Access permissions entitlement review

• US 9,912,672 B2
• Filed: 04/13/2017
• Issued: 03/06/2018
• Est. Priority Date: 09/09/2009
• Status: Active Grant

• Current Assignee: Varonis Systems, Inc.
• Original Assignee: Varonis Systems, Inc.
• Inventors: Faitelson, Yakov, Korkus, Ohad, Kretzer-Katzir, Ophir, Bass, David
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): WYSZYNSKI, AUBREY H
• Application Number:
  US15/486,782
• Publication Number:
  US 20170223025A1
• Time in Patent Office: 327 Days
• Field of Search: 726 4
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system for operating an enterprise computer network including multiple network objects, said system comprising monitoring and collection functionality for obtaining continuously updated information regarding at least one of access permissions and actual usage of said network objects, and entitlement review by owner functionality operative to present to at least one owner of at least one network object a visually sensible indication of authorization status including a specific indication of users which were not yet authorized by said at least one owner of said at least one network object.

Claims

1. A system for operating an enterprise computer network including multiple network objects, said system comprising:

at least one monitoring and collection module for obtaining continuously updated information regarding at least one of access permissions and actual usage of said network objects;

background data characterization functionality operable for characterizing network objects of interest at least by at least one content characteristic thereof;

near real time data matching functionality operable for selecting the data of interest by considering only data elements which have said at least one content characteristic thereof from among said multiple network objects; and

at least one entitlement review by owner module operative;

to present to at least one of at least one owner and at least one authorizer of at least one said selected network object a visually sensible indication of authorization status, said visually sensible indication of authorization status including at least a list of users and user groups having access permissions to said at least one said selected network object, said at least one authorizer being delegated responsibility with respect to said at least one said selected network object by said at least one owner;

to require said at least one of said at least one owner and said at least one authorizer to review said authorization status;

responsive to said review, to allow said at least one of said at least one owner and said at least one authorizer to modify said authorization status;

responsive to said at least one of said at least one owner and said at least one authorizer not modifying said authorization status, to require said at least one of said at least one owner and said at least one authorizer to confirm said authorization status; and

responsive to said at least one of said at least one owner and said at least one authorizer modifying said authorization status, to require said at least one of said at least one owner and said at least one authorizer to confirm said modified authorization status.

2. A system according to claim 1 and wherein said system resides on a computer server which is connected to an enterprise level network to which is connected a multiplicity of computers and storage devices.

3. A system according to claim 1 and wherein said visually sensible indication of authorization status comprises a list of network objects owned by said at least one owner of said at least one said selected network object.

4. A system according to claim 3 and wherein for each of said list of network objects, said visually sensible indication of authorization status comprises a list of users and user groups having access permissions to said each of said list of network objects.

5. A system according to claim 4 and wherein for each of said list of users and user groups having access permissions to said each of said list of network objects said authorization status comprises at least:

an indication of whether said access permissions were not authorized by said at least one of said at least one owner and said at least one authorizer of said at least one said selected network object; and

a revocation recommendation to said at least one of said at least one owner and said at least one authorizer of said at least one said selected network object recommending whether said access permissions should be revoked from the user or user group.

6. A system according to claim 5 and wherein said revocation recommendation comprises a textual justification for said revocation recommendation.

7. A system according to claim 6 and wherein said at least one entitlement review by owner module comprises at least one access permissions modifying module.

8. A system according to claim 7 and wherein said at least one access permissions modifying module is preset to modify access permissions in accordance with said revocation recommendations.

9. A system according to claim 8 and wherein when said at least one of said at least one owner and said at least one authorizer of said at least one said selected network object utilizes said at least one access permissions modifying module to modify access permissions to any of said list of network objects, said at least one entitlement review by owner module requires said at least one of said at least one owner and said at least one authorizer of said at least one said selected network object to write a justification for modifying access permissions to any of said list of network objects.

10. A system according to claim 8 and wherein when said at least one of said at least one owner and said at least one authorizer of said at least one said selected network object chooses to disregard said revocation recommendation associated with said at least one selected network object, said at least one entitlement review by owner module requires said at least at least one of said one owner and said at least one authorizer of said at least one said selected network object to write a justification for disregarding said revocation recommendation associated with said at least one said selected network object.