RU2623808C2 - Method of application of safety policies for computer safety - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: method is implemented by applying security policies on the specified device, depending on the current level of user knowledge. A method is proposed in which the user's current level of knowledge is selected from the database. The level of knowledge of the user is a numerical value reflecting the erudition of the user in the field of knowledge relating to the security of the computer. The information about the security of the computer is selected from the database based on the current level of knowledge of the user. The selected information is provided to the user. A feedback on the information provided is received from the user. Based on the feedback a new level of knowledge of the user is calculated and it becomes current, and is stored in the database. The security policies, that must be applied to the computer to ensure the security of the computer, are applied depending on the current level of user knowledge.

EFFECT: ensuring the safety of the computer.

3 cl, 3 dwg

Description

Technical field

The invention relates to solutions for securing a computing device, and more particularly, to methods for applying security policies to ensure the security of a computing device.

State of the art

Currently, applications - "advisers" (English advisor, the term will be used without quotes) are becoming increasingly popular. They are often small in size and carry functionality that provides the user with various information, both educational and advertising. Using this information, the user can learn something or understand that he needs this or that application to solve certain problems. Often, advisor applications help the user also install the necessary application.

In addition, advisor applications are now also being released by antivirus software companies. The main goal is to educate the user at least in the basics of ensuring the security of a computing device, after which the user will understand the need for security applications on his device (for example, a firewall, anti-spam applications, anti-virus applications).

However, it is worthwhile to understand that in most cases, training a user for something can be done only after involving the user in the learning process, since providing the information in a simple sequential form may not be interesting for the user. It is necessary to interest him in some way. For example, to provide a variety of training information (to conduct not only testing, but also to display training materials in an easier to understand form - images, videos), competitive opportunities (the user can compete with other users in terms of their knowledge), bonuses for successful training (providing any material benefit to the user after successful training).

The very idea of training a computer security user is not new. So, publication US 8955109 B1 describes a system that determines whether a user is vulnerable to attacks using methods of social engineering. If the user is vulnerable, he is provided with information on how not to become a victim of such an attack.

The proposed method allows you to educate the user, analyze the learning outcomes, based on the learning outcomes, apply security policies to the computing device and, if necessary, install the necessary applications to ensure the security of the computing device.

SUMMARY OF THE INVENTION

The technical result is to ensure the security of the computing device, which is achieved by applying security policies on the specified device, depending on the current level of knowledge of the user.

According to one implementation option, a method is provided for applying security policies that must be applied to a computing device to ensure the security of the computing device, in which: using the analysis tool, the user’s current knowledge level is selected from the database and passed to the information providing means; the level of knowledge of the user is a numerical value that reflects the erudition of the user in the field of knowledge regarding the security of the computing device; using the means of providing information, information about ensuring the security of the computing device is selected from the database based on the current level of knowledge of the user, while this information contains at least one of: text information about ensuring the security of the computing device; images, audio and video recordings about the security of a computing device; questions to calculate the level of knowledge of the user to ensure the security of the computing device; information about software that ensures the security of the computing device; a request to apply a security policy that ensures the security of a computing device; a request to install software that ensures the safety of a computing device; using the means of providing information provide the selected information to the user; using the means of providing information receive feedback (English feedback) from the user for the information provided; wherein the feedback contains at least one of: confirmation of the user's acquaintance with information about ensuring the security of the computing device; user response to a question for calculating the level of knowledge of the user to ensure the security of the computing device; user response to a request for a security policy that ensures the security of the computing device; user response to a request to install software that ensures the safety of a computing device; using the means of providing information transmit feedback to the security tool; using the security tool, based on the presented feedback, security policies are applied that must be applied to the computing device to ensure the security of the computing device, while security policies include software settings to ensure the security of the computing device.

According to one particular embodiment, a method is provided in which, using the information providing means, feedback is provided to the analysis means, and using the analysis means, the knowledge level of the user, which becomes current, is calculated and stored in the database.

According to another particular embodiment, a method is provided in which the security software for the computing device is at least an anti-virus application.

According to another particular embodiment, a method is provided in which software settings for securing a computing device include installing software for securing a computing device.

