SYSTEMS AND METHODS FOR PERFORMING ACCESS ENTITLEMENT REVIEWS

• US 20120047575A1
• Filed: 01/25/2011
• Published: 02/23/2012
• Est. Priority Date: 08/17/2010
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Baikalov, Igor A., Antilley, Dan P. Jr., Deats, Jonathan William, Hansen, Robert Alan, Langsam, Peter Jordan, Paltenghe, Cris T., Pritmani, Ravi, Renfro, Chadwick R., Warn, Carmen M.
• Granted Patent: US 8,418,229 B2
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy

Abstract

Embodiments of the invention relate to risk assessments and, more particularly to performing access risk assessments based on identified outliers.

Claims

1. A method for access entitlement review, the method comprising:

determining, via a computing device processor, one or more entitlement review candidates from amongst a plurality of associates associated with an entity;

providing, via a computing device processor, a listing of one or more access entitlements associated with each of the one or more entitlement review candidates;

receiving, via a computing device processor, one of a justification input or a revocation input for each of the one or more access entitlements; and

providing for revocation of one or more of the access entitlements based on the revocation input.

2. The method of claim 1, wherein providing the listing of the one or more access entitlements further comprises providing, via a computing device processor, a network-accessible viewable display of the listing of the one or more access entitlements.

3. The method of claim 1, wherein providing the listing of the one or more access entitlements further comprises providing, via the computing device processor, the listing of the one or more access entitlements to an associated entitlement review candidate for self-review.

4. The method of claim 3, wherein providing the listing of the one or more access entitlements further comprises providing, via the computing device processor, the listing of the one or more outlier access entitlements to a manager of the associated entitlement review candidate.

5. The method of claim 4, wherein receiving further comprises receiving, via a computing device processor, from the manager, one of the justification input or the revocation input for each of the one or more access entitlements, wherein the justification inputs and revocation inputs are at least partially based on access entitlement responses from the associated entitlement review candidate.

6. The method of claim 1, wherein providing the listing of the one or more access entitlements further comprises providing, via the computing device processor, the listing of the one or more access entitlements to an entitlement review facilitator.

7. The method of claim 6, wherein receiving further comprises receiving, via a computing device processor, from the entitlement review facilitator, one of the justification input or the revocation input for each of the one or more access entitlements.

8. The method of claim 1, wherein providing for revocation further comprises providing, via a computing device processor, a revocation notification to a revocation facilitator, wherein the revocation notification lists the access entitlements to be revoked.

9. The method of claim 1, wherein determining the one or more risk review candidates further comprises determining, via the computing device processor, one or more normalized risk scores for the plurality of associates and comparing, via a computing device processor, the normalized risk scores to predetermined normalized risk score thresholds, wherein each of the one or more normalized risk scores are associated with a risk category.

10. The method of claim 9, wherein determining the one or more normalized risk scores further comprises determining, via a computing device processor, community averages and community standard deviations for each community within two or more predetermined community categories based on one or more raw risk scores and determining, via the computing device processor, the one or more normalized risk scores based on the raw risk scores, the community averages and the community standard deviation.

11. The method of claim 9, wherein determining the one or more risk review candidates further comprises determining, via a computing device processor, one or more outlier reinforcement scores and comparing, via a computing device processor, the outlier reinforcement scores to predetermined outlier reinforcement score thresholds.

12. The method of claim 11, wherein determining the one or more outlier reinforcement scores further comprises summing, via a computing device processor, positive-valued normalized risk scores within a community to result in an overall community score and summing, via a computing device processor, the overall community scores from two or more community categories to result in the outlier reinforcement score.

13. A method for access entitlement review, the method comprising:

communicating, via a computing device processor, a self-entitlement review notification to an associate requiring entitlement review;

communicating, via a computing device processor, an entitlement review notification to a manager of the associate requiring entitlement review;

providing, via a computing device processor, the manager with access to self-entitlement review responses inputted by the associate;

receiving, via a computing device processor, from the manager, entitlement review responses, wherein the entitlement review responses are based at least in part on the self-entitlement review responses; and

storing, in computing device memory, the entitlement review responses in an entitlement review queue.

14. The method of claim 13, further comprising communicating, via a computing device processor, an entitlement review notification to an entitlement review facilitator.

