEAD based on the user's activity compared to the organizational median, and generates 1122 peer group medians and compares 522 the user's activity to them.

[0147] In some embodiments, for example, the activity types measured for a user include exfiltration activity types such as external email, copy to cloud, copy to removable media, copy to file share, copy to sharing platform, copy to chat, and print. As a reminder, as with other examples listed herein, zero or more of the listed examples are part of a corresponding embodiment.

[0148] In some embodiments, the CEAD detector will send a CEAD insight 432 with the top three reasons 328 and a score to the coordinator. In some embodiments, the reasons include a comparison of the user's activities with their peer groups, and the score indicates this. In some embodiments, the top three reasons are reasons within each peer group, and in some embodiments, reasons across all peer groups, depending on the configuration and embodiment. Three is just an example; in some cases, the top N reasons are shown, where N is in the range of 1 to 10. In some embodiments, CEAD insights reflect the cumulative exfiltration of a user compared to the organization and its peer groups. Specifically, for example, one or more of the following are specified or included in some CEAD insights 432: total cumulative activity, a link to the details of the activity, any groups in which the user is most abnormal, a score indicating that the user is more risky relative to other users (if they are abnormal compared to multiple peer groups), or whether the exfiltration activity contains priority content.

[0149] The following are some of the many possible examples of CEAD Insight Explanation 326. Here, "org" means organization, "UTC" means coordinated universal time, and "exfil" means exfiltrate.

[0150] CEAD Explanation A (showing the top 3 most anomalous groups and the top causes within each group). March 18 to March 28. 100% more events than others in the organization (5,500 events: replication to the cloud). 90% more events than others in a similar role (4,000 events: email). 50% more events than others accessing similar resources (20,000 events: all exfiltration activity).

[0151] CEAD Explanation B (showing top 3 causes across all causes, peer groups). March 1, 2022 - March 30, 2022 (UTC) | Risk Score: 30 / 100. 216 events: Copy to USB: 99% more than others in similar roles. 10% more than others in the organization. 100 events: All exfiltration activities with priority content: 80% more than others in similar roles. 216 events: File printing: 75% more than others in similar organizations.

[0152] CEAD Explanation C (only all exfiltrations and groups are shown). March 18-28. All exfiltrations: 5,000 events. 100% more events than users with similar roles. 50% more events than users accessing similar resources. 10% more events than organizations.

[0153] CEAD Explanation D (Shows top 3 all exfiltrations or priority content exfiltrations). March 1, 2022 - March 30, 2022 (UTC) | Risk score: 30 / 100. 216 events: All exfiltration activities: 99% more than others in similar roles. 100 events: All exfiltration activities with priority content: 80% more than others in similar roles. 216 events: All exfiltration activities: 75% more than others in similar organizations.

[0154] CEAD Explanation E (Alternative Detail Level). March 1, 2022 - March 30, 2022 (UTC) | Risk Score: 30 / 100. 216 events: Copy to USB: 99% more than users with the same job title. 100 events: All exfiltration activities with priority content: Same as access 80% more than users of the site. Prioritized content includes: 2 sensitivity labels. 216 events: File printing: 75% more than teammates.

[0155] In some embodiments, higher scores are assigned when the activity involves priority content. In some embodiments, such content includes content having one or more of the following: a sensitivity label configured as priority content, a sensitive information type configured as priority content, a sharing platform configured as priority content (e.g., sites), file extensions configured as priority content, or inferred priority sensitivity labels (e.g., the top 10% priority sensitivity labels).

[0156] In some embodiments, the data used to generate peer group 404 is obtained from, for example, a directory service, and includes, for example, a manager alias + job title and a list of the manager's direct reports + their job titles.

[0157] In some embodiments, peer groups 404 are defined based on organizational hierarchy, access to shared resources, and job title. In variations, only two of these bases are used, or only one of these bases is used.

[0158] In some embodiments, the IRM tool setup control screen or other user interface 124 provides 1038 a message such as "NOTE: If you select this check, you will agree to share your Active data, including organizational hierarchy and job titles to identify peer groups. If your organization does not use Active If the user does not use the same tools to maintain organizational hierarchies and job titles, detection accuracy may be lower."

[0159] In some embodiments, tenants can choose whether to calculate their CEAD for users compared to the organization specification, peer specification, or both. By selecting the peer group specification, the tenant agrees to share directory service data with the IRM, including organizational hierarchy and job title to identify peer groups.

[0160] In some embodiments, the CEAD data flow utilizes or includes one or more of the following: tenant settings, event hubs, event listeners, orchestrators, cruncher stores, raw policy data, rich logs, RESTful web APIs (such as Microsoft Graph TM API (compliant with REST=Representational State Transfer), authentication tokens, aggregation, peer group model, CEAD detector code or other mechanisms indicated or familiar to those skilled in the art.

[0161] In the insider risk space, not all users are equal. Some users, due to their access to sensitive data or other sensitive system resources 132 (software, hardware, data) and the impact they have on the organization, have the ability to cause more damage to the organization if they abuse or misuse their access and privileges. In some embodiments, the potential high impact user (PHIU) model 526 identifies users who are more likely to cause substantial damage to the organization if they become an insider threat. This context 214 is valuable to the organization because it helps enable the security team to prioritize insider risk prevention, alert review, investigation, and response activities to prevent damage from data leaks, data theft, sabotage, negative workplace culture activities, etc. Security teams typically have limited resources, so it is beneficial to focus their efforts on the most impactful threats first to protect their organization.

[0162] As an example, consider J, an employee of a hypothetical company, Contoso. J is a junior business analyst responsible for creating reports on cost of goods sold (COGS) for materials. J does not have much exposure to other transactions at Contoso, and most of J's access is limited to COGS data for a specific wiring required for Contoso's small component products. C is also an employee at Contoso. C is a senior director with a large team in the Information Technology (IT) organization. C also has a senior management position at Contoso for Services and Microsoft Global management privileges for tenants in the service, and is Administrators (a trademark of Microsoft Corporation). These administrative roles allow C to access all of Contoso's Additionally, C is working with Contoso's security red team on a highly confidential project and has access to reports on Contoso's control gaps and vulnerabilities across its critical business processes.

[0163] In this example, the Contoso security team sees two internal risk alerts 428 for potential data theft. One alert is for J and the other is for C. The security team sees that C is a potential high impact user at Contoso and they prioritize review and response to C's activities. If C were to abuse administrator privileges, it could cause great damage at Contoso. If C were to maliciously sell the red team report, it could put Contoso in a vulnerable position to be compromised by an external attacker.

[0164] Within the internal risk management tool 122, the PHIU model can be implemented in several ways. One approach involves alert prioritization, such as a risk score booster. Internal risk management alerts involving users identified as PHIUs receive boosted risk scores so the customer can prioritize the review and response of these alerts. Another approach involves additional detection controls, such as the automatic addition 506 of PHIUs to one or more priority user groups 322. In the internal risk management tool, priority user groups can be automatically created 506 to define users who are subject to closer inspection and more sensitive risk scores. In some embodiments, priority user groups also limit review activities to specific users or internal risk role groups. These approaches are not mutually exclusive; they can be combined in a given risk management tool.

[0165] Some embodiments take advantage of potential user impact as opposed to actual user impact. Estimating, tracking, modifying alerts, and otherwise managing potential impact provides advantages over internal risk approaches that only look for impactful or risky behavior. Some embodiments "left-shift" CEAD or other detection, that is, they perform detection earlier than other approaches. For example, some embodiments expose suspicious behavior earlier to the attention of security controls or security personnel, or both, which enhances the organization's ability to avoid significant damage to the organization. In addition, by decoupling 1124 these impact categories (potential impact vs. actual impact), embodiments gain independent statistical benefits. For example, even if behavioral alerts are noisy for a particular tenant, an independently calculated PHIU enhancement can still help mitigate that noise and separate out alerts that pose a greater danger.

[0166] In some embodiments, the PHIU functionality 210 provides automated, machine-driven enrichment to identify users 402 based on data and telemetry from within the organization. This is more efficient, more accurate, and faster than an organization manually identifying high-value users.

[0167] Some embodiments include adjustment controls in the modular risk portfolio framework that are particularly suitable for adjusting 542 the definition of "high impact." For example, in some embodiments, the algorithm is adjusted so that organizational impact is twice as important as access to sensitive documents. Adjustability is beneficial because different customers may have different risk preferences, or different data used to feed the PHIU identification algorithm, or both. Some embodiments automatically set 542 those adjustment controls based on available and relevant inputs for each unique organization. For example, if the organization has a flat hierarchy, an embodiment will apply 512 the impact measurement differently than if the organization has a pyramid hierarchy, for example, by reducing 542 (possibly to zero) the weight 332 of signals such as the user's position from the top of the organizational hierarchy and the user's count of reported persons. Similarly, if the organization does not provide a clear signal for the sensitivity of the document, an embodiment will automatically reduce 542 the emphasis on the user's potential impact.

