Vertically integrated access control system for identifying and remediating flagged combinations of capabilities resulting from user entitlements to computing resources
First Claim
1. A computerized vertically integrated access control system for identifying and remediating flagged combinations of capabilities resulting from user entitlements to computing resources, comprising:
- a computer processor;
a memory;
a network communication device; and
an access control module stored in the memory, executable by the computer processor, and configured to perform the steps of;
collecting information regarding a plurality of entity capabilities of an entity;
storing, in a database, a plurality of entity capability data records, each entity capability data record corresponding to an entity capability of the plurality of entity capabilities;
collecting information regarding a plurality of flagged combinations of entity capabilities;
storing, in the database, a plurality of flagged combination data records, each flagged combination data record corresponding to a flagged combination of entity capabilities;
collecting information regarding interfaces of an information system of the entity;
collecting information regarding access control rules of the information system;
collecting information regarding computing resources of the information system;
storing, in the database, a plurality of data records corresponding to the interfaces, access control rules, and computing resources of the information system;
for each entity capability, linking in the database said entity capability to each interface that implements said entity capability;
for each interface, linking in the database said interface to each access control rule for accessing said interface;
for each computing resource, linking in the database said computing resource to each access control rule for accessing said computing resource;
for each interface, linking in the database said interface to each computing resource accessed by said interface;
identifying entitlements of a first user within the information system;
based on the entitlements of the first user, identifying access control rules assigned to the first user;
identifying entity capabilities of the first user by identifying entity capabilities linked in the database to the access control rules assigned to the first user;
comparing the entity capabilities of the first user to the plurality of flagged combinations of entity capabilities;
in response to comparing the entity capabilities of the first user to the plurality of flagged combinations of entity capabilities, determining that the entity capabilities of the first user comprise a first flagged combination of entity capabilities;
in response to determining that the entity capabilities of the first user comprise the first flagged combination of entity capabilities, performing an information security action to remediate the first flagged combination of entity capabilities.
1 Assignment
0 Petitions
Accused Products
Abstract
A vertically integrated access control system may store in a database data records corresponding to the interfaces, access control rules, and computing resources of an information system, as well as data records for entity capabilities. Data records for related interfaces, access control rules, computing resources, and entity capabilities may be linked. Using the database, the system may determine the entity capabilities that can be performed based on an existing user entitlement. If the entity capabilities include a flagged combination of entity capabilities, the system may perform an information security action to remediate the flagged combination. The system may use the database to form vertically integrated access units. The vertically integrated access units may be used to form user entitlements. The system may continuously monitor whether any proposed configurations would create a flagged combination of entity capabilities, and if so take an action to prevent such flagged combination.
50 Citations
20 Claims
-
1. A computerized vertically integrated access control system for identifying and remediating flagged combinations of capabilities resulting from user entitlements to computing resources, comprising:
a computer processor;
a memory;a network communication device; and an access control module stored in the memory, executable by the computer processor, and configured to perform the steps of; collecting information regarding a plurality of entity capabilities of an entity;
storing, in a database, a plurality of entity capability data records, each entity capability data record corresponding to an entity capability of the plurality of entity capabilities;collecting information regarding a plurality of flagged combinations of entity capabilities; storing, in the database, a plurality of flagged combination data records, each flagged combination data record corresponding to a flagged combination of entity capabilities; collecting information regarding interfaces of an information system of the entity;
collecting information regarding access control rules of the information system;
collecting information regarding computing resources of the information system;
storing, in the database, a plurality of data records corresponding to the interfaces, access control rules, and computing resources of the information system;for each entity capability, linking in the database said entity capability to each interface that implements said entity capability; for each interface, linking in the database said interface to each access control rule for accessing said interface; for each computing resource, linking in the database said computing resource to each access control rule for accessing said computing resource; for each interface, linking in the database said interface to each computing resource accessed by said interface; identifying entitlements of a first user within the information system;