15. The method of claim 14, wherein communicating the entitlement review notification to the entitlement review facilitator further comprises communicating, via a computing device processor, an entitlement review notification to an entitlement review facilitator in lieu of communicating the self-entitlement review notification to the associate and the entitlement review notification to the manager.

16. The method of claim 14, wherein receiving further comprises receiving, via a computing device processor, from the entitlement review facilitator, the entitlement review responses, wherein the entitlement review responses received from the entitlement review facilitator are in lieu of entitlement review responses received from the manager.

17. An apparatus for access entitlement review, the apparatus comprising:

a computing platform including a memory and at least processor in communication with the memory;

an entitlement review candidate determining module stored in the memory, executable by the processor and configured to determine one or more entitlement review candidates from amongst a plurality of associates; and

an access entitlement review module stored in the memory, executable by the processor and including,

an access entitlement review application configured to provide for a listing of a one or more access entitlements associated with each of the one or more entitlement review candidates and receive one of a justification input or a revocation input for each of the one or more access entitlements, and

an access entitlement review queue configured to store the justification inputs and revocations inputs as review results for the entitlement review candidates.

18. The apparatus of claim 17, wherein the access entitlement review application is further configured to provide a network-accessible viewable display of the listing of the one or more access entitlements.

19. The apparatus of claim 17, wherein the access entitlement review application is further configured to provide the listing of the one or more access entitlements to the associated entitlement review candidate for self-review.

20. The apparatus of claim 19, wherein the access entitlement review application is further configured to provide the listing of the one or more access entitlements to a manager of the associated entitlement review candidate.

21. The apparatus of claim 20, wherein the access entitlement review application is further configured to receive, from the manager, one of a justification input or a revocation input for each of the one or more access entitlements, wherein the justification inputs and revocation inputs are at least partially based on access entitlement responses from the associated entitlement review candidate.

22. The apparatus of claim 17, wherein the access entitlement review application is further configured to provide the listing of the one or more access entitlements to an entitlement review facilitator.

23. The apparatus of claim 22, wherein the access entitlement review application is further configured to receive, from the entitlement review facilitator, one of the justification input or the revocation input for each of the one or more access entitlements.

24. The apparatus of claim 17, further comprising an access entitlement revocation routine configured to provide a revocation notification to a revocation facilitator, wherein the revocation notification includes a list of the access entitlements requiring revocation.

25. The apparatus of claim 17, wherein the entitlement review candidate determining module is further configured to determine one or more normalized risk scores for the plurality of employees and compare the normalized risk scores to predetermined normalized risk score thresholds to determine the entitlement review candidates, wherein each of the one or more normalized risk scores are associated with a risk category.

26. The apparatus of claim 25, wherein the entitlement review candidate determining module is further configured to determine community averages and community standard deviations for each community within two or more predetermined community categories based on one or more raw risk scores and determine the one or more normalized risk scores based on the raw risk scores, the community averages and the community standard deviation.

27. The apparatus of claim 25, wherein the entitlement review candidate determining module is further configured to determine one or more outlier reinforcement scores and compare the outlier reinforcement scores to predetermined outlier reinforcement score thresholds to determine the entitlement review candidates.

28. The apparatus of claim 27, wherein the entitlement review candidate determining module is further configured to sum positive-valued normalized risk scores within a community to result in an overall community score and sum the overall community scores from two or more community categories to result in the outlier reinforcement score.

29. An apparatus for access entitlement review, the apparatus comprising:

a computing platform including a memory and at least processor in communication with the memory; and

an access entitlement review module stored in the memory, executable by the processor and including,

an access entitlement review application configured to communicate a self-entitlement review notification to an associate requiring entitlement review and an entitlement review notification to a manger of the associate and receive entitlement review responses from the manager,

an access entitlement review interface application configured to provide the manager with access to self-assessment review responses inputted by the associate, such that the entitlement review responses received from the manager are based at least in part on the self-entitlement, and

an access entitlement review queue configured to store the entitlement review responses.

30. The apparatus of claim 29, wherein the access entitlement review application is further configured to communicate an entitlement review notification to an entitlement review facilitator.

31. The apparatus of claim 30, wherein the access entitlement review application is further configured to communicate the entitlement review notification to an entitlement review facilitator in lieu of communicating the self-entitlement review notification to the associate and the entitlement review notification to the manager.

