US 12,407,729 B2
Monitoring data exfiltration based on user status
Craig Robert Jones, Carmathen (GB)
Assigned to Sophos Limited, (GB)
Filed by Sophos Limited, Abingdon (GB)
Filed on Mar. 28, 2022, as Appl. No. 17/705,749.
Prior Publication US 2023/0308485 A1, Sep. 28, 2023
Int. Cl. H04L 29/06 (2006.01); G06Q 10/1053 (2023.01); H04L 9/40 (2022.01)
CPC H04L 63/20 (2013.01) [G06Q 10/1053 (2013.01); H04L 63/102 (2013.01); H04L 63/105 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
storing, by a computer system at a threat management facility, an employment status module associated with at least one entity, wherein
the employment status module associates a plurality of employment statuses with respective security settings for a plurality of users associated with the at least one entity, and
the respective security settings relate to data processing electronic device activity by the plurality of users;
receiving, by one or more processors of the computer system, information indicating a change in an employment status of a user of the plurality of users;
determining, by the one or more processors of the computer system using the employment status module, a change to security settings for the user based on the change in the employment status of the user;
applying, by the one or more processors of the computer system, the change to the security settings for the user in a security management system of the threat management facility;
restricting, by sending instructions to a monitoring agent located on the electronic device of the user, use of at least one data processing electronic device activity of the electronic device of the user in a manner determined by a policy module of the threat management facility on an electronic device of the user based on the change to the security settings for the user; and
controlling the monitoring agent, by the one or more processors of the computer system, based on the employment status of the user and the security settings for the user, wherein the monitoring agent is configured to prevent data exfiltration based on the change of security settings for the user by preventing applications and/or websites or functionality associated with those applications or websites in a manner defined by the policy module.