REAL TIME PIVOTING ON DATA TO MODEL GOVERNANCE PROPERTIES

• US 20180191730A1
• Filed: 03/28/2017
• Published: 07/05/2018
• Est. Priority Date: 12/30/2016
• Status: Active Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Granted Patent: US 10,848,501 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Real time pivoting on data to model governance properties is provided. A data explorer module of a security and compliance service may analyze data, metadata, and activities associated with a tenant or a hosted service to understand the data, identify uncategorized data, and determine applicable policies and/or remediation actions in case of sensitive data that may need protection. The data may be stored and managed by a data insights platform which may enable query-based analyses on correlated, multi-stage evaluated data. Thus, the data may be analyzed, additionally, considering metadata, activities associated with the data, etc. In addition to the data, metadata, and activities, the data explorer module may receive information associated with existing classifications, properties, access, and applied policies. Upon evaluation of the data based on the received/stored factors, the data explores module may identify the data and determine applicable policies or actions.

Claims

1. A method to provide real time pivoting on data to model governance properties, the method comprising:

receiving information on one or more of classification, property, applied policy, and access associated with data stored in a correlated and multi-stage evaluated storage structure;

analyzing the data based on the received information;

determining one or more of a label, an applicable policy, and a remediation action for the data based on analysis results; and

presenting the determined one or more of the label, the applicable policy, and the remediation action through one or more actionable visualizations.

2. The method of claim 1, further comprising:

receiving metadata associated with the data; and

considering the metadata in the analysis.

3. The method of claim 1, wherein the data comprises one or more of a document, a communication, and non-document content.

4. The method of claim 3, wherein receiving the information on the classification comprises:

receiving a label or a sensitive data type information associated with the data.

5. The method of claim 3, wherein receiving the information on the property comprises:

receiving an age and a type information associated with the data.

6. The method of claim 3, wherein receiving the information on the applied policy comprises:

receiving information associated with one or more casting policies already applied to the data.

7. The method of claim 3, wherein receiving the information on the access comprises:

receiving information associated with one or more of a storage location of the data, a location of a user accessing the data, an identity of a user or an entity accessing the data, and whether the data is shared internally or externally.

8. The method of claim 1, wherein determining the applicable policy further comprises:

detecting, a pattern associated with the data and a usage of the data based on the analysis;

deriving an insight for the applicable policy based on the pattern; and

presenting the application policy as a suggested policy for the data based on the derived insight.

9. The method of claim 8, further comprising:

tailoring the suggested policy based on a tenant profile, wherein the tenant profile includes one or more of an industry, a size, a geographical location, a hosted service ecosystem, a role, a regulatory requirement, and a legal requirement associated with the tenant.

10. The method of claim 1, further comprising:

providing the determined one or more of the label, the applicable policy, and the remediation action to one or more modules of a security and compliance service,

11. The method of claim 1, further comprising:

monitoring changes to the data and the one or more of classification, property, applied policy, and access associated with the data;

creating a performance report based on the monitoring; and

re-evaluating the one or more of the label, the applicable policy, and the remediation action for the data based on the performance report.

12. A server configured to provide real time pivoting on data to model governance properties, the server comprising:

a communication interface configured to facilitate communication between another server hosting a security and compliance service, one or more client devices, and the server;

a memory configured to store instructions; and

one or more processors coupled to the communication interface and the memory and configured to execute a data explorer module, wherein the data explorer module is configured to;

receive information on one or more of classification, property, applied policy, and access associated with data stored in a correlated and multi-stage evaluated storage structure;

receive metadata associated with the data;

analyze the data based on the received information and metadata;

determine one or more of a label, an applicable policy, and a remediation action for the data based on analysis results; and

present a dashboard with one or more actionable visualizations representing distinct attributes of the data and the determined one or more of the label, the applicable policy, and the remediation action.

13. The server of claim 12, wherein the remediation action includes one or more of implementation of aa suggested policy and restriction of one or more of a delete action, a share action, a copy action, a move action, an anonymous link creation, a synchronization, a site creation, a created exemption, a permission modification, a purge of email boxes, a folder movement, a user addition, and a group addition.

14. The server of claim 12, wherein the data explorer module is further configured to:

present one of a new policy and a modified policy as the applicable policy based on the analysis results.

15. The server of claim 12, wherein the data explorer module is further configured to:

automatically implement the remediation action.

16. The server of claim 12, wherein the data explorer module is further configured to provide the analysis results to a threat intelligence module to identify threats to the data.

17. The server of claim 12, wherein the data explorer module is further configured to provide the analysis results to an alert management module to manage alerts based on activity associated with the data.

18. A computer-readable memory device with instructions stored thereon to provide real time pivoting on data to model governance properties, the instructions, when executed, configured to cause one or more computing devices to perform actions comprising:

receive attribute information for data stored in a correlated and multi-stage evaluated storage structure, wherein the attribute information is associated with one or more of classification, property, applied policy, and access associated;

present a dashboard with one or more actionable visualizations representing distinct as of the data;

receive a multiple attribute filtering of the data through the dashboard;

analyze the filtered data based on the received attribute information;

determine one or more of a label, an applicable policy, and a remediation action for the data based on analysis results; and

present the determined one or more of the label, the applicable policy, and the remediation action through the dashboard.

19. The computer-readable memory device of claim 18, wherein the attribute information includes one or more of a label, a sensitive data type, a data type, an age, a storage location of the data, a location of a user accessing the data, an identity of a user or an entity accessing the data, and whether the data is shared internally or externally.

20. The computer-readable memory device of claim 18, wherein the data includes one or more of a document and a communication, and the one or more of the label, the applicable policy, and the remediation action is determined based on a content of the document or the communication.