Context-Based Security Risk Mitigation on Computing Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems struggle to effectively manage and mitigate security risks in real-time, particularly in dynamic network environments, where user privileges and device configurations can change frequently.
Innovation Solution
The system employs a processor-based apparatus that receives risk assessment rules, including user privilege criteria and device criteria, to identify user-specific security risks. It applies privilege mitigation measures without relying on a management server, updating these measures based on new risk assessment rules detected during subsequent login events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system continuously communicates with a management server to update risk assessment rules, then the security management reliability is improved, but the device complexity and network dependency increase
Solution Approach 1:
The system divides security management functionality into two segments: risk assessment rule updates are received from a management server, while the actual security policy enforcement and mitigation measures are executed locally on the computing device. This segmentation allows the device to operate independently while still receiving guidance from external sources.
Solution Approach 2:
The computing device receives and stores risk assessment rules in advance from the management server before actual security incidents occur. These pre-loaded rules enable the device to immediately apply appropriate mitigation measures when security risks are detected, without needing to communicate with the server during critical security events.
2Reliability
If the system applies strict security mitigation measures, then the security risk is reduced, but the ease of operation and user productivity deteriorate
Solution Approach 1:
The system applies different privilege mitigation measures to different users based on their specific risk profiles, device configurations, and access patterns. Instead of uniformly restricting all users, the system tailors security measures to individual contexts, such as applying stricter controls to high-risk users while maintaining easier access for low-risk users.
Solution Approach 2:
The privilege mitigation measures are dynamically adjusted based on current security risks, user behavior, and device state. The system can escalate or de-escalate security measures in real-time, transitioning from permissive to restrictive modes as conditions change, rather than maintaining static security policies.
3Speed
If the system monitors and updates security rules in real-time, then the security responsiveness is improved, but the energy consumption and processing load increase
Solution Approach 1:
The system updates risk assessment rules periodically or at scheduled intervals rather than continuously monitoring and updating in real-time. The computing device receives updated rules at predetermined times or when triggered by specific events, reducing the constant processing load while maintaining adequate security responsiveness.
Solution Approach 2:
The computing device autonomously evaluates security risks and applies mitigation measures using locally stored rules without requiring constant external verification or updates. The device serves itself by making independent security decisions based on pre-received guidance, reducing the energy and processing requirements of continuous network communication.
Data Source
AI summary
An apparatus includes a processor operatively coupled to a memory. The processor receives a first set of risk assessment rules including first user privilege criteria and first device criteria. The first device criteria include a computing device patch level, a network type, and/or a password policy. The processor identifies a user-specific security risk based on the first set of risk assessment rules and applies a privilege mitigation measure based on the user-specific security risk without being in communication with a management server. The processor later receives a second, updated set of risk assessment rules at the computing device. Upon detecting another login of the user, the processor identifies an updated user-specific security risk based on the updated set of risk assessment rules, and applies a modified privilege mitigation measure based on the updated user-specific security risk, again without being in communication with the management server.