[0168] Some embodiments include or utilize extensibility, for example, a modular scoring framework that accepts "plug-in" new indicators of potential impact to users. The two indicator pillars 310 discussed herein are organizational power or influence and sensitive data access, but the modular scoring framework will accept other pillars and calculate 502 PHIU scores based on them. Some examples of other pillars 310 include public visibility and potential for brand damage, as well as operational entry for business criticality. In some embodiments, pillar refinement is also employed 1058, such as reasoning about file sensitivity in the data access pillar.

[0169] Some embodiments provide 516 an explanation 326. They provide 516 a reason 328 that helps an analyst or investigator interpret the PHIU designation, rather than simply stating “this user is potentially high impact.” The explanation 326 specifies why the user was designated (or not designated) as a PHIU.

[0170] Risky internal activities (internal risks) may be challenging for an organization to detect because the risk comes from users who have been authorized to access assets 132 within the organization; such access is necessary so that these users can perform their expected job duties. Therefore, it may be very difficult to detect unexpected and harmful activities performed by these users. The technical challenge faced by security professionals is how to tell whether the user's activity is expected and just doing their job, or whether it may be potentially risky and can harm the organization. In some embodiments, the peer-aware cumulative exfiltration anomaly detection function 414, 210 helps the organization detect potentially risky internal activities by filtering out 1010 expected and benign activities for users and showing 1010 activities that may cause risks. In some embodiments, this is accomplished by analyzing 1010 activities performed by users over time and across multiple activity types, and comparing 522 the activities with the organization's specifications or the specifications of the user's (multiple) specific peer groups, or both.

[0171] Some embodiments include or utilize a detector 414 that can generate an internal risk alert when a user has potentially risky activity based on the amount of activity over time, the type of activity, and how the activity compares to the user's peer group 404 norms. To calculate 518 the detection 520, some embodiments are based on, for example, Online access mode and Active The user's peer group is identified 1120 by an organizational hierarchy or similar offering from other vendors (Microsoft Corporation logo).

[0172] Some embodiments simultaneously look for anomalies in specific exfiltration activity types (e.g., copy to USB) as well as cumulative or "all up" activity (e.g., copy to USB + print + ...). This allows embodiments to find people who spread exfiltration over different data transfer mechanisms or different data communication channels, or both. In addition, some embodiments include a modular framework that allows for per-tenant customization, for example, to take advantage of the types of actions available from a given tenant or important to a given tenant, or both.

[0173] Some embodiments look for anomalies 518 520 by comparing 522 the user's activities to the normal activities of each of multiple definitions of the user's peer group 404 (e.g., peer groups based on organizational structure, job title, and common access to documents) simultaneously or sequentially. In some embodiments or configurations, the user's peer group 404 is the entire organization, but the default and assumption herein is that any peer group 404 is smaller than the entire organization. This multi-peer group approach allows embodiments to find 518 hard-to-find risks 520 that might be missed if the user's activities were compared to only one slice of the population (also referred to as a peer group). In addition, in some embodiments, this multi-peer group approach is done modularly to support customization by tenant, for example, to take advantage of the types of actions available from a given tenant or the types of actions that are important to a given tenant, or both.

[0174] Some embodiments utilize file sensitivity information to improve detection (CEAD or PHIU or both). Some embodiments do this when reasoning about peer groups (e.g., common access to sensitive files implies peers), or when evaluating anomalies in potential exfiltration activity (e.g., a user copied too many sensitive files to a USB), or both.

[0175] In some embodiments, configurability (CEAD or PHIU or both) provides advantages. As described above, some embodiments are easily configured 542 to focus on specific activity types, specific definitions of peer groups, specific file sensitivities, or a combination thereof. This configurability not only appropriately tailors 542 the solution to the different components that individual customers may have (e.g., Contoso may not have marked documents, so file sensitivity information does not exist), but also enables the solution to solicit and comply with preferences specified by each customer (e.g., Contoso may not care about printing activities).

[0176] A related advantage is how some embodiments automatically adapt 542 each customer appropriately. Even in the absence of detailed preferences and fine-tuning stated by the customer, the algorithms in some embodiments are designed to work essentially out of the box. For example, if a necessary data component is missing, some embodiments automatically reduce 542 a specific definition of a CEAD peer group or PHIU signal. Some embodiments adjust 542 in a non-binary manner to get as much value as possible from the available data components (e.g., by using a weighted combination with non-zero weights rather than simply turning it on or off). Similarly, in some embodiments, the anomaly detection algorithm automatically determines 518 worrying behavior regardless of normal behavior for each tenant. This is very different from, for example, a simple data loss prevention (DLP) rule that only looks for "more than 50 items copied to USB". In some embodiments, this approach is also different from an approach that looks for rapid changes in user behavior, for example, a detector that would sound an alarm because a user copied 5,000 files to a USB drive on the last day of work may not detect 518 exfiltration activity of two or three files per day or every other day through different channels (email, USB, shared drive) in the months before the termination of the user's account.

[0177] With respect to weighting, some embodiments base signal weighting or pillar weighting or both on the quality of available data, which in some cases includes data about or from the organization or both. For example, weights 332 are set 542 or adjusted 542 based on whether the organization is flat or has a management hierarchy, based on whether the organization defines management roles in the computing system, etc. In some embodiments, there is no granularity or a granularity of weighted data, or the data may be more fine-grained.

[0178] Data can be direct or inferred. For example, when an organization has little sensitive information, a low impact risk signal can be inferred even in the presence of actual access to sensitive information. In some embodiments, the definition of "small" is a threshold of absolute size, such as less than 10 megabytes, and in some embodiments it is a threshold relative to the size of non-sensitive information, such as less than 5% of the information is marked or typed as sensitive.

[0179] In some embodiments, insight 432 is a detection from a PHIU detector, a CEAD detector, or another detection in the IRM. Some examples are: CEAD detection finds that a particular user has unusual activity when compared to its peer group, and user X is found to have downloaded 100 files in a given day.

[0180] In some embodiments, alerts 428 are how embodiments surface insights to customers via the customer's security or administrative staff. In some embodiments, alerts are per-user and show all insights detected for a user since tracking of that user began in system 216 or another time period. Not all insights are risky behavior, so some embodiments also have a risk score threshold to be met before surfacing insights for a user in the form of an alert. In some embodiments, this risk score threshold can be customized for a customer.

[0181] In the example, suppose a user has several insights, but all of them have a risk score < 15, where 15 is the alert threshold. Then, although the embodiment saves the user's insights, the embodiment does not generate an alert to show that the user has risky behavior. If the user receives an insight with a risk score >= 15 (or whatever the threshold is), the embodiment generates 1126 an alert and shows 516 all the insights it has for the given user, so management or security personnel can investigate.

[0182] After an alert is generated for a given user, some embodiments track 1102 feedback 1104 from the alert, which indicates whether management or security personnel found the alert useful. This is determined based on whether they acknowledged the alert or dismissed the alert, respectively.

[0183] In some embodiments, IRM data is viewed as organized in a hierarchy. Raw events: These are atomic activity events recorded for a user, e.g., user E downloaded at 12:25 PM on 9 / 26. Insights: These are based on related or aggregated events and are assigned a risk score, e.g., E had 550 download events on 9 / 26, 35 of which contained sensitive information, or E had 1500 exfiltration events in the last 30 days, most of which were copied to USB and printed, and this is anomalous compared to E's peer group. Alerts: Alerts are generated based on insights for a user, and in this example, an embodiment only generates alerts if the user's insights are risky because they receive at least a specified minimum score. A security professional or administrator can confirm or dismiss the alert after they have reviewed the activity and determined whether it poses a risk. Some embodiments collect feedback based on the security professional's or administrator's response to the alert (confirmation or dismissal), which is used as a data basis for reasoning 1102 about the effectiveness of the insight.

[0184] Some embodiments use the impact score 214 to filter 1012 or boost alert scores in other alert systems. Some embodiments use the impact score 214 as a basis for automatically adjusting priority user group membership (PUGs get more intense monitoring). Some embodiments use the impact score 214 to automatically turn specific detectors on or off. Some embodiments use the impact score 214 to automatically adjust alert thresholds. Some embodiments use the impact score 214 to train a machine learning model specifically for PUG members so that the model optimizes detection of PUG members.

[0185] Some embodiments monitor and respond to performance changes. In some embodiments, built-in metrics identify changes in accuracy. In some embodiments, behind-the-scenes controls can adjust 1128, 542 embodiments to respond to performance issues (e.g., the system includes several options for anomaly detection algorithms, calibration algorithms, and related hyperparameters). Some embodiments include guardrails to avoid catastrophic customer experiences before any degradation is fixed.

