Proactive Security Risk Assessment via User Interaction Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security risk assessment systems in computing networks are not preventative and fail to detect potential security risks proactively, only assessing risks after they have occurred, which can pose significant threats to employers due to employee unawareness of security risks such as insecure passwords or phishing attacks.
Innovation Solution
A system and method that assesses security risks by generating interaction items for training, obtaining sensed data from user interactions, and comparing it to security risk scoring metrics to calculate a security risk score, using a database and processors to analyze user behavior and technical data, and transmitting the score for display and management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current security risk assessment systems are used, then security risks are assessed after they occur, but they fail to detect potential security risks proactively
Solution Approach 1:
The system performs preliminary actions by proactively presenting security scenarios and interaction items to users before actual security incidents occur. It assesses user behavior, security knowledge, and risk factors in advance, calculating security risk scores before threats materialize, thereby preventing security breaches rather than merely detecting them after occurrence.
2Reliability
If proactive security risk assessment is implemented, then potential threats are detected before occurrence, but system complexity increases
Solution Approach 1:
The security risk assessment system is segmented into distinct functional modules: a presentation module that delivers security scenarios, a data collection module that gathers user interactions, a calculation module that computes risk scores using multiple factors (user behavior, security knowledge, device security, network security), and a reporting module that delivers assessments. This modular segmentation manages system complexity while enabling comprehensive proactive security evaluation.
3Measurement precision
If comprehensive user behavior analysis is performed, then accurate security risk scores are calculated, but data processing requirements increase
Solution Approach 1:
The system extracts and focuses on the most critical security risk factors from extensive user behavior data, such as security knowledge test results, phishing scenario responses, device security configurations, and network security practices. By selectively analyzing only the most relevant data elements rather than processing all possible user actions, the system achieves accurate risk scoring while minimizing data processing energy consumption.
Data Source
AI summary
Various embodiments assess security risks of users in computing networks. In some embodiments, an interaction item is sent to an end user electronic device. When the end user interacts with the interaction item, the system collects feedback data that includes information about the user's interaction with the interaction item, as well as technical information about the electronic device. The feedback is compared to a plurality of security risk scoring metrics. Based on this comparison, a security risk score for the user with respect to a computing network.