Event Monitoring

Abstract

A computing device may detect events such as a break-in, fire, flood, movement of people between different areas or zones within a defined area, cyberattacks, movement of devices away from the defined area, etc. If an event is detected, the computing device may take action to protect devices, data on the devices, and/or accounts accessible by the devices. The devices may encrypt, backup data, and/or delete data. The computing device may communicate with other computing devices about events that have been detected.

What is claimed is: 
     
         1 . A method comprising:
 receiving, by a computing device, information indicating an occurrence of an event; and   based on an association between a location of a user device and a location associated with the event, causing the user device to perform an action to protect data accessible via the user device.   
     
     
         2 . The method of  claim 1 , wherein the event comprises at least one of: a cyberattack, detecting malware, disconnecting a device from one or more networks, or unauthorized access to a premises. 
     
     
         3 . The method of  claim 1 , wherein the action comprises preventing access to the data via the user device and providing access, via the user device, to second data different from the data. 
     
     
         4 . The method of  claim 1 , wherein the computing device is located at a premises, wherein the premises comprises the location associated with the event, and further comprising:
 sending, by the computing device to a second computing device located remotely from the premises, a notification indicating the occurrence of the event.   
     
     
         5 . The method of  claim 1 , wherein the action comprises one or more of:
 encrypting the data;   deleting the data from the user device; or   logging out of one or more accounts that are accessible via the user device.   
     
     
         6 . The method of  claim 1 , wherein the event is associated with a premises, wherein the computing device is located at the premises, and wherein the action comprises copying the data to a second computing device located remotely from the premises. 
     
     
         7 . The method of  claim 1 , further comprising:
 determining, based on the occurrence of the event, the action to protect data accessible via the user device.   
     
     
         8 . A method comprising:
 receiving, by a first computing device, information indicating an occurrence of a cyberattack;   determining, by the first computing device, based on the occurrence of the cyberattack and a classification of the cyberattack, an action to protect data accessible via a second computing device; and   causing the second computing device to perform the action.   
     
     
         9 . The method of  claim 8 , wherein the classification comprises a severity of the cyberattack. 
     
     
         10 . The method of  claim 8 , wherein the determining the action to protect the data further comprises:
 determining, based on the classification of the cyberattack, the action to protect the data.   
     
     
         11 . The method of  claim 8 , further comprising:
 determining, based on the classification of the cyberattack, an action to protect data accessible via one or more other computing devices.   
     
     
         12 . The method of  claim 8 , wherein the action comprises one or more of: locking the second computing device; encrypting the data; deleting the data; disconnecting the second computing device from one or more networks; disconnecting the second computing device from one or more other computing devices; or storing the data to one or more other computing devices. 
     
     
         13 . The method of  claim 8 , wherein the action comprises protecting an account targeted by the cyberattack. 
     
     
         14 . The method of  claim 13 , wherein protecting the account comprises one or more of: requesting authentication information associated with the account; logging out of the account on the second computing device; logging out of the account on one or more other computing devices; limiting access to the data via the second computing device; or limiting access to the data via one or more other computing devices. 
     
     
         15 . The method of  claim 8 , further comprising:
 determining an association between a location of the second computing device and a location associated with the cyberattack, wherein causing the second computing device to perform the action is further based on the association.   
     
     
         16 . An apparatus comprising:
 one or more processors; and   memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
 receive information indicating an occurrence of an event; and 
 based on an association between a location of a user device and a location associated with the event, cause the user device to perform an action to protect data accessible via the user device. 
   
     
     
         17 . The apparatus of  claim 16 , wherein the event comprises at least one of: a cyberattack, detecting malware, disconnecting a device from one or more networks, or unauthorized access to a premises. 
     
     
         18 . The apparatus of  claim 16 , wherein the action comprises preventing access to the data via the user device and providing access, via the user device, to second data different from the data. 
     
     
         19 . The apparatus of  claim 16 , wherein the apparatus is located at a premises, wherein the premises comprises the location associated with the event, and wherein the instructions, when executed by the one or more processors, cause the apparatus to:
 send, to a computing device located remotely from the premises, a notification indicating the occurrence of the event.   
     
     
         20 . The apparatus of  claim 16 , wherein the action comprises one or more of:
 encrypting the data;   deleting the data from the user device; or   logging out of one or more accounts that are accessible via the user device.   
     
     
         21 . The apparatus of  claim 16 , wherein the event is associated with a premises, wherein the apparatus is located at the premises, and wherein the action comprises copying the data to a second computing device located remotely from the premises. 
     
     
         22 . The apparatus of  claim 16 , wherein the instructions, when executed by the one or more processors, cause the apparatus to:
 determine, based on the occurrence of the event, the action to protect data accessible via the user device.   
     
     
         23 . An apparatus comprising:
 one or more processors; and   memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
 receive information indicating an occurrence of a cyberattack; 
 determine, based on the occurrence of the cyberattack and a classification of the cyberattack, an action to protect data accessible via a computing device; and 
 causing the computing device to perform the action. 
   
     
     
         24 . The apparatus of  claim 23 , wherein the classification comprises a severity of the cyberattack. 
     
     
         25 . The apparatus of  claim 23 , wherein the instructions, when executed by the one or more processors, cause the apparatus to determine the action to protect the data by causing:
 determining, based on the classification of the cyberattack, the action to protect the data.   
     
     
         26 . The apparatus of  claim 23 , wherein the instructions, when executed by the one or more processors, cause the apparatus to:
 determine, based on the classification of the cyberattack, an action to protect data accessible via one or more other computing devices.   
     
     
         27 . The apparatus of  claim 23 , wherein the action comprises one or more of: locking the computing device; encrypting the data; deleting the data; disconnecting the computing device from one or more networks; disconnecting the computing device from one or more other computing devices; or storing the data to one or more other computing devices. 
     
     
         28 . The apparatus of  claim 23 , wherein the action comprises protecting an account targeted by the cyberattack. 
     
     
         29 . The apparatus of  claim 28 , wherein protecting the account comprises one or more of: requesting authentication information associated with the account; logging out of the account on the computing device; logging out of the account on one or more other computing devices; limiting access to the data via the computing device; or limiting access to the data via one or more other computing devices. 
     
     
         30 . The apparatus of  claim 23 , wherein the instructions, when executed by the one or more processors, cause the apparatus to:
 determine an association between a location of the computing device and a location associated with the cyberattack, wherein causing the computing device to perform the action is further based on the association.