Brief Description of the Drawings

Additional objectives, features and advantages of the present invention will be apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

FIG. 1 illustrates the structure of a security policy enforcement system for securing a computing device.

FIG. 2 illustrates a method for applying security policies to secure a computing device.

FIG. 3 is an example of a general purpose computer system on which the present invention may be implemented.

Description of Embodiments

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details provided to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined only in the scope of the attached claims.

FIG. 1 illustrates the structure of a security policy enforcement system for securing a computing device.

The system consists of a means of providing information 110, analysis tools 120, security tools 130. In general, all the tools of the system operate on a user's computing device 111. The computing devices may include personal computers, laptops, tablets and smartphones. In a particular embodiment, the information providing means 110 and the security means 130 operate on a user computing device 111, and the analysis means 120 operates on a remote server.

The means of providing information 110 selects from the database information about the security of the computing device for providing the user 111 based on his current level of knowledge, provides it to the user 111, receives feedback from the user 111 and provides feedback to the security means 130. In one embodiment, the information providing tool 110 provides feedback to the analysis tool 120.

Information provided to user 111 may include:

- text information about the security of the computing device (for example, a link to a web page containing an article with materials about ensuring the security of the computing device or displaying text locally on the screen of the computing device);

- images, audio and video recordings about the security of the computing device (for example, video recordings with instructions for ensuring the security of the computing device);

- questions for calculating the level of knowledge of the user on ensuring the security of a computing device (for example, a question regarding information on ensuring the security of a computing device, and possible answers to this question);

- information about the software that ensures the security of the computing device (for example, a link to a web page with a description of the anti-virus application);

- a request for the application of a security policy that ensures the security of the computing device (for example, enable the firewall);

- a request to install software that ensures the security of a computing device (for example, an anti-virus application).

The user's knowledge level 111 is a numerical value that reflects his knowledge in the field of knowledge regarding the security of a computing device. The higher the erudition of the user 111, the greater the value of his level of knowledge.

In one embodiment, the means of providing information 110 operates optionally, that is, if the user 111 does not want to receive information (the user can express his unwillingness to receive information, for example, by setting the corresponding option in the settings of the operation of the means of providing information 110), the means of providing information 110 will not provide information to user 111.

In another embodiment, information may be provided at a time interval selected by user 111. In yet another embodiment, the information is provided as a push notification. In yet another embodiment, information is provided while the user 111 is not working with the device (for example, the device is in standby mode, or the display of the device is turned off).

In one embodiment, the information is provided after a certain amount (for example, 10) minutes after putting the device into standby mode, once a day.

In yet another embodiment, information is provided if the information providing means 110 detects certain scenarios of user 111 activity. For example, user 111 opened a desktop on a mobile device and did not launch applications for 5 (or more) seconds.

In one embodiment, the information provided to the user 111 contains a daily security question. In one embodiment, if the answer is incorrect, the question may repeat after some time (for example, after a week). If the answer to the question contains the answer options, then among them may contain the answer option “Learn more” with reference to the relevant article on the security of the computing device.

Examples of questions may include:

but. Is the link http://www.kaspersky.com.legalbusyness.biz/ a phishing? Answer Options:

i. "Yes";

ii. “No, kaspersky.com is a reliable site”;

iii. Learn more about phishing button.

b. If you received a letter from your close friend, and it contains a knowingly malicious link, does this mean that your friend’s mail was hacked? Answer Options:

i. “Yes, my friend would never do that!”;

ii. “Optional, the letter can be faked”;

iii. "Nobody knows that we are friends, that's for sure he!"

c. You received a letter with the headline “Your photo in the attachment, did not expect this from you!”, But in the attachment the image. Is it worth it to watch? Answer Options:

i. “No, if from a stranger, then it’s for sure a virus”;

ii. “It stands, there are no viruses in pictures”;

iii. “If the sender is familiar to me, then I will look with one eye”;

iv. “I will make sure that the sender is familiar to me, that I really expect photos from him, that the anti-virus protection is enabled and updated, and I will see”;

v. “Without looking, I will forward a letter to all my friends.”

d. You are in a cafe with free Wi-Fi, open to all visitors. Can someone see which site you are visiting? Options:

i. “Yes, but only if he is standing behind me”;

ii. “Yes, he intercepts all traffic”;

iii. “Yes, regardless of the conditions, those who are next to me know where I am going”;

iv. “No, the Internet is securely encrypted.”

e. You have lost your smartphone. Whoever found him knows the address where you woke up today? Option:

i. “Yes, but only if I didn’t configure anything”;

ii. “No, I do not store the address in the smartphone”;

iii. “No, my smartphone does not track or record my location, and with all the desire, it will not be able to show me a map of movements.”

