[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <54240b1b-d895-139f-4aa4-87e4bc2e7af7@thorsheim.net>
Date: Thu, 19 May 2016 22:43:12 +0200
From: Per Thorsheim <per@...rsheim.net>
To: passwords@...ts.openwall.com
Subject: User profile based fraudulent (password) activity detection
Markus Jakobsson (Founder at ZapFraud) recently made a small Linkedin
post where he said it is time to deploy filters to detect social
engineering attacks, which is something they offer as a product/service,
according to their website.
I replied with:
"Banks and credit cards actively monitor where in the world people use
their cards, as well as lots of other parameters to build profiles of
their card owners in order to detect fraudulent usage. I have not yet
seen much, if any products or technologies deployed with small/medium
sized businesses to better detect fraudulent activity on their employee
accounts, where the activity is technically allowed (correct usr+pwd)
but breaks the user's profiles. Does it exist?"
Markus has imho a great response with:
There is not much there, and there is a need for it. Most people think
spam filters, detection of phishing URLs, malware detection and DLP is
enough, not realizing how vulnerable that makes their users.
--
Biometrics has behavioral biometrics (HOW you type, speak, move etc),
credit card companies and banks uses algorithms and behavioral profiles
to search for fraud. (At least they do over here...)
Any ideas, products or services out there to build profiles of user
logons (IP, geo-location, time/day/date) etc to detect suspicious
activity? Did I just give away a business idea here? (I want to be
credited, and a free lifetime license!)
--
Best regards,
Per Thorsheim
CISA, CISM, CISSP, ISSAP
Founder of PasswordsCon.org
CEO of godpraksis.no
Phone: +47 90 99 92 59
Twitter: @thorsheim
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