[0186] With respect to in-depth measures measuring CEAD detection accuracy, some embodiments include accuracy metrics such as the percentage of CEAD detections that are acknowledged rather than dismissed by the customer. In some embodiments, accuracy metrics include accuracy by activity type (e.g., USB exfiltration), by tenant (e.g., CEAD is struggling for tenant X), and by alert attributes (e.g., when CEAD alerts are based on USB exfiltration of volume < 100, they are typically dismissed). Some embodiments utilize more than acknowledgement or dismissal as feedback, e.g., in some UIs 124, click behavior is used to infer which alerts are at least somewhat interesting to the customer (e.g., security personnel or administrators or both), even if they did not explicitly acknowledge the alert.

[0187] Some embodiments utilize similar metrics to measure PHIU detection accuracy, e.g., for PHIU detections that are confirmed or dismissed by the user, except that the metadata provided in the insights is specific to PHIU. The metadata includes all feature values ​​and weights that created the PHIU detection. In this example, the overall PHIU metric is the same as CEAD, including the number of insights generated, how many insights detected each feature as an anomaly, and the user alerts created in the IRM, where PHIU is the highest scoring insight in the alert. As with CEAD, embodiments may use metadata and customer feedback to try to identify false positive detections.

[0188] In some embodiments, when an embodiment detects CEAD, the embodiment includes insight-specific metadata, such as the activities detected as anomalous, activity counts, peer comparison median, organizational comparison median, and other statistics indicating why the model gave the user a specific CEAD risk score. Some embodiments also track overall CEAD metrics, such as the number of insights generated, how many insights detected each activity type as anomalous, and user alerts created in the IRM, where CEAD is the highest-scoring insight in the alert. After an alert is created for a user, some embodiments also track feedback from customers if the alert for the user is found to be benign (the alert is dismissed) or the alert is worth taking action on (the alert is acknowledged). Some embodiments take this feedback and classify the detection as a false positive or true positive based on the metadata from the insight and whether the customer finds the alert worth taking action on.

[0189] In some embodiments, CEAD control parameters include which activity types to consider (e.g., copying to USB, printing, uploading to personal cloud storage, etc.), the granularity of file sensitivity levels to use (e.g., ignore sensitivity and treat all files equal, and 2 buckets (all, sensitive only), etc.), the relative importance of those activityType+fileSensitivityLevel combinations (e.g., copying sensitive files to USB is twice as important to Tenant X as everything else, or Tenant Y hardly cares about printing), and which core anomaly detection and calibration options to use (e.g., z-score with mean vs. median, calibration with linear or nonlinear scaling).

[0190] In some embodiments, the PHIU control parameters include the relative importance weights of the pillars. In some embodiments, smaller controls are also available, for example, when calculating the file access pillar, there are parameters that define how to ignore meaningless files, such as ignoring anything that has been accessed by >= 10% of other users. In some embodiments, adjustable hyperparameters for the PHIU include an upper limit on the percentage of users that the embodiment detects as potential high-impact users and the types of activities that the embodiment considers for the access pillar.

[0191] In some embodiments, guardrails are employed 1130 to avoid undesirable customer experiences with CEAD throttling and rate limiting. For example, some embodiments are configured to send no more than N medium-severity alerts to any tenant in a day to prevent the number of daily alerts from doubling between one day and the next. These are examples, for example, in some embodiments, other periods besides days are also used, and other alert categories besides medium severity are also used, or both are used.

[0192] In some embodiments, guardrails are employed 1130 to filter out 1014 CEAD insights from being sent in their entirety or to specific tenants. If an embodiment receives customer feedback or otherwise identifies an issue with a model detection algorithm, an embodiment may temporarily filter 1014 CEAD insights based on the generated risk score. In this example, an embodiment may filter 1014 completely to stop the flow of insights, or partially filter 1014 only the highest scoring insights until a fix can be added so that there is an immediate response to a given customer while a correction is made.

[0193] In some embodiments, the PHIU is an annotator for existing alerts, thereby inheriting these or other guardrails. In some embodiments, guardrails deployed for PHIU insights can fully filter 1014 or partially filter 1014 based on PHIU ranking model outputs. These filters 1014 can be by organization or for all detections.

[0194] Some embodiments combine the various anomaly scores of a user compared to their different peer groups 404. In some embodiments, the anomaly score combination function is consistent with the following constraints.

[0195] One constraint is that the more peer groups a user is anomalous compared to, the higher the user's overall score should be. For example, when user X is anomalous compared to users visiting the same site, users with similar job titles, and users in their team, then user X is more risky than user Y who is anomalous compared to only one peer group.

[0196] Another constraint is that the more unusual a user is compared to his peer group, the higher his risk score will be.For example, in some embodiments, the combining function preserves the relative distances between the adjusted scores.

[0197] Some embodiments provide customizability so an organization can weight one peer group higher than another. For example, a customer can decide that if a user is an outlier compared to their team, they are more at risk than if they are an outlier compared to others with the same job title.

[0198] As an example, assume an embodiment has N risk scores, where N = the number of different peer group definitions. Then, an anomaly score combination method proceeds as follows to arrive at a single risk score that can be used by an analyst.

[0199] Step 1: Calculate the average risk score for each algorithm across tenants.

[0200] Step 2: For each user's score, find the distance from the mean.

[0201] Step 3: Use a min-max normalizer to normalize the distance from the mean.

[0202] Step 4: For each risk score for the user, assign a weight.

[0203] Step 5: Calculate the weighted risk score.

[0204] Step 6: Calculate the average of the weighted risk scores and define it as RawScore (for internal debugging).

[0205] Step 7: Normalize the weighted risk score and return it as RiskUserScore (used by product 302).

[0206] In a variation, step 6 is skipped. In a variation, the tenant is replaced by a different kind of entity (eg, a group or a department).

[0207] Some embodiments combine organization level attributes from a directory service with the user's historical usage patterns and with sensitivity content. Some may infer what the sensitive content is based on out of box type 418 and tags 416. Some embodiments are adjustable 542 based on data relevant to the organization. In some embodiments, users are stack ranked across the entire organization to identify impact 212 potential relative to organizational norms.

[0208] Some embodiments combine peer group identification with cumulative anomaly detection to detect if activity is anomalous by understanding the user's peer group norms. Some embodiments also assign risk scores based on what is anomalous compared to organizational norms. If a user has a cumulative risk of exfiltration compared to their peer group and they are identified as a PHIU, some embodiments combine these operations.

[0209] Some embodiments use or include an exfiltration detector that utilizes a combination of the following components: file action and sensitivity information, multiple types of calculated peer groups, multimodal exfiltration detection across the board, and possible preemptive boosting of activities of users with inherent ability to do high damage. In some embodiments, the boost is calculated based on organizational information and file access behavior plus sensitivity. In some cases, these embodiments are robust to different components available from different customers, or different customers expressing their preferences for which components are most important in their risk perspective, or both.

[0210] Some embodiments operate along the lines consistent with the following pseudo code, in which "#" indicates a comment, and " / " indicates one or two items, for example, "calculation / inference" indicates calculation or inference or both, and "exfil" indicates exfiltration: Func DetectRiskyUserExfiltrationActivity( # Calculate / infer several peer groups for each user <peerGroupOfType1,peerGroupOfType2,···,peerGroupOfTypeN> ← DeterePeerGroupForEachUser() #Use multiple definitions of peers (some reasoning / behavior), and leverage file sensitivity #Quantify the risk of each user by comparing their file actions to everyone else and everyone in their peer group possibleExfilRiskScore_detecteddByComparingEachUserToAllUsers←ExfiltionDetector(allUsers) #Each ExfiltionDetector() includes multivariate AD across multimodal activities (with / configured importance) & leverages file sensitivity possibleExfilRiskScore_detecteddByComparingEachUserToTheirType1Peer Group←ExfiltrationDetector(peerGroupOfType1) possibleExfilRiskScore_detecteddByComparingEachUserToTheirType2PeerGroup←ExfiltrationDetector(peerGroupOfType2) possibleExfilRiskScore_detecteddByComparingEachUserToTheirTypeNPeerGroup←ExfiltrationDetector(peerGroupOfTypeN) overallExfilRiskScoreForEachUser← CombineAndCaliforniaPerGroupRiskScore(possibleExfilRiskScore_detectedByComparingEachUserToAllUsers, possibleExfilRiskScore_detecteddByComparingEachUserToTheirType1Peer Group, possibleExfilRiskScore_detecteddByComparingEachUserToTheirTypeN PeerGroup)#Robustness to errors and configurable importance #Boost score for users with inherently higher risk potentialImpactScoreForEachUser←ComputepotentialHightImpactUsers() #Multiple definitions of potential impact (some reasoning / behavior), exploit file sensitivity, robustness to errors, and configurable importance finalExfilRiskScoreForEachUser← BoostRiskScoreForPHIU(overallExfilRiskScoreForEachUser, potentialImpactScoreForEachUser) #Returns a list of risky exfiltration detections, each explained in a user-accessible way (interpretability is good for internal risk protection) return finalExfilRiskScoreForEachUser )

[0211] Some embodiments weight at least one of signals 314 based on the strength of the signal, or weight at least one of pillars 310 based on the strength of at least one of the pillars' signals. In some embodiments, signal strength is measured as usability, usefulness (e.g., reasoned as more than just noise), or desirability (e.g., the embodiment or customer assigns relative importance weights).