based on the entitlements of the first user, identifying access control rules assigned to the first user;identifying entity capabilities of the first user by identifying entity capabilities linked in the database to the access control rules assigned to the first user; comparing the entity capabilities of the first user to the plurality of flagged combinations of entity capabilities; in response to comparing the entity capabilities of the first user to the plurality of flagged combinations of entity capabilities, determining that the entity capabilities of the first user comprise a first flagged combination of entity capabilities; in response to determining that the entity capabilities of the first user comprise the first flagged combination of entity capabilities, performing an information security action to remediate the first flagged combination of entity capabilities. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
9. A computer program product for identifying and remediating flagged combinations of capabilities resulting from user entitlements to computing resources, the computer program product comprising a non-transitory computer-readable storage medium having computer-executable instructions for causing a computer processor to perform the steps of:
-
collecting information regarding a plurality of entity capabilities of an entity;
storing, in a database, a plurality of entity capability data records, each entity capability data record corresponding to an entity capability of the plurality of entity capabilities;collecting information regarding a plurality of flagged combinations of entity capabilities;
storing, in the database, a plurality of flagged combination data records, each flagged combination data record corresponding to a flagged combination of entity capabilities;collecting information regarding interfaces of an information system of the entity;
collecting information regarding access control rules of the information system;
collecting information regarding computing resources of the information system;
storing, in the database, a plurality of data records corresponding to the interfaces, access control rules, and computing resources of the information system;for each entity capability, linking in the database said entity capability to each interface that implements said entity capability; for each interface, linking in the database said interface to each access control rule for accessing said interface; for each computing resource, linking in the database said computing resource to each access control rule for accessing said computing resource; for each interface, linking in the database said interface to each computing resource accessed by said interface; identifying entitlements of a first user within the information system;
based on the entitlements of the first user, identifying access control rules assigned to the first user;identifying entity capabilities of the first user by identifying entity capabilities linked in the database to the access control rules assigned to the first user; comparing the entity capabilities of the first user to the plurality of flagged combinations of entity capabilities; in response to comparing the entity capabilities of the first user to the plurality of flagged combinations of entity capabilities, determining that the entity capabilities of the first user comprise a first flagged combination of entity capabilities; in response to determining that the entity capabilities of the first user comprise the first flagged combination of entity capabilities, performing an information security action to remediate the first flagged combination of entity capabilities. - View Dependent Claims (10, 11, 12, 13, 14, 15, 16)
-
-
17. A computerized method for identifying and remediating flagged combinations of capabilities resulting from user entitlements to computing resources, the method comprising the steps of:
-
collecting, via a computer processor, information regarding a plurality of entity capabilities of an entity; storing, via a computer processor, in a database, a plurality of entity capability data records, each entity capability data record corresponding to an entity capability of the plurality of entity capabilities; collecting, via a computer processor, information regarding a plurality of flagged combinations of entity capabilities; storing, via a computer processor, in the database, a plurality of flagged combination data records, each flagged combination data record corresponding to a flagged combination of entity capabilities; collecting, via a computer processor, information regarding interfaces of an information system of the entity; collecting, via a computer processor, information regarding access control rules of the information system; collecting, via a computer processor, information regarding computing resources of the information system; storing, via a computer processor, in the database, a plurality of data records corresponding to the interfaces, access control rules, and computing resources of the information system; for each entity capability, linking, via a computer processor, in the database said entity capability to each interface that implements said entity capability; for each interface, linking, via a computer processor, in the database said interface to each access control rule for accessing said interface; for each computing resource, linking, via a computer processor, in the database said computing resource to each access control rule for accessing said computing resource; for each interface, linking, via a computer processor, in the database said interface to each computing resource accessed by said interface; identifying, via a computer processor, entitlements of a first user within the information system; based on the entitlements of the first user, identifying, via a computer processor, access control rules assigned to the first user; identifying, via a computer processor, entity capabilities of the first user by identifying entity capabilities linked in the database to the access control rules assigned to the first user; comparing, via a computer processor, the entity capabilities of the first user to the plurality of flagged combinations of entity capabilities; in response to comparing the entity capabilities of the first user to the plurality of flagged combinations of entity capabilities, determining, via a computer processor, that the entity capabilities of the first user comprise a first flagged combination of entity capabilities; in response to determining that the entity capabilities of the first user comprise the first flagged combination of entity capabilities, performing, via a computer processor, an information security action to remediate the first flagged combination of entity capabilities. - View Dependent Claims (18, 19, 20)
-
Specification