Automatic resource ownership assignment system and method

• US 9,372,862 B2
• Filed: 09/26/2014
• Issued: 06/21/2016
• Est. Priority Date: 05/12/2011
• Status: Active Grant

• Current Assignee: Varonis Systems, Inc.
• Original Assignee: Varonis Systems, Inc.
• Inventors: Faitelson, Yakov, Korkus, Ohad, Kretzer-Katzir, Ophir
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US14/498,373
• Publication Number:
  US 20150012573A1
• Time in Patent Office: 634 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/16 File or folder operations, e.g. details of user interfaces specifically adapted to file systems
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 16/185 Hierarchical storage management [HSM] systems, e.g. file migration or policies thereof details of archiving G06F16/11
• CPC Class Codes: G06F 16/192 Implementing virtual folder structures
• CPC Class Codes: G06F 16/90324 using system suggestions
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A method for automatic folder ownership assignment, including ascertaining which first folders, among a first multiplicity of folders, have at least one of modify and write permissions to non-IT administration entities, adding the first folders to a list of candidates for ownership assignment, defining a second multiplicity of folders which is a subset of the first multiplicity of folders and not including the first folders and descendents and ancestors thereof, ascertaining which second folders among the second multiplicity of folders, have permissions to non-IT administration entities, adding the second folders to the candidates, defining a third multiplicity of folders, which is a subset of the second multiplicity of folders and not including the second folders and descendents and ancestors thereof, ascertaining which third folders among the third multiplicity of folders are topmost folders, adding the third folders to the candidates, and recommending possible assignment of ownership of the candidates.

Claims

1. A system for automatic folder ownership assignment in an enterprise computer network, the system comprising at least one computer processor and one memory implementing the following functionalities:

modify/write permissions scrutinizing functionality operative for ascertaining which first folders, among a first multiplicity of folders in an enterprise computer network, have at least one of modify and write permissions to entities other than IT administration entities, and adding said first folders to a list of base-folder candidates for ownership assignment;

first pruning functionality operative for defining a second multiplicity of folders, said second multiplicity of folders being a subset of said first multiplicity of folders which does not include said first folders, all descendents of said first folders and all ancestors of said first folders;

permissions scrutinizing functionality operative for ascertaining which second folders among said second multiplicity of folders, have read permissions to entities other than IT administration entities and adding said second folders to said list of base-folder candidates for ownership assignment;

second pruning functionality operative for defining a third multiplicity of folders, said third multiplicity of folders being a subset of said second multiplicity of folders which does not include said second folders, all descendents of said second folders and all ancestors of said second folders;

topmost folder scrutinizing functionality operative for ascertaining which third folders among said third multiplicity of folders are topmost folders and adding said third folders to said list of base-folder candidates for ownership assignment; and

possible ownership assignment recommendation functionality operative for recommending possible assignment of ownership of at least one of said list of base-folder candidates.

2. A system for automatic folder ownership assignment in an enterprise computer network, the system comprising at least one computer processor and one memory implementing the following functionalities:

modify/write permissions scrutinizing functionality operative for ascertaining which first folders, among a first multiplicity of folders in an enterprise computer network, have at least one of modify and write permissions to entities other than IT administration entities and comprise at least sensitive content, and adding said first folders to a list of base-folder candidates for ownership assignment;

first pruning functionality operative for defining a second multiplicity of folders, said second multiplicity of folders being a subset of said first multiplicity of folders which does not include said first folders, all descendents of said first folders and all ancestors of said first folders;

permissions scrutinizing functionality operative for ascertaining which second folders among said second multiplicity of folders, have read permissions to entities other than IT administration entities and comprise at least sensitive content, and adding said second folders to said list of base-folder candidates for ownership assignment;

second pruning functionality operative for defining a third multiplicity of folders, said third multiplicity of folders being a subset of said second multiplicity of folders which does not include said second folders, all descendents of said second folders and all ancestors of said second folders;

topmost folder scrutinizing functionality operative for ascertaining which third folders among said third multiplicity of folders are topmost folders and adding said third folders to said list of base-folder candidates for ownership assignment; and

possible ownership assignment recommendation functionality operative for recommending possible assignment of ownership of at least one of said list of base-folder candidates.