Date: Thu, 19 May 2016 22:43:12 +0200 From: Per Thorsheim <per@...rsheim.net> To: passwords@...ts.openwall.com Subject: User profile based fraudulent (password) activity detection Markus Jakobsson (Founder at ZapFraud) recently made a small Linkedin post where he said it is time to deploy filters to detect social engineering attacks, which is something they offer as a product/service, according to their website. I replied with: "Banks and credit cards actively monitor where in the world people use their cards, as well as lots of other parameters to build profiles of their card owners in order to detect fraudulent usage. I have not yet seen much, if any products or technologies deployed with small/medium sized businesses to better detect fraudulent activity on their employee accounts, where the activity is technically allowed (correct usr+pwd) but breaks the user's profiles. Does it exist?" Markus has imho a great response with: There is not much there, and there is a need for it. Most people think spam filters, detection of phishing URLs, malware detection and DLP is enough, not realizing how vulnerable that makes their users. -- Biometrics has behavioral biometrics (HOW you type, speak, move etc), credit card companies and banks uses algorithms and behavioral profiles to search for fraud. (At least they do over here...) Any ideas, products or services out there to build profiles of user logons (IP, geo-location, time/day/date) etc to detect suspicious activity? Did I just give away a business idea here? (I want to be credited, and a free lifetime license!) -- Best regards, Per Thorsheim CISA, CISM, CISSP, ISSAP Founder of PasswordsCon.org CEO of godpraksis.no Phone: +47 90 99 92 59 Twitter: @thorsheim
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.