[0212] Some embodiments elevate risk scores in a policy-based network security tool based at least on the calculated risk of impact.In some embodiments, the policy-based network security tool is guided solely or in part by a policy, by a detector, or both.

[0213] In some embodiments, peer-aware CEAD and PHIU are implemented as separate and distinct technology pieces, and in some embodiments they are integrated, depending on the embodiment. The PHIU function identifies users who are likely to do an impact, and the CEAD function identifies actual activity (exfiltration) regardless of the likelihood of the user. In some embodiments, neither is an input to the other. In some embodiments, the PHIU and CEAD operate in parallel to help customers make better decisions (e.g., user X is doing something iffy [peer-aware CEAD] + if they want [PHIU] they could cause serious damage, so recommend appropriate personnel to investigate and take action if necessary). In some embodiments, the PHIU and CEAD are constructed similarly in that they each have a signal and a backbone. Technical characteristics

[0214] The technical features of the embodiments described herein will be apparent to those of ordinary skill in the art, and will also be apparent to a wide range of concerned readers. Some embodiments address technical activities, such as calculating 502 impact risk 214, changing 506 security group 322 membership, modifying 508 security control 420 behavior, detecting 518 abnormal exudation 406, and comparing 522 user activities with activities of user peer groups 404, each of which is an activity deeply rooted in computing technology. Some of the technical mechanisms discussed include, for example, PHIU detectors 408, CEAD detectors 414, statistical or machine learning models 526, security tools 122, and internal risk management software 302. Some of the technical effects discussed include, for example, the designation of users 402 with high potential impact 212 on system resources 132, more centralized and efficient network security based on such designation, and detecting 518 cumulative exudation anomalies 520. Therefore, purely mental processes and activities limited to pen and paper are clearly excluded. Based on the description provided, other advantages of the technical characteristics based on teaching will also be apparent to those skilled in the art.

[0215] Different embodiments provide different technical benefits or other advantages in different circumstances, but a skilled artisan informed by the teachings herein will recognize that certain technical advantages will likely result from particular innovative features or combinations of features, as noted throughout this document.

[0216] Some of the embodiments described herein may be viewed by some in a broader context. For example, concepts such as efficiency, reliability, user satisfaction, or waste may be considered relevant to a particular embodiment. However, availability in light of a broad context does not mean that this document seeks exclusive rights to abstract concepts; they are not. Instead, the present disclosure focuses on providing appropriate specific embodiments whose technical effects fully or partially solve specific technical problems, such as how to efficiently and effectively differentiate users based on their potential impact 212 rather than actual behavior alone, and how to adjust 542 network security impact risk mechanisms 302, 122 based on which data signals 314 are available or based on which are the priorities of the customers or both. Other configured storage media, systems, and processes involving efficiency, reliability, user satisfaction, or waste are outside the scope of this disclosure. Therefore, with a proper understanding of the present disclosure, ambiguity, mere abstraction, lack of technical characteristics, and accompanying proof problems are also avoided. Additional combinations and variations

[0217] Any of these combinations of software code, data structures, logic, components, communications, and / or their functional equivalents may also be combined with any of the above systems and variations thereof. A process may include any steps described herein in any subset or combination or sequence that is operable. Each variation may occur alone or in combination with any one or more other variations. Each variation may occur with any process, and each process may be combined with any one or more other processes. Each process or combination of processes (including variations) may be combined with any configured storage media combination and variations described above.

[0218] More generally, a skilled artisan will recognize that not every part of the present disclosure or any particular detail therein must satisfy legal standards, such as enabling, written description, or best mode. Furthermore, embodiments are not limited to specific scenarios, motivational examples, operating environments, peripherals, software process flows, identifiers, data structures, data selections, naming conventions, symbols, control flows, or other implementation options described herein. Any apparent conflict with any other patent disclosure, even from the owner of the present innovation, has no effect in interpreting the claims set forth in this patent disclosure. Acronyms, abbreviations, names and symbols

[0219] Some acronyms, abbreviations, names and symbols are defined below. Others are defined elsewhere herein or do not need to be defined here in order to be understood by those skilled in the art. ALU: Arithmetic Logic Unit API: Application Programming Interface BIOS: Basic Input / Output System CD: compact disc CPU: Central Processing Unit DVD: Digital Versatile Disc or Digital Video Disc FPGA: Field Programmable Gate Array FPU: Floating Point Processing Unit GDPR: General Data Protection Regulation GPU: Graphics Processing Unit GUI: Graphical User Interface HTTPS: Hypertext Transfer Protocol, secure IaaS or IAAS: Infrastructure as a Service ID: identification or identity LAN: Local Area Network OS: Operating System PaaS or PAAS: Platform as a Service RAM: Random Access Memory ROM: Read Only Memory TPU: Tensor Processing Unit UEFI: Unified Extensible Firmware Interface UI: User Interface WAN: Wide Area Network Some additional terms

[0220] Reference is made herein to exemplary embodiments such as those shown in the accompanying drawings, and specific language is also used herein to describe them. However, changes and further modifications to the features shown herein and additional technical applications of the abstract principles shown by the specific embodiments herein by those skilled in the relevant art(s) after mastering the present disclosure should be considered within the scope of the claims.

[0221] The meaning of the term is explained in this disclosure, so the claims should be read with careful attention to these explanations. Specific examples are given, but (multiple) technicians in the relevant field will understand that other examples may also fall within the meaning of the term used, and within the scope of one or more claims. The term does not have to have the same meaning as below here, that is, they are in general use (especially in non-technical use) or in the use of a specific industry or in a specific dictionary or dictionary collection. Figure numerals can be used with various wordings to help show the breadth of the term. Omitting the figure numerals from a given text does not necessarily mean that the content of the figure is not discussed by the text. The inventor advocates and exercises the right to compile specific and selected dictionaries. The quoted term is explicitly defined, but the term can also be implicitly defined without using quotation marks. The term can be defined explicitly or implicitly in the specific implementation and / or elsewhere in the application document.

[0222] A "computer system" (also referred to as a "computing system") may include, for example, one or more servers, motherboards, processing nodes, laptops, tablet computers, personal computers (portable or non-portable), personal digital assistants, smart phones, smart watches, smart bracelets, mobile phones or mobile phones, other mobile devices having at least a processor and memory, video game systems, augmented reality systems, holographic projection systems, televisions, wearable computing systems, and / or other devices that provide one or more processors controlled at least in part by instructions. The instructions may be in the form of firmware or other software in memory and / or dedicated circuit systems.

[0223] A "multithreaded" computer system is one that supports multiple threads of execution. The term "thread" should be understood to include code that can or is subject to scheduling and possibly synchronization. Outside of the present disclosure, a thread may also be known by another name, such as a "task," "process," or "coroutine." However, a distinction is made herein between threads and processes, i.e., a thread defines an execution path within a process. Furthermore, the threads of a process share a given address space, while different processes have different corresponding address spaces. The threads of a process may run in parallel, sequentially, or in a combination of parallel and sequential execution (e.g., time slicing).

[0224] A "processor" is a thread processing unit, such as a core in a simultaneous multithreading implementation. A processor comprises hardware. A given chip may house one or more processors. Processors may be general purpose, or they may be customized for specific uses, such as vector processing, graphics processing, signal processing, floating point arithmetic processing, encryption, I / O processing, machine learning, etc.

[0225] The "kernel" includes the operating system, hypervisor, virtual machine, BIOS or UEFI code, and similar hardware interface software.

[0226] "Code" means processor instructions, data (which includes constants, variables, and data structures), or both instructions and data. "Code" and "software" are used interchangeably herein. Executable code, interpreted code, and firmware are some examples of code.

[0227] "Program" is used broadly herein and includes applications, kernels, drivers, interrupt handlers, firmware, state machines, libraries, and other code written by programmers (also called developers) and / or automatically generated.

[0228] A "routine" is a callable code segment that typically returns control to the instruction just after the point in program execution that called the routine. A distinction is sometimes made elsewhere between "functions" and "procedures," depending on the terminology used: functions typically return a value, while procedures do not. As used herein, a "routine" includes both functions and procedures. A routine may have code that returns a value (e.g., sin(x)), or it may simply return without providing a value (e.g., a void function).

[0229] "Service" means a consumable program offering in a cloud computing environment or other network or computing system environment that provides resources to multiple programs or provides access to resources to multiple programs, or both. The Service implementation itself may include multiple applications or other programs.

[0230] "Cloud" refers to pooled resources for computing, storage, and networking that are elastically available for measured, on-demand services. Clouds can be private, public, community, or hybrid, and cloud services can be provided as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), or another service. Unless otherwise specified, any discussion of reading from or writing to files includes reading / writing local files or reading / writing over a network, which can be a cloud network or other network, or both (local and networked read / write). A cloud may also be referred to as a "cloud environment" or a "cloud computing environment."