In one embodiment, if user 111 has not answered the question, then questions are accumulated (stored for re-provision to user 111). In one implementation variant, the number of questions limited by a threshold value (for example, three) is accumulated, then the oldest questions are replaced by new ones.

In one embodiment, the information providing means 110 collects device usage statistics.

Device usage statistics contain information:

- about the time intervals for using the device for various purposes (for example, intervals when the device is in active and sleep modes, intervals for using a web browser, mail client and other applications, and others);

- About 111 information resources visited by the user (for example, sites visited by the user on the local network or on the Internet);

- about time intervals for using the device’s hardware functions (for example, intervals for using the Wi-Fi module, Bluetooth, geolocation, intervals for using data transfer over a mobile network, etc.);

- the availability and use of software to ensure the security of the computing device (for example, the presence of a firewall or antivirus application 111 on the user's device, as well as information on the use of these applications).

In one embodiment, the means of providing information 110 collects information about the activity and interests of the user 111 in the form of keywords (tags). In the General case, the tags are allocated by the means of providing information 110 based on the activity of the computing device of the user 111.

Examples of highlighted tags include:

a. tags corresponding to visited sites, for example, “facebook”, “battle.net”, “gmail” and others;

b. tags corresponding to installed applications, for example, “internet banking”, “cut the grief”, “ms office” and others;

c. tags corresponding to the activity of the hardware functions of the computing device, for example, “wifi”, “audio”, “gprs”, “battery”, “sms”, “flight mode”, “geolocation”, “flashlight”, “bluetooth”, “nfc " and others.

In general, the security information provided to the user 111 for the computing device is stored in the database 121. In one embodiment, this information can be tagged when information is added to the database 121. It should be noted that the methods for filling the database 121 with information about providing the security of the computing device and keeping this information up to date is beyond the scope of the present invention. In general, filling and maintaining the relevance of database 121 can be automated or performed by an information security specialist.

In one embodiment, the information providing means 110 selects information to be provided by tags based on the activity of the user 111. For example, the user 111 is not shown Wi-Fi related issues if he has never connected to Wi-Fi. Another example of selecting information to provide based on user 111 activity is the following information: “We noticed that you have never turned on Wi-Fi in a month, maybe you are afraid of threats via Wi-Fi? Let’s tell you that it can be not scary and safe. ”

In one embodiment, the information providing means 110 provides the user 111 with information containing also information about a security application, for example:

Do you need to use the same password on different resources?

i. “Yes, it’s easier to remember”;

ii. “No, if one resource is compromised, an attacker will gain access to everyone”;

iii. “I have Kaspersky Password Manager, he remembers different passwords himself.”

In one embodiment, the information providing tool 110 provides the user 111 with information containing a suggestion to install a security application (for example, a firewall or anti-virus application). For example:

Your device does not have a firewall installed. Do you want to install “Kaspersky Firewall?”

i. "No thanks";

ii. “Yes, I want to install Kaspersky Firewall.”

In another embodiment, the information providing tool 110 provides information that a security policy can only be applied after installing the software. For example:

Do you want to see warnings about phishing sites?

i. “No, but I myself can determine what this site is”;

ii. “No, there is nothing wrong with such sites”;

iii. “Yes, I want to install an application that will identify phishing sites for me and warn about the transition to them.”

Feedback on the information provided may include:

- confirmation of the familiarization of the user 111 with information about the security of the computing device (for example, confirmation of the opening of a web page with the provided material);

- the response of the user 111 to the question for calculating the level of knowledge of the user 111 on ensuring the security of the computing device (for example, the answer chosen by the user 111);

- the user's response to the request for the application of a security policy that ensures the security of the computing device (for example, the consent of user 111 to enable the firewall);

- the user's response to the request to install software that ensures the security of the computing device (for example, user 111's consent to install the software or user 111 selecting the “remind later” option).