32. The apparatus of claim 30, wherein the access entitlement review application is further configured to receive, from the entitlement review facilitator, the entitlement review responses, wherein the entitlement review responses received from the entitlement review facilitator are in lieu of entitlement review responses received from the manager.

33. A computer program product comprising:

a non-transitory computer-readable medium comprising;

a first set of codes for causing a computer to determine one or more entitlement review candidates from amongst a plurality of associates associated with an entity;

a second set of codes for causing a computer to provide a listing of one or more access entitlements associated with each of the one or more entitlement review candidates;

a third set of codes for causing a computer to receive one of a justification input or a revocation input for each of the one or more access entitlements; and

a fourth set of codes for causing a computer to store in an access entitlement review queue the justification inputs and revocation inputs as access entitlement review results.

34. The computer program product of claim 33, wherein the second set of codes is further configured to cause the computer to provide a network-accessible viewable display of the listing of the one or more access entitlements.

35. The computer program product of claim 33, wherein the second set of codes is further configured to cause the computer to provide the listing of the one or more access entitlements to an associated entitlement review candidate for self-review.

36. The computer program product of claim 35, wherein the second set of codes is further configured to cause the computer to provide the listing of the one or more access entitlements to a manager of the associated entitlement review candidate.

37. The computer program product of claim 36, wherein the third set of codes is further configured to cause the computer to receive, from the manager, one of the justification input or the revocation input for each of the one or more access entitlements, wherein the justification inputs and revocation inputs are at least partially based on access entitlement responses from the associated entitlement review candidate.

38. The computer program product of claim 33, wherein the second set of codes is further configured to cause the computer to provide the listing of the one or more access entitlements to an entitlement review facilitator.

39. The computer program product of claim 38, wherein the third set of codes is further configured to cause the computer to receive, from the entitlement review facilitator, one of the justification input or the revocation input for each of the one or more access entitlements.

40. The computer program product of claim 33, further comprising a fifth set of codes for causing a computer to provide a revocation notification to a revocation facilitator, wherein the revocation notification lists the access entitlements to be revoked.

41. The computer program product of claim 33, wherein the first set of codes is further configured to cause the computer to determine one or more normalized risk scores for the plurality of employees and compare the normalized risk scores to predetermined normalized risk score thresholds, wherein each of the one or more normalized risk scores are associated with a risk category.

42. The computer program product of claim 41, wherein the first set of codes is further configured to cause the computer to determine community averages and community standard deviations for each community within two or more predetermined community categories based on one or more raw risk scores and determine the one or more normalized risk scores based on the raw risk scores, the community averages and the community standard deviation.

43. The computer program product of claim 41, wherein the first set of codes is further configured to cause the computer to determine one or more outlier reinforcement scores and compare the outlier reinforcement scores to predetermined outlier reinforcement score thresholds.

44. The computer program product of claim 43, wherein the first set of codes is further configured to cause the computer to sum positive-valued normalized risk scores within a community to result in an overall community score and sum the overall community scores from two or more community categories to result in the outlier reinforcement score.

45. A computer program product comprising:

a non-transitory computer-readable medium comprising;

a first set of codes for causing a computer to communicate a self-entitlement review notification to an associate requiring entitlement review;

a second set of codes for causing a computer to communicate an entitlement review notification to a manager of the associate requiring entitlement review;

a third set of codes for causing a computer to provide the manager with access to self-entitlement review responses inputted by the associate;

a fourth set of codes for causing a computer to receive, from the manager, entitlement review responses, wherein the entitlement review responses are based at least in part on the self-entitlement review responses; and

a fifth set of codes for causing a computer to store the entitlement review responses in an entitlement review queue.

46. The computer program product of claim 45, further comprising a sixth set of codes for causing a computer to communicate an entitlement review notification to an entitlement review facilitator.

47. The computer program product of claim 46, wherein the sixth set of codes is further configured to communicate the entitlement review notification to the entitlement review facilitator in lieu of communicating the self-entitlement review notification to the associate and the entitlement review notification to the manager.

48. The computer program product of claim 47, wherein the fourth set of codes is further configured to cause the computer to receive, from the entitlement review facilitator, the entitlement review responses, wherein the entitlement review responses received from the entitlement review facilitator are in lieu of entitlement review responses received from the manager.