Method to calculate a risk score of a folder that has been scanned for confidential information

• US 8,516,597 B1
• Filed: 03/01/2011
• Issued: 08/20/2013
• Est. Priority Date: 12/02/2010
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Jackson, Adam, Sharma, Pritesh, Mailen, Jeremy, Byun, Harold
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US13/038,232
• Time in Patent Office: 903 Days
• Field of Search: 726/25, 726/27
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A method for calculating a risk score of a data object may include obtaining a severity level associated with a data object. The severity level may be calculated based on presence of confidential information in the data object. The data object may be a file or a folder. The severity level may be calculated using a data loss prevention policy. The method may further include obtaining metadata associated with the data object. The metadata may comprise at least one of access permission data for the data object and access usage data for the data object. The method may further include calculating a risk score for the data object based on the severity level and the metadata associated with the data object.

Claims

1. A method comprising:

obtaining, by a computer system, a severity level associated with a data object, wherein the severity level is calculated based on presence of confidential information in the data object, the data object being a file or a folder, the severity level being calculated using a data loss prevention policy in response to a violation of the data loss prevention policy;

obtaining, by the computer system, metadata associated with the data object based on a configuration parameter, the metadata comprising at least one of access permission data for the data object and access usage data for the data object, wherein the configuration parameter defines the metadata to obtain to calculate a risk score; and

calculating, by the computer system, the risk score for the data object based on the severity level and the metadata associated with the data object.

2. The method of claim 1, wherein if the data object is a folder comprising one or more files, the risk score for the folder comprises a risk score for each of the one or more files.

3. The method of claim 1, wherein the access permission data is a permission access control list associated with a number of users permitted to access the data object.

4. The method of claim 1, wherein the access usage data for the data object defines historical data for the data object, the historical data comprising a number of users that have accessed the data object during a predetermined amount of time.

5. The method of claim 1, further comprising:

assigning a weight to the risk score for the data object, wherein the weight is assigned based on a risk score of one or more other data objects to be included in a risk report;

creating the risk report including the weighted risk score for the data object; and

displaying the risk report in a user interface.

6. A non-transitory computer readable storage medium that provides instructions, which when executed on a computer system cause the computer system to perform operations comprising:

obtaining a severity level associated with a data object, wherein the severity level is calculated based on presence of confidential information in the data object, the data object being a file or a folder, the severity level being calculated using a data loss prevention policy in response to a violation of the data loss prevention policy;

obtaining metadata associated with the data object based on a configuration parameter, the metadata comprising at least one of access permission data for the data object and access usage data for the data object, wherein the configuration parameter defines the metadata to obtain to calculate a risk score; and

calculating the risk score for the data object based on the severity level and the metadata associated with the data object.

7. The non-transitory computer readable storage medium of claim 6, wherein if the data object is a folder comprising one or more files the risk score for the folder comprises a risk score for each of the one or more files.

8. The non-transitory computer readable storage medium of claim 6, wherein the access permission data is a permission access control list is associated with a number of users permitted to access the data object.

9. The non-transitory computer readable storage medium of claim 6, wherein the access usage data for the data object defines historical data for the data object, the historical data comprising a number of users that have accessed the data object during a predetermined amount of time.

10. The non-transitory computer readable storage medium of claim 6, the operations further comprising:

assigning a weight to the risk score for the data object, wherein the weight is assigned based on a risk score of one or more other data objects to be included in a risk report;

creating the risk report including the weighted risk score for the data object; and

displaying the risk report in a user interface.

11. A system, comprising:

a memory; and

a processor coupled with the memory to

obtain a severity level associated with a data object, wherein the severity level is calculated based on presence of confidential information in the data object, the data object being a file or a folder, the severity level being calculated using a data loss prevention policy in response to a violation of the data loss prevention policy;

obtain metadata associated with the data object based on a configuration parameter, the metadata comprising at least one of access permission data for the data object and access usage data for the data object, wherein the configuration parameter defines the metadata to obtain to calculate a risk score; and

calculate the risk score for the data object based on the severity level and the metadata associated with the data object.

12. The system of claim 11, wherein the processor is further to:

assign a weight to the risk score for the data object, wherein the weight is assigned based on a risk score of one or more other data objects to be included in a risk report;

create the risk report including the weighted risk score for the data object; and

display the risk report in a user interface.