Image: Getty Images/iStockphoto

Organizations often spend a great deal of time and money on endpoint and network security as a key way to thwart cyberattacks. But one aspect traditionally beyond the control of security technology is the human factor. Users are going to make mistakes whether it be clicking on a malicious link or file attachment, unknowingly downloading malware, or using products that are not secure. A new feature from the security firm Bitdefender is aiming to take some control over that otherwise uncontrollable human element.

SEE: Zero trust security: A cheat sheet (free PDF) (TechRepublic)

Launched on Tuesday, a feature known as Human Risk Analytics will be part of Bitdefender’s GravityZone product. Designed to supplement GravityZone’s antimalware technologies and centralized security management, Human Risk Analytics (HRA) will aim to protect organizations against insider threats and other human-prone risks.

Specifically, HRA will examine user actions and identify behaviors that pose a security risk to the organization and to the employees themselves. Built-in Risk Scores data will let security professionals find systems and users with a higher level of risk and take steps to address them on an individual basis.

“Contrary to other user monitoring practices, HRA does not monitor what sites a user is visiting, or if the user is using a USB drive,” said Bogdan Carlescu, Bitdefender’s senior product marketing manager for enterprise security solutions.

“Instead, HRA records user behavior and potential risks to create a risk profile. For example, if Human Risk Analytics detects that the user is visiting websites known to be malicious, has been infected through a USB drive, is using unencrypted webpages for login, or clicks on phishing URLs included in an email or other high-risk actions, these actions will modify the user’s risk profile and affect the organization’s overall total risk score.”

All the information from HRA will be part of the Risk Dashboard in the GravityZone console, so there won’t be a need for any additional actions on the part of security administrators who use the product.

“HRA is fully integrated with GravityZone, specifically within its Risk Analytics engine,” Carlescu explained. “HRA is currently available for all GravityZone users as a beta capability. We want all customers to have the chance to interact with and test out the new module with no additional cost for the next few months.”

Beyond Human Risk Analytics, GravityZone is beefing up its Security Controls with a Ransomware Mitigation module that will attempt to help organizations better handle advanced ransomware attacks through real-time file backups. Future editions of GravityZone will add human risk mitigation features such as Adaptive Security Awareness Training (ASAT) and Adaptive Security Controls (ASC). All of the new features will be integrated into GravityZone’s human vulnerability management capabilities.

“To improve cyber resilience one must start by understanding the risk profile of the organization,” Carlescu said. “The risk analysis or risk assessment allows organizations to identify and quantify their risk exposure. This should be an ongoing effort and is the heart of any sound cybersecurity strategy. It is essential to have a clear understanding of risk to make the right decision on what risks need to be prioritized in the mitigation process and what are the appropriate security controls to be used.”