The analysis tool 120 selects from the database 121 the current value of the user knowledge level 111 and passes it to the information providing means 110. In one embodiment, the analysis tool 120 calculates, based on the feedback received from the information providing means 110, a new knowledge level of the user 111, which becomes current, and stores it in database 121.

In one embodiment, the initial level of knowledge of all 111 users is zero.

The knowledge level of user 111 can be calculated by analysis tool 120 based on information security materials reviewed by user 111 and answers to questions answered by user 111. The calculation can use existing mathematical and algorithmic methods. Examples of calculating the level of knowledge are given below.

In one embodiment, the increase in the level of knowledge depends on the amount of textual information that user 111 has read. For example, after reading 5 articles on information security, the level of knowledge of user 111 increases (for example, by 1). In another embodiment, to calculate the level of knowledge, the number of correct answers of user 111 is used as a percentage of the total number of answers of user 111 (for example, the level of knowledge increases when the percentage of correct answers is more than 75). In one embodiment, the increase in the level of knowledge depending on the number of correct answers is not linear, for example, the first increase (for example, to the second level of knowledge) occurs after 2-3 correct answers to questions to calculate the level of knowledge of user 111 on ensuring the security of a computing device . The user receives the fifth level of knowledge, for example, for 15 or more correct answers. In one embodiment, a set of conditions is used to calculate the level of knowledge. For example, to achieve the second level of knowledge it is necessary to familiarize yourself with 3 text articles on information security, answer at least 5 questions and at the same time give at least 60% correct answers. To achieve the third level, user 111 needs to read 5 articles, answer 10 questions and give at least 70% of the correct answers. In one embodiment, with an incorrect answer to the question, the level of knowledge of user 111 can be reduced by analysis tool 120.

After calculating the new value of the knowledge level of the user 111, the analysis tool 120 stores it in the database 121.

In one embodiment, the analysis tool 120 prompts the user 111 to create a profile after determining, by feedback from the user, his consent to provide information on ensuring the security of the computing device. In another embodiment, the profile may be modifiable and have various settings. For example, in the profile, you can specify the name of the profile (English nickname), the real username 111, the territorial location of the user 111, set the profile icon avatar, etc.

In one embodiment, for the correct answer, the analysis tool 120 accrues 111 points (or an experience point) to the user.

In one embodiment, the analysis tool 120 comprises a competition in which various users 111 compete with their knowledge levels. For example, there is a list (English chart) of user profiles 111 by knowledge level (English highscore). In one implementation variant, only profiles of those 111 users who installed the product on the same day (so that the competition was “fair”) participate in the competition.

In one embodiment, when the user’s knowledge level 111 is increased, the analysis tool 120 allows the user 111 to receive some rewards (English bonus) depending on his level of knowledge. For example, at level 10, a one-time 10% discount on any of the applications for purchase can be obtained (applications for purchase can be determined by software manufacturers, and their list can be stored both at the manufacturers themselves and in the Google Play, Arr stores Store ”,“ Microsoft Store ”and others). In another embodiment, the promotion may be the free use of a security application for a certain period (for example, three months). In another embodiment, the promotion may be the extension of the current license key of the security application to another computing device of the user 111.

The security tool 130 based on the feedback on the information received from the provision of information 110 applies the security policies 131 that must be applied to the device.

Examples of security policies 131 include the following:

- Do not use public Wi-Fi networks;

- Do not run applications whose digital signature authenticity cannot be verified;

- Do not open links from letters received from unknown recipients;

- Do not enter authentication data on an unknown site;

- Do not use the same password for several (for example, two) sites;

- other;

It is worth noting that security policies 131 include software settings to ensure the security of the computing device, for example:

- perform daily antivirus scans;

- enable the firewall;

- enable advertising filter;

- enable spam filter.

In one embodiment, the software settings for securing the computing device include installing software 141 for securing the computing device, for example:

- install a firewall;

- install an antivirus application.

In this case, the security tool 130 installs the necessary software 141 to ensure the security of the computing device. In one embodiment, a software distribution 141 may be obtained by security tool 130 from a server on a local area network or the Internet.

FIG. 2 depicts how security policies are applied to secure a computing device.