[0231] "Access" to a computing resource includes using permissions or other capabilities to read, modify, write, execute, move, delete, create, or otherwise exploit the resource. Attempted access may be explicitly distinguished from actual access, but "access" without the "attempt" qualifier includes both attempted access and access actually performed or provided.

[0232] As used herein, "comprising" allows for additional elements (ie, include means comprises) unless stated otherwise.

[0233] "Optimize" means to improve, but not necessarily to perfect. For example, a program or algorithm that has already been optimized can be further improved.

[0234] "Process" is sometimes used herein as a term in the field of computing science and in this technical sense encompasses a computing resource user, which may also include or be referred to as, for example, a coroutine, a thread, a task, an interrupt handler, an application process, a kernel process, a procedure, or an object method. In practice, a "process" is composed of a number of components such as Task Manager, ps or other similar utilities in an operating system environment (trademarks of Microsoft Corporation, Linus Torvalds, respectively). "Process" is also used herein as a patent law term, for example, to describe a process claim as opposed to a system claim or an article of manufacture (configured storage medium) claim. Similarly, "method" is sometimes used herein as a technical term in the field of computer science (a "routine") and also as a patent law field term (a "process"). The terms "process" and "method" in patent law are used interchangeably herein. Those skilled in the art will understand the intended meaning in a particular instance, and will also understand that a given claimed process or method (in the patent law sense) may sometimes be implemented using one or more processes or methods (in the computer science sense).

[0235] "Automatically" means using automation (e.g., general-purpose computing hardware configured by software for the specific operations and technical effects discussed herein), rather than not using automation. In particular, steps performed "automatically" are not performed by hand on paper or in a person's mind, although they may be initiated by a human or directed interactively by a human. Automatic steps are performed using a machine in order to obtain one or more technical effects that would not be achieved without the technical interaction provided thereby. Automatically performed steps are assumed to include at least one operation that is actively performed.

[0236] In this document, "activity" of a user refers to the activity of a user device or the activity of a user account, or the activity of software on behalf of a user, or the activity of hardware on behalf of a user. Activity is represented by digital data or machine operations, or both, in a computing system. "Activity" within the scope of any claim based on this disclosure excludes human actions per se. Therefore, software or hardware activity "on behalf of a user" refers to software or hardware activity on behalf of a user device or on behalf of a user account or on behalf of another computer mechanism or computing artifact, and therefore does not bring human behavior per se into the scope of any embodiment or any claim.

[0237] Those skilled in the art understand that the technical effect is the speculative purpose of the technical embodiment. For example, the fact that the calculations are only involved in the embodiment, and some calculations can also be performed without the technical components (e.g., by paper and pencil, or even as mental steps), does not eliminate the existence of the technical effect or change the specific and technical nature of the embodiment, especially in the implementation of the embodiment in the real world. Internal risk management operations such as obtaining 1132 access signals 312 and impact signals 320, calculating internal impact risks 214, detecting 518 cumulative exudation anomalies 520, automatically and actively changing 506 security group membership, and many other operations discussed herein are understood to be inherently digital. Even in the case of a hypothetical prototype, the human mind cannot directly interface with the CPU or other processor or with the RAM or other digital storage device to read and write the necessary data to perform the internal risk management steps 500 taught herein, let alone in the large-scale computing environment of the real world of the embodiment. Based on this disclosure, those skilled in the art will understand all of this well.

[0238] "Computationally" also means that a computing device (at least a processor plus memory) is being used, and excludes obtaining a result through human thought alone or through human action alone. For example, doing arithmetic with paper and pen is not computationally performing arithmetic as understood herein. Computational results are faster, broader, deeper, more accurate, more consistent, more comprehensive, and / or otherwise provide a technical effect that is beyond the scope of human performance alone. A "computational step" is a step that is computationally performed. Neither "automatically" nor "computationally" necessarily means "immediately." "Computationally" and "automatically" are used interchangeably herein.

[0239] "Actively" means without direct request from the user. In fact, the user may not even be aware that an active step of an embodiment is possible until the result of the step has been presented to the user. Unless otherwise stated, any calculation and / or automatic steps described herein may also be done actively.

[0240] “Based on” means at least based on, but not exclusively based on. Thus, a calculation based on X depends at least on X, and may also depend on Y.

[0241] Throughout this document, use of the optional plural "(s)" means that there are one or more of the indicated features. For example, "(s) processors" means "one or more processors" or equivalently "at least one processor".

[0242] "At least one" in a list of items means one of the items, or two of the items, or three of the items, etc., up to and including all N items, where the list is a list of N items. The presence of an item in the list does not require the item to exist (or an inspection for the item) in an embodiment. For example, if an embodiment of a system is described herein as including at least one of A, B, C, or D, a system that includes A but does not inspect B or C or D is an embodiment, and a system that includes A and also includes B but does not include or inspect C or D is also an embodiment. Similar understandings relate to items that are steps or step portions or options in a method embodiment. This is not a complete list of all possibilities; it is merely to help understand the scope of "at least one" contemplated herein.

[0243] For purposes of U.S. law and practice, the word "step" as used herein in a claim or elsewhere is not intended to invoke means-plus-function, step-plus-function, or 35 U.S.C. 112, sixth paragraph / 112(f) claim interpretation. Any assumption to that effect is hereby expressly re-interpreted.

[0244] For purposes of U.S. law and practice, claims are not intended to invoke a parts-plus-function interpretation unless they use the phrase “means for…” Claim language that is intended to be interpreted as parts-plus-function language (if any) will expressly recite that intent through the use of the phrase “means for…” When the parts-plus-function interpretation is applied, whether through the use of the claim language “means for…” and / or the legal construction of the court, the parts recited in the specification for a given noun or a given verb should be understood to be linked to the claim language and linked together herein by any of the following: appearance within the same block in a block diagram of the drawings, represented by the same or similar name, represented by the same figure number, a functional relationship depicted in any drawing, a functional relationship indicated in the present disclosure. For example, if a claim limitation recites a "zac widget" and that claim limitation becomes subject to a parts-plus-function interpretation, then all structure identified anywhere in at least any frame, paragraph, or example in the specification that mentions the "zac widget," or that is bound together by any figure markings assigned to the zac widget, or that is disclosed as having a functional relationship to the structure or operation of the zac widget, will be considered part of the structure identified in an application of the zac widget and will help define an equivalent set of zac widget structures.

[0245] Those skilled in the art will recognize that the present disclosure discusses various data values ​​and data structures, and recognizes that these items reside in memory (RAM, disk, etc.), thereby configuring the memory. Those skilled in the art will also recognize that the present disclosure discusses various algorithmic steps to be embodied in executable code in a given implementation, and that such code also resides in memory, and that it effectively configures any general purpose processor that executes it, thereby converting it from a general purpose processor to a special purpose processor as functionally specific hardware.

[0246] Therefore, one skilled in the art will not make the mistake of treating (a) the memory described in the claim and (b) the data structure or data value or code described in the claim as non-overlapping items. The data structures and data values ​​and the code are understood to reside in the memory even when the claim does not explicitly state the residency of each data structure or data value or the code segment mentioned. Therefore, an explicit statement of such residency is not required. However, they are not prohibited either, and there may be one or two optional references for emphasis, so as not to exclude all other data values ​​and data structures and codes from residency. Similarly, the code function stated in the claim is understood to configure the processor, regardless of whether the configuration quality is explicitly stated in the claim.

[0247] Throughout this document, unless explicitly stated otherwise, any reference to a step in a process assumes that the step may be performed directly by an interested party and / or performed indirectly by a party through intervening mechanisms and / or intervening entities and still be within the scope of that step. That is, steps do not require direct performance by an interested party unless direct performance is an explicitly stated requirement. For example, computational steps on behalf of an interested party, such as adding, adjusting, alerting, changing, applying, allocating, promoting, calculating, altering, checking, classifying, comparing, computing, controlling, counting, decoupling, exporting, detecting, displaying, adopting, exuding, expiring, extracting, feeding, filtering, generating, acquiring, grouping, identifying, applying, reasoning, keeping, finding or viewing, maintaining, modifying, marking, notifying, parsing, providing, receiving, removing, resetting, retrieving, saving, scoring, setting, showing, storing, tracking, training, adjusting, updating, utilizing (as well as adding, adding, adjustings, adjusting, etc.) for a destination or other subject matter may involve intervening actions, such as the aforementioned actions or such as forwarding, copying, uploading, downloading, encoding, decoding, compressing, decompressing, encrypting, decrypting, authenticating, calling, etc. by other parties or organizations, including any actions recited in this document, but are still understood to be performed directly or on behalf of the interested party.

