Method and system for analyzing risk

Abstract

The present invention provides a method, system and computer program product for analyzing risks, for example associated with potential data leakage. Risk for activities may be measured as a function of risk components related to: persons involved in the activity; sensitivity of data at risk; endpoint receiving data at risk; and type the activity. Risk may account for the probability of a leakage event given an activity as well as a risk cost which reflects the above risk components. Manually and/or automatically tuned parameters may be used to affect the risk calculation. Risk associated with persons and/or files may be obtained by: initializing risk scores of persons or files based on a rule set; adjusting the risk scores in response to ongoing monitoring of events; identifying commonalities across persons or files; and propagating risk scores based on the commonalities.

1 . A method for determining a risk associated with a behavioral activity regarding digital data files to cause an undesired event such as data loss or data leakage a secure data environment, the method comprising:
 a) monitoring ongoing transactions within the digital data files;   b) obtaining one or more probabilities, each probability associated with a respective potential undesired event associated with the digital data files and each probability being a conditional probability given the behavioral activity;   c) adjusting each of said probabilities by multiplication with a respective probability weighting factor;
 for each potential undesired event associated with the digital data files, obtaining one or more entity costs, each entity cost representative of a contribution to said risk associated with a given type of entity associated with the behavioral activity; 
   d) for each potential undesired event associated with the digitial data files, determining a resultant cost as a function of said entity costs; and   e) measuring the risk as an expectation over the one or more resultant costs distributed over the associated probabilities of potential undesired events associated with the digital data files or acting to mitigate the risk.   
     
     
         2 . The method according to  claim 1 , wherein a single nonzero event risk value is determined and a single corresponding conditional probability of said undesired event associated with the digital data files given the behavioral activity is obtained. 
     
     
         3 . The method according to  claim 1 , wherein the probability weighting factor is associated with one or both of the behavioral activity and the indesired event associated with the digital data files corresponding to the conditional probability being adjusted by multiplication with said probability weighting factor. 
     
     
         4 . (canceled) 
     
     
         5 . The method according to  claim 1 , wherein the function of entity costs associated with said undesired event associated with the digital data files is a weighted or an unweighted average of entity costs associated with said undesired event associated with the digital data files. 
     
     
         6 . The method according to  claim 1 , wherein an average of said entity costs is a weighted average, and wherein each weighting factor associated with the weighted average is bounded between zero and one, inclusive. 
     
     
         7 . The method according to  claim 1 , wherein said probability weighting factor is defined automatically, defined via user input, or a combination thereof. 
     
     
         8 . The method according to  claim 1 , wherein the given type of entity corresponds to a set of persons interacting with data to potentially be leaked, an asset comprising said data to potentially be leaked, and an endpoint to which said data to potentially be leaked is transferred. 
     
     
         9 . The method according to  claim 1 , wherein determining at least one of the entity costs comprises:
 a) obtaining a set of entities of the given type of entity, each of said set of entities associated with the behavioral activity;   b) obtaining a set of sub-costs, each sub-cost associated with a member of the set of entities; and   c) determining a weighted sum of the set of sub-costs.   
     
     
         10 . The method according to  claim 9 , wherein each sub-cost is weighted by a weighting factor equal to 2 −i , where in i corresponds to the ordinal position of said sub-cost relative to the set of sub-costs when the set of sub-costs is sorted in order of descending value. 
     
     
         11 . A computer program product comprising a non-transitory computer readable memory storing computer executable instructions for a method for determining a risk associated with a behavioral activity regarding digital data files to cause an undesired event such as data loss or data leakage of the digital data tiles within a secure data environment thereon that when executed by a processor, cause the processor to:
 a) monitor ongoing transactions with the digital data files:   b) obtain one or more probabilities, each probability associated with a respective potential undesired event associated with the digital data files and each probability being a conditional probability given the behavioral activity;   c) adjust each of said probabilities by multiplication with a respective probability weighing factor   d) for each potential undesired event associated with the digital data tiles. obtain one or more entity costs, each entity cost representative of a contribution to said risk associated with a given type of entity associated with the behavioral activity:   e) for each potential undesired event associated with the digital data files. determine a resultant cost as a function of said entity costs: and measure the risk as an expectation over the one or more resultant costs distributed over the associated probabilities of potential undesired events associated with the digital data files or acting to mitigate the risk.   
     
     
         12 . A system for determining as risk associated with a behavioral activity regarding digital data files to cause art undesired event such as a data loss or data leakage of the digital data files within a secure data environment, the system comprising;
 a processor; and   a non-transitory computer readable storage medium having executable instructions thereon that when executed by the processor, cause the processor to:   a) monitor ongoing transactions with the digital data files;   b) obtain one or more probabilities, each probability associated with a respective potential undesired event associated with the digital data files and each probability being a conditional probability given the behavioral activity;   c) adjust each of said probabilities by multiplication with a respective probability weighting factor:   d) for each potential undesired event associated with the digital data files, obtain one or more entity costs, each entity cost representative of a contribution to said risk associated with a given type of entity associated with the behavioral activity.   e) for each potential undesired event associated with the digital data files, determine a resultant cost as a function of said entity costs; and   f) measure the risk as an expectation over the one or more resultant costs distributed over the associated probabilities of potential undesired events associated with the digital data files or acting to mitigate the risk.   
     
     
         13 . The computer program product according to  claim 11 , wherein a single nonzero event risk value is determined and a single corresponding conditional probability of said undesired event associated with the digital data files given the behavioral activity is obtained. 
     
     
         14 . The computer program product according to  claim 11 , wherein the probability weighting factor is associated with one or both of the behavioral activity and the undesired event associated with the digital data files corresponding to the conditional probability being adjusted by multiplication with said probability weighting factor. 
     
     
         15 . The computer program product according to  claim 11 , wherein the function of entity costs associated with said undesired event associated with the digital data files is a weighted or an unweighted average of entity costs associated with said undesired event associated with the digital data files. 
     
     
         16 . The computer program product according to  claim 11 , wherein an average of said entity costs is a weighted average, and wherein each weighting factor associated with the weighted average is bounded between zero and one, inclusive. 
     
     
         17 . The computer program product according to  claim 11 , wherein said probability weighting factor is defined automatically, defined via user input, or a combination thereof. 
     
     
         18 . The system according to  claim 12 , wherein a single nonzero event risk value is determined and a single corresponding conditional probability of said undesired event associated with the digital data files given the behavioral activity is obtained. 
     
     
         19 . The system according to  claim 12 , wherein the probability weighting factor is associated with one or both of the behavioral activity and the undesired event associated with the digital data files corresponding to the conditional probability being adjusted by multiplication with said probability weighting factor. 
     
     
         20 . The system according to  claim 12 , wherein the function of entity costs associated with said undesired event associated with the digital data files is a weighted or an unweighted average of entity costs associated with said undesired event associated with the digital data files. 
     
     
         21 . The system according to  claim 12 , wherein an average of said entity costs is a weighted average, and wherein each weighting factor associated with the weighted average is bounded between zero and one, inclusive.