Bank of America Corporation

Timothy C Metzger

Ronald Ramcharran

Peter Jordan Langsam

Dan P Antilley

Jonathan William Deats

Brian McHugh

Daniel P Shnowske

Sireesh Kumar Nuthi

Subhan V Dandekar

Michael E Kozikowski

Okan Demirmen

Systems and methods for calculating threat scores for individuals within an organization or domain are provided. Aspects of the invention relate to computer-implemented methods that form a predictive threat rating for user accounts. In one implementation, a first threat score representing a first time period may be calculated. The first threat score may be compared with aspects of the same user accounts for a second time period. Weighting schemes may be applied to certain activities, controls, and/or user accounts. Further aspects relate to apparatuses configured to execute methods for ranking individual user accounts. Certain embodiments may not block transmissions that violate predefine rules, however, indications of such improper transmission may be considered when constructing a threat rating. Blocked transmissions enforced upon a user account may also be received. Certain activity, such as accessing the internet, may be monitored for the presence of a security threat and/or an ethics threat.

Insider threat correlation tool

Methods, systems, computer-readable media, and apparatuses for handling information security incidents are presented. In some embodiments, a computing device may receive information indicating that a network address is associated with an information security incident. Subsequently, the computing device may monitor activity associated with the network address. Based on the monitoring, the computing device may determine whether the network address represents an information security threat. In response to determining that the network address represents an information security threat, the computing device may cause one or more remediation actions to be performed. In some arrangements, the information security incident may be a denial of service attack. In additional or alternative arrangements, the network address may be located in a particular net block, and the computing device may evaluate one or more remediation criteria, which may include analyzing network activity for one or more other addresses that are located within the net block.

Handling information security incidents

Embodiments of the invention provide for a centralized system for database access management. In specific embodiments, the centralized system provides for granting users temporal access to databases for a prescribed period of time, such that upon expiration of the time period the user is automatically blocked (i.e., added back to the blacklist) from accessing the database. Moreover, as a result of centralized management, reporting and auditing of actions related to database access management are greatly improved in that all actions are recorded and a historical database of such actions is available to system users. In addition, the centralized system provides for automatic notification to predetermined stakeholders based on occurrence of predetermined system actions, such as blocking a user from database access, unblocking a user from database access (i.e., granting access) or the like.

Database access unblocker

Growing community of inventors

Hoboken, NJ, United States of America

Timothy C Metzger