[0248] For example, whenever reference is made to data or instructions, it should be understood that these items configure computer-readable memory and / or computer-readable storage media, thereby converting them into specific items, rather than simply existing on paper, in a person's mind, or as signals propagating on wires. For the purposes of U.S. patent protection, memory or other computer-readable storage media is not a propagating signal or carrier wave or merely energy outside the scope of patentable subject matter under the U.S. Patent and Trademark Office (USPTO) interpretation of the In re Nuijten case. In the United States, no claim claims to cover the signal itself or merely energy, and any claim interpretation to the contrary is unreasonable on its face in light of the present disclosure. Unless otherwise expressly stated in a claim granted outside the United States, the claim does not cover the signal itself or merely energy.

[0249] Furthermore, despite apparent contrary statements elsewhere herein, it should be understood that a clear distinction is made between (a) computer-readable storage media and computer-readable memory on the one hand and (b) transmission media (also called signal media) on the other hand. Transmission media are propagating signal or carrier wave computer-readable media. In contrast, computer-readable storage media and computer-readable memory are not propagating signal or carrier wave computer-readable media. Unless otherwise expressly stated in the claims, "computer-readable medium" means computer-readable storage media, not propagating signals per se or merely energy.

[0250] The "embodiments" herein are examples. The term "embodiments" is not interchangeable with "the invention." An embodiment may freely share or borrow aspects to create other embodiments (assuming the result is operable), even if the resulting combination of aspects is not itself explicitly described herein. Requiring that every permitted combination be explicitly and individually described is unnecessary for one skilled in the art and would be contrary to the strategy of recognizing that patent specifications are written for those skilled in the art. Both formal combinatorial calculations and informal common sense about the number of possible combinations resulting from even a small number of combinable features would indicate that there are a large number of combinations of aspects for the aspects described herein. Therefore, requiring that every combination be explicitly listed would be contrary to the strategy of requiring that patent specifications be concise and that the reader be equipped with an indication of the relevant technical field. Reference numerals list

[0251] The following list is provided for the convenience and support of the drawings and as part of the specification text, which describes the innovation by reference to a number of items. Items not listed here may still be part of a given embodiment. For better readability of the text, some but not all references to items in the text are described near the given reference numerals. The same reference numerals may be used to refer to different examples or different instances of a given item. The list of reference numerals is: 100 operating environment, also called computing environment; includes one or more systems 102 101 A machine in system 102, for example, any device having at least processor 110 and memory 112 and also having a different identifier (such as an IP address or a MAC (Media Access Control) address); it can be a physical machine or a virtual machine 102 implemented on physical hardware. Computer system, also called "computational system" or "computing system", and when in a network, can be called a "node" 104 User, such as a user of the enhancement system 202; unless otherwise specified, a human being or an online identity of a human being 106 Peripheral devices 108 Networks typically include, for example, LANs, WANs, software-defined networks, clouds, and other wired or wireless networks. 110 processors; including hardware 112 Computer-readable storage media, such as RAM, hard disk 114 Removable configured computer readable storage medium 116 Instructions executable by a processor; may be on a removable storage medium or in other memory (volatile or non-volatile or both) 118 digital data in system 102; data structures, values, mappings, software, tokens, and other examples are discussed herein; "digital data" refers to data in a computing system, as opposed to data written on paper or in a person's mind, for example 120(s) kernel, such as(s) operating system, BIOS, UEFI, device drivers 122 tools and applications, such as version control systems, network security tools, software development tools, office productivity tools, social media tools, diagnostics, browsers, games, email and other communication tools, commands, etc. 124 User interface; hardware and software 126Display screen, also called "monitor" 128 computing hardware not associated with reference numerals 106, 108, 110, 112, 114 130 Privileges or permissions in a computing system; may be digital or computational or both 132 Resources in system 102, e.g., data, software, hardware, or a combination thereof; "data resources" include data 118, and may include data that is not software, data that is software, or data objects that represent hardware; some example resources include a virtual machine, an individual file or storage block, a group of files (e.g., a folder or directory subtree), and a storage account, but many other resources exist in many systems 102 134 A role regarding access in a computing system, such as network administrator or global administrator; can be digital or computational or both 136 Cloud, also known as cloud environment or cloud computing environment 202 management computing system, i.e., system 102 enhanced with internal risk management functionality 210 204 Insiders, such as employees, officers, trustees, fiduciaries, or other persons or entities authorized by the organization to have greater or different access to organizational resources than the public 206 Insider risk, such as a quantitative assessment of the chance or likelihood or probability of some unexpected or unauthorized (or both) event or omission caused by an insider 208 Internal risk management, for example, identifying possible sources of security risks within the organization, identifying possible sequences of events and other aspects of risk scenarios involving such sources, assessing the potential impact of accidental or intentional damage in such scenarios, and developing tools and techniques to identify, assess, simulate, reduce, prevent, mitigate, investigate or document such scenarios 210 functionality for internal risk management as taught herein; for example, software or dedicated hardware that performs or is configured to perform steps 502 and 504, or any software or hardware that performs or is configured to perform the method 500 first disclosed herein or to perform computational internal risk management activities 212 The impact of the activity on the system or system resources, assumed to be unwanted or harmful 214 The risk of impact, i.e., the quantified risk of impact 212 216 managed system 102, i.e., a system whose resources are protected by internal risk management function 210; object or target of activity of beneficial function 210 302 Internal risk management software, e.g., software 304 that provides functionality 210 Network security features, e.g., the existence of security groups 322, membership in security groups 322, behavior of security controls 420, behavior of security tools 122, behavior of security detection mechanisms 408, 404, 122, behavior of security models 526, privileges 130 themselves or the association of users with privileges 130, roles 134 themselves or the association of users with roles 134, sensitivity labels 416 themselves or the association of resources with sensitivity labels 416, or sensitivity types 418 themselves or the association of resources with sensitivity types 418 306 access to resource 132; including the use of "access" in the examples herein and also including the explicit definition of "access" in this document; 308 access pillars, digital or calculated, and as represented in a computing system; digital 310 generally pillars; digital 312 access signals, used for computing pillars; digital 314 generally pillar signals; digital 316 impact; including the use of "impact" in the examples herein; digital or calculated, and as represented in a computing system; "impact" of a user means the result of an activity in a computing system by a user device, a user account, software on behalf of a user, or hardware on behalf of a user, or the result of an activity in a computing system by a user device, a user account, software on behalf of a user, or hardware on behalf of a user other conditions; the impact is represented by digital data or machine operation or both; the impact or any other pillar value or any pillar signal based on the disclosure within the scope of any claim excludes human action itself; therefore, calculating the impact risk of a user means calculating the impact risk of software or hardware activities representing the user, which is affected by human action itself excluded from the scope of any embodiment or any claim, as indicated in the definition of "representative" herein 318 impact pillar; digital 320 impact signal, used to calculate the pillar; digital 322 security group, as represented in the computing system 324 weighted combination of digital values, as represented in the computing system 326 Explanation of calculation results; number 328 explains the reason in 326; number 330 is generally an interface; in the context, it also refers to a specific interface, such as user interface 124, web API, etc. 332 weight in weighted combination 324; numeric value 402 Potential High Impact Users (PHIU) represented in the computing system 404 User peer group represented in the computing system 406 Exfiltration occurring in or indicated in a computing system 408 PHIU detection results or activities or mechanisms in computing systems 410 Unauthorized activity occurring or indicated in a computing system 412 Authorized activity occurring in or represented in a computing system 414CEAD detection results or activities or mechanisms in computing systems 416 Sensitivity Labels in Computing Systems 418 Types of Sensitivity in Computing Systems 420 Security Controls in Computing Systems Risk score booster in 422 computing system 424 Organization 426 Calculate the risk-related scores in the system 428 Alarms in the computing system 430 Alarm thresholds or other security-related thresholds in computing systems 432 Insights in Computing Systems 500 flow chart; 500 also involves the attached Figure 5 The flowchart shows or is attached Figure 5 process Figure 1 consistent internal risk management approach; Figure 5 The "Any other steps taught in the text or figures" step at the bottom is incorporated into Figures 6 to 11 Flowchart 502 computationally determine (also called calculate) the impact risk 214; "computationally" means performed in a computing system, not mentally or on paper 504 Computationally adjust network security features in response to the impact risk 506 Computationally change security group membership, for example, by adding members, removing members, creating a security group, or disabling or deleting a security group 508 computationally modifies the behavior of a security control (current or expected or both), for example, by changing a threshold or frequency or intensity or other setting, or by enabling or disabling or adding or removing a control 510 computationally calculates a pillar 310 (also referred to as a pillar value) 512 Computationally Calculate Weighted Combinations 324 514 Computerically displaying the PHIU designation 408, such as on the display 126 or via other electronic to human communication 516 Computationally display interpretation 326, such as on display 126 or via other electronic to human communication 518 Computationally detect leakage anomaly 520 Exudation anomalies occurring in or represented in the computing system 522 Comparison of user activity to user peer group activity either directly or computationally by comparing statistics such as means, medians, etc. 524 Computationally train statistical models or machine learning models or both 526 Statistical models or machine learning models or both 528 Computationally control an account, such as by allowing or preventing access or by modifying permissions associated with the account, or both 530 computationally controls the detectors for PHIU detection 408 or CEAD detection 414 or both 532 Accounts in the Computing System 534 A computing detector in a computing system for PHIU detection 408 or CEAD detection 414 or both 536 computationally improves (upward or downward, but assumes upward) a risk score in a computing system 538 computationally changes a risk-related score threshold in a computing system 540 any step or item discussed in this disclosure that is not assigned some other reference number; thus, 540 may be explicitly shown as a reference number for various steps or items, or both, and may be added as a reference number for various steps or items, or both (in this disclosure or any subsequent patent application claiming priority to this disclosure) without adding new content 542 computationally adjusts the system 202 to an available or preferred data source, or both, such as by changing the weights 332 600 flow chart; 600 also involves Figure 6 The flowchart shows or Figure 6 process Figure 1 Internal risk management approach 700 flow chart; 700 also involves Figure 7 The flowchart shows or Figure 7 process Figure 1 Internal risk management approach 800 flow chart; 800 also involves Figure 8 The flowchart shows or Figure 8 process Figure 1 Internal risk management approach 900 flow chart; 900 also involves Fig. 9 The flowchart shows or Fig. 9 process Figure 1 Internal risk management approach 1000 flow chart; 1000 also involves Fig.10 The flowchart shows or Fig.10 process Figure 1 Internal risk management approach 1002 Computationally apply or utilize role-based access control 1004 computationally marking impact designations in or into a data structure 1006 computationally filtering users (eg, accounts) based on ranges 1008 Calculate the lift in the ground filtration system 202 1010 computationally filtering the activities represented in system 202 1012 calculates the score in the ground filtering system 202 1014 Computational Filtering System 102 Insight 432 1016 In the system 202, the continuous impact 214 is calculated to specify 1018 Computationally add value to shock risk calculation 1020 Calculate and obtain the pillar or pillar signal base weight 1022 computationally classifying a pillar or pillar signal as variable weight or fixed weight 1024 calculates the pillar or pillar signal strength 1026 Computationally set the pillar or pillar signal base weight 1028 Computationally store pillar or pillar signal weight residual values 1030 computationally calculating the pillar or pillar signal reliability strength 1032 Computationally calculate pillar or pillar signal weights 1034 Computational Reasoning Access 306 1036 Computational Reasoning Organizational Power 316 1038 Computationally displaying a message or otherwise notifying an entity 1040 Computational Security Review 1042 Computational maintenance lift 422 1044 Computationally labeled security group 322 data structure 1046 Computationally display security group 322 data structure 1048 computationally derived pillar or pillar signal 1050 Insights 432 in Computational Processing System 202 1052 computationally expires the impact 214 specified in the system 102 1054 computationally resets the system 102 in the shock 214 specified 1058 The value used in the calculation of shock risk 1100 flow chart; 1100 also involves Fig.11 The flowchart shows or Fig.11 process Figure 1 Internal risk management approach 1102 Computationally utilizing feedback 1104 1104 feedback, as represented by 1106 in system 202, the explosion radius data is calculated 1108 Computationally Aggregate Access Data 1110 Computationally extract access data 1112 Computationally Grouped Access Data 1114 Computationally Calculate Exudation Statistics 1116 Computationally calculate the exudate fraction 1118 computationally removes a site or other resource from access 306 computationally 1120 computationally generates peer group 404 1122 computationally generate peer group 404 statistics 1124 Computationally decoupling potential shocks from actual shocks 1126 Computationally generated alert 428 1128 computationally adjusts the embodiment, for example, by changing the weights 332, thresholds 430, or algorithms (e.g., which signals 314 or which pillars 310 or both) are used in response to the absence or presence or strength of available data or in response to user preferences expressed in the system 202 1130 Calculated use of guardrail 1132 Calculate the pillar value or pillar signal value 1202 Public visibility of the user, as represented in system 202 1204 Social network influence of the user, as represented in system 202 1206 Risk of damaging the brand, as represented in system 202 1208 Mission criticality of the resource, as represented in system 202 1210 User access request 306, as represented in system 202 1212 Speed ​​of response to request 1210, as represented in system 202 1214 Authorization rate of request 1210, as represented in system 202 1216 History of (multiple) attacks against the user, as represented in system 202 1218 Location or title or role of the user, as represented in system 202 1220 Count of people who reported to the user, as represented in system 202 Conclusion