At step 210, using the analysis tool 120, the current knowledge level of the user 111 is selected from the database and transferred to the information providing means 110. The level of knowledge of the user 111 is a numerical value reflecting the erudition of the user 111 in the field of knowledge regarding the security of the computing device.

At step 220, using the information providing means 110, information about ensuring the security of the computing device based on the current level of knowledge of user 111 is selected from the database 121 from the database 121, while the information provided to the user 111 may include:

- text information about the security of the computing device;

- Images, audio and video recordings about the security of a computing device;

- questions for calculating the level of knowledge of the user 111 to ensure the security of the computing device;

- information about software that ensures the security of the computing device;

- a request for the application of a security policy that ensures the security of the computing device;

- a request to install software that ensures the safety of a computing device.

At step 230, the information provided 110 provides the selected information to the user 111.

At step 240, using the information providing means 110, feedback is received from the user 111 on the information provided, the feedback may include:

- confirmation of familiarization of the user 111 with information about ensuring the security of the computing device;

- the response of the user 111 to the question for calculating the level of knowledge of the user to ensure the security of the computing device;

- the response of the user 111 to the request for the application of security policy 131, ensuring the security of the computing device;

- the response of the user 111 to the request to install software 141, ensuring the security of the computing device.

In one embodiment, the feedback is transmitted to the analysis tool 120 using the information providing tool 110, and the knowledge level of the user 111, which becomes current, is calculated based on the feedback 120 and stored in the database 121.

At step 250, feedback is provided to the security tool 130 by the information providing means 110.

At step 260, using the security tool 130, based on the feedback on the information provided, security policies 131 are applied that must be applied to the computing device to ensure the security of the computing device. In one embodiment, security policies 131 include software settings for securing a computing device. In yet another embodiment, the software settings for ensuring the security of the computing device include installing software 141. Thus, in the case where it is necessary to install the software 141 using security means 130 to ensure the security of the computing device, the installation of the necessary software 141 for securing a computing device based on applied security policies 131 In one embodiment, the anti-virus application is software 141 for providing security for a computing device.

FIG. 3 represents an example of a general purpose computer system, a personal computer or server 20 comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented as any prior art bus structure comprising, in turn, a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26, contains basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating ROM systems 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the interface of the magnetic disks 33 and the interface of the optical drive 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that can store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.) that are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38, and program data 39. The user is able to enter commands and information into personal computer 20 via input devices (keyboard 40, keypad “ the mouse "42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to the computer system 20 via a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer can be equipped with other peripheral output devices (not displayed), for example, speakers, a printer, etc. .

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature the personal computer 20 of FIG. 3. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes may also be present on the computer network.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 50 via a network adapter or network interface 51. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

In conclusion, it should be noted that the information provided in the description are examples that do not limit the scope of the present invention defined by the claims. One skilled in the art will recognize that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (17)

1. The method of applying security policies that must be applied to a computing device to ensure the security of the computing device, in which: a) using the analysis tool, the user’s current level of knowledge is selected from the database and transferred to the means for providing information; the level of knowledge of the user is a numerical value that reflects the erudition of the user in the field of knowledge regarding the security of the computing device; b) using the means of providing information, select information from the database on ensuring the security of the computing device based on the current level of knowledge of the user, while this information contains questions for calculating the level of knowledge of the user to ensure the security of the computing device and at least one of: - text information about the security of the computing device; - Images, audio and video recordings about the security of a computing device; - information about software that ensures the security of the computing device; c) using the means of providing information provide the selected information to the user; d) using the means of providing information receive feedback from the user on the information provided; wherein the feedback contains: - confirmation of familiarization of the user with information about the security of the computing device; - the user's answer to the question for calculating the level of knowledge of the user to ensure the security of the computing device; d) using the analysis tool, on the basis of the feedback received from the means of providing information, the new level of knowledge of the user that becomes current is calculated and stored in a database; e) apply security policies that must be applied to the computing device to ensure the security of the computing device, depending on the current level of knowledge of the user. 2. The method of claim 1, wherein the security software for the computing device is at least an anti-virus application. 3. The method of claim 1, wherein the security policies include installing software to ensure the security of the computing device.

Images