[0252] Some embodiments help manage network security internal risk 206. The authorized user impact pillar value 318 is based on one or more impact signals 320 representing the actual or potential impact 316 of a user in the computing environment 100. The authorized user access pillar value 308 is based on one or more access signals 312 representing the actual or potential access 306 of a user to a resource 132. The impact risk value 214 is calculated 502 as a non-weighted or weighted combination 324 (depending on the embodiment) of the pillar values ​​310. In response to the impact risk 214, an embodiment automatically adjusts 504 a network security characteristic 304, such as a security risk score 426, security group 322 membership, threat detection mechanism 420, or alert threshold 430. In some cases, the impact risk 214 is also based on the access signal 312 of the cumulative potential exfiltration anomaly 520. In some cases, impact risk 214 is based on one or more values ​​representing user public visibility 1202 , user social network influence 1204 , brand damage risk 1206 , resource mission criticality 1208 , access request response speed 1212 or success rate 1214 , or known network security attacks 1216 .

[0253] Some embodiments automatically calculate 502 the impact risk 214 of authorized users of a managed computing system 216, and adjust 504 the network security features 304 of the managed computing system 216 based at least on the impact risk 214. This advantageously helps security teams and security controls 420 prioritize insider risk prevention, alert review, investigation, and response activities to reduce or prevent damage from data leaks, data theft, sabotage, negative workplace culture activities, etc. Security teams and security controls are often resource-constrained, so it is advantageous to focus their efforts first on the highest-impact threats to protect the organization.

[0254] Some embodiments automatically display a human-readable explanation 326 of the calculation basis 328 utilized in calculating 502 the impact risk 214. This advantageously informs security personnel, administrators, and others how the user matches or does not match the criteria for being designated as a PHIU 402. The explanation enhances the usefulness of security controls and impact risk, and in some cases leads to improvements in PHIU criteria.

[0255] In some embodiments, automatically calculating 502 shock risk includes calculating 512 a weighted combination 324 where pillar values ​​310 have different weights 324. This advantageously allows the management system 202 or risk management software 302 to be adjusted 542 based on data availability or customer preferences or both.

[0256] Embodiments are understood to inherently also include or benefit from tested and appropriate security controls and privacy controls, such as the General Data Protection Regulation (GDPR). The use of the tools and techniques taught herein is compatible with the use of such controls.

[0257] Although Microsoft technologies are used in some motivational examples, the teachings herein are not limited to use in technologies provided or managed by Microsoft. For example, under appropriate licenses, the teachings herein can be embodied in software or services provided by other cloud service providers.

[0258] Although specific embodiments are explicitly shown and described herein as processes, configured storage media, or systems, it should be understood that the discussion of one type of embodiment generally also extends to other types of embodiments. For example, the description of the process in conjunction with the accompanying drawings also helps to describe the configured storage medium, and helps to describe the technical effects and operations of the system and manufacturer as discussed in conjunction with other drawings. Any limitations from one embodiment do not necessarily follow to be read into another embodiment. In particular, the process is not necessarily limited to the data structures and arrangements presented when discussing systems or manufacturers such as configured storage.

[0259] Those skilled in the art will appreciate that implementation details may involve specific code, such as specific thresholds, comparisons, specific kinds of platforms or programming languages ​​or architectures, specific scripts or other tasks, and specific computing environments, and therefore need not appear in every embodiment. Those skilled in the art will also appreciate that program identifiers and some other terms used when discussing the details are implementation-specific and therefore need not relate to every embodiment. Nevertheless, while they do not necessarily need to be present here, such details may help some readers by providing context and / or may illustrate some of the many possible implementations of the technology discussed herein.

[0260] Note that the items provided herein, including technical processes, technical effects, technical mechanisms, and technical details of all claimed or assertable embodiments are illustrative but not comprehensive, and those skilled in the art will understand that the present disclosure and the embodiments described herein do not relate to subject matter outside the technical field, or any ideas of their own, such as the main or original cause or motivation, or only the result itself, or mental processes or mental steps, or business methods or general economic practices, or only methods of organizing human activities, or natural laws themselves, or naturally occurring things or processes, or living things or parts of living things, or mathematical formulas themselves, or isolated software themselves, or only conventional computers, or any completely imperceptible or any abstract concept itself, or unimportant post-solution activities, or any method implemented entirely on an unspecified device, or any method that cannot produce useful and specific results, or any preemption of all fields of use, or to any other subject matter that is not suitable for patent protection under the laws of the jurisdiction in which such protection is sought or granted or enforced.

[0261] References herein to an embodiment having some feature X and references elsewhere herein to an embodiment having some feature Y do not exclude embodiments in the present disclosure having both feature X and feature Y, unless such exclusion is expressly stated herein. All possible negative claim limitations are within the scope of the present disclosure, in the sense that any feature stated as part of an embodiment may be removed from inclusion in another embodiment even if no specific exclusion is given in any example herein. The term "embodiment" is used herein merely as a more convenient form of "process, system, article, configured computer-readable storage medium, and / or other examples taught herein are applied in a manner consistent with applicable law." Thus, a given "embodiment" may include any combination of the features disclosed herein, provided that the embodiment is consistent with at least one claim.

[0262] Not every item shown in the figure needs to be present in each embodiment. On the contrary, the embodiment may include (multiple) items not explicitly shown in the figure. Although some possibilities are shown in text and drawings by specific examples here, the embodiment may be separated from these examples. For example, the specific technical effects or technical features of the examples may be omitted, renamed, grouped differently, repeated, instantiated differently in hardware and / or software, or a mixture of effects or features that appear in two or more examples. In some embodiments, the functions shown in one place can also be provided at different locations; those skilled in the art recognize that functional modules can be defined in various ways in a given implementation without omitting the desired technical effects from the set of interactive modules that are considered as a whole. Due to space limitations or for convenience, different steps can be shown together in a single frame in the figure, but are still executable separately, for example, one can be executed without executing another in a given execution of the method.

[0263] Reference has been made to the drawings by reference numerals. Any apparent inconsistency in the wording associated with a given reference numeral in the drawings or in the text should be understood to simply widen the scope of reference by that reference numeral. Different instances of a given reference numeral may refer to different embodiments, even if the same reference numeral is used. Similarly, a given reference numeral may be used to refer to a verb, a noun, and / or a corresponding instance of each, e.g., a processor 110 may process 110 instructions by executing the instructions.

[0264] As used herein, terms such as "a," "an," and "the" include one or more of the indicated items or steps. In particular, in the claims, reference to an item generally means that there is at least one such item, and reference to a step means that at least one instance of the step is performed. Similarly, "is" and other singular verb forms should be understood to encompass the possibility of "are" and other plural forms when the context permits, so as to avoid grammatical errors or misunderstandings.

[0265] Headings are for convenience only; information about a given topic may be found outside the section whose title indicates that topic.

[0266] All claims and the abstract as filed are part of the specification. The abstract is provided for convenience and to comply with patent office requirements; it is not a substitute for the claims and does not control over claim interpretation in the event of any apparent conflict with the rest of the specification. Similarly, the summary is provided for convenience and does not control over claim interpretation in the event of any conflict with the claims or the rest of the specification. Claim interpretation should be made in light of the description as understood by those skilled in the art; an innovator does not need to recite every nuance within the claims themselves, as if no other disclosure were provided herein.

[0267] To the extent that any term used herein implies or otherwise refers to an industry standard, and to the extent applicable law requires identification of a specific version of such a standard, this disclosure should be understood to refer to the latest version of that standard that has been published in at least draft form (final form takes precedence, if more recent) under applicable patent law as of the earliest priority date of this disclosure.

[0268] Although exemplary embodiments have been shown in the drawings and described above, it is apparent to those skilled in the art that many modifications may be made without departing from the principles and concepts set forth in the claims, and that such modifications do not need to encompass the entire abstract concept. Although the subject matter is described in language specific to structural features and / or process actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific technical features or actions described in the above claims. Each component or aspect or technical effect identified in a given definition or example does not necessarily exist or is utilized in every embodiment. Instead, the specific features and actions and effects described are disclosed as examples to be considered when implementing the claims.

[0269] All changes that come within the meaning and range of equivalency of the claims and that fall outside the abstract concept are intended to be embraced to the extent permitted by law.< / value>

Claims

1. A method for internal network security risk management performed by a computing system for an authorized user, the method comprising: automatically calculating an access pillar value based on at least one access signal, the access pillar value representing an access authorization of the authorized user that authorizes access to computing system resources; automatically calculating an influence pillar value based on at least one influence signal, the influence pillar value representing a degree of influence of the authorized user; automatically calculating a shock risk based at least on the pillar values; and A network security characteristic is automatically adjusted based at least on the impact risk.

2. The method of claim 1, wherein the access signal indicates at least one of the following: a count of computing system resources accessed by the authorized user; a count of computing system resources that the authorized user is authorized to access; a count of computing system resources of a specified sensitivity that have been accessed by the authorized user; or A count of computing system resources of a specified sensitivity that the authorized user is authorized to access.

3. The method according to claim 1, wherein the influence signal indicates at least one of the following: the position of the authorized user within the organization's hierarchy; The authorized user's title or role within the organization; A count of the people within the organization who report to the Authorized User; or The authorized user's administrative role within the computing environment.

4. The method according to claim 1, further characterized in that At least one of the following: Automatically calculating the access pillar value comprises: calculating a weighted combination in which at least two access signals have different respective weights; or Automatically calculating the impact pillar value includes: calculating a weighted combination in which at least two impact signals have different respective weights; Automatically calculating the shock risk includes: calculating a weighted combination in which the pillar values ​​have different corresponding weights.

5. The method of claim 1, wherein the shock risk is also automatically calculated based on an additional pillar value, the additional pillar value representing at least one of the following: a speed of response to access requests for requests by said authorized users to access computing system resources; a success rate of the authorized users receiving access to computing system resources; the authorized user's membership in a computing system security group; Network security attacks against said authorized users; exfiltration activities of said authorized users; Public visibility of said authorized users; measurement of the influence of the authorized user on the social network; risk of damage to the organization’s brand; or The mission criticality of the computing system resources accessible to the authorized users.

6. The method according to claim 1, further comprising: A human-readable explanation of the calculation basis utilized in calculating the shock risk is automatically displayed.

7. The method of claim 1, wherein automatically adjusting network security characteristics based at least on the impact risk comprises at least one of the following: Automatically elevate risk scores in cybersecurity tools with alerting capabilities; Automatically disable, automatically suspend, or automatically delete accounts in computing environments; automatically changing membership of the authorized user in a computing system security group; Automatically enable specific security threat detection mechanisms; Automatically disable specific security threat detection mechanisms; Automatically change specific security alert thresholds; or A machine learning model is trained using training data, wherein at least a quarter of the training data, measured by data size or training data example count, or both, includes impact signals, access signals, pillar values, or impact risks.

8. The method of claim 1, wherein automatically calculating the impact risk is further based on at least a cumulative potential exfiltration abnormal access signal, the cumulative potential exfiltration abnormal access signal representing detection of abnormal cumulative potential exfiltration of data by the authorized user.

9. The method according to claim 8, further comprising: The abnormal cumulative potential exfiltration of data by the authorized user is detected at least in part by comparing the potential exfiltration activity of the authorized user to first activity of a first peer group of the authorized user and to second activity of a second peer group of the authorized user.

10. The method according to claim 1, further comprising: The weighted combination is calculated based on at least an average risk score for a signal or a strut and a distance from the average risk score.

11. The method according to claim 1, further comprising: Imposing role-based access controls on requests to view impact risks.

12. The method according to claim 1, further comprising: The authorized user is marked with a potential high impact user designation based on the impact risk exceeding a designated threshold, and the designation is maintained after the impact risk falls below the designated threshold.

13. An internal risk management computing system configured to manage internal risk of a managed computing system including resources, the internal risk management computing system comprising: digital storage, at least a portion of which is external to the managed computing system; a processor in operable communication with the digital memory, the processor configured to perform internal risk management operations, the internal risk management operations comprising: automatically calculating an impact risk for authorized users of the managed computing system, and automatically adjusting network security characteristics of the managed computing system based at least on the impact risk; wherein the authorized user of the managed computing system includes at least one of: a user device within the managed computing system, a user account within the managed computing system, a computing mechanism within the managed computing system, or a computing artifact within the managed computing system; The impact risk includes a numerical value representing the impact of the unauthorized activities of the authorized user or the future unauthorized activities of the authorized user, or both, and the impact risk is calculated based on at least an authorized user access pillar value and an authorized user influence pillar value, wherein the authorized user impact pillar value represents the degree of influence of the authorized user within the managed computing system or within the organization utilizing the managed computing system, or both, and the authorized user access pillar value represents the degree of authorized access of the authorized user to the resources of the managed computing system.

14. The internal risk management computing system of claim 13 in combination with the managed computing system.

15. The combined internal risk management computing system and managed computing system of claim 14, wherein the managed computing system includes security controls and security groups, the security controls being applied differently to users who are members of the security groups and users who are not members of the security groups, and the adjustment comprises at least one of: changing user membership of the security group based at least on the impact risk, or modifying the application of the security control to at least one user based at least on the impact risk.

Images