Dynamic optimizing scanner for identity and access management (IAM) compliance verification

• US 9,942,261 B2
• Filed: 03/21/2017
• Issued: 04/10/2018
• Est. Priority Date: 12/03/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Harter, John Leslie, Palmieri, David Walsh, Robke, Jeffrey Tobias
• Primary Examiner(s): Hoffman, Brandon S
• Application Number:
  US15/464,746
• Publication Number:
  US 20170195360A1
• Time in Patent Office: 385 Days
• Field of Search: None
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

An identity and access management (IAM) system is associated with a set of data sources from which data is collected. A set of vulnerabilities that the IAM system should attempt to detect is identified. For each vulnerability to be detected, a prioritized list of strategies used to detect that vulnerability is generated. Preferably, each strategy specifies the type(s) of data required to detect that vulnerability. An algorithm to determine a best strategy to be used for detecting each vulnerability, preferably based on the data available from the data sources, is then identified. The IAM system then collects data in an optimized manner. In particular, during the collection process, the IAM system preferably collects only what is necessary based on the configuration, even if the data source is capable of providing additional data. The collected data is then processed to detect security vulnerabilities associated with the IAM accounts.

Claims

1. A method to facilitate detection of security vulnerabilities in accounts provisioned in an identity and access management (IAM) system, comprising:

determining types of data supported by a set of data sources;

based on the types of data supported by the set of data sources, determining a set of one or more vulnerability detection strategies to apply to detect the security vulnerabilities;

based on the set of one or more vulnerability detection strategies, collecting data from the data sources, wherein during data collection a given data source of the set of data sources is invoked just once to collect data for all of the set of one or more vulnerability detection strategies;

based on the data collected, executing the set of one or more vulnerability detection strategies; and

updating at least one vulnerability detection strategy as the set of data sources is changed or updated.

2. The method as described in claim 1 wherein first and second data sources of the set of data sources provide distinct types of data from one another.

3. The method as described in claim 1 wherein the types of data include one of:

live data, static data, and a combination of live and static data.

4. The method as described in claim 1 wherein determining a set of one or more vulnerability detection strategies determines a strategy for vulnerability detection that, relative to at least one other strategy for vulnerability detection, is optimized based on the types of data supported by the set of data sources.

5. The method as described in claim 1 wherein determining a set of one or more vulnerability detection strategies determines a strategy for vulnerability detection that, relative to at least one other strategy for vulnerability detection, is optimized based on an operating environment in which the security vulnerabilities are to be detected.

6. The method as described in claim 1 wherein the IAM system is associated with a multi-tenant cloud compute environment, and wherein a vulnerability detection strategy for a first tenant is distinct from a vulnerability detection strategy for a second tenant.

7. An apparatus, comprising:

a processor;

computer memory holding computer program instructions executed by the processor to facilitate detection of security vulnerabilities in accounts provisioned in an identity and access management (IAM) system, the computer program instructions operative to;

determine types of data supported by a set of data sources;

based on the types of data supported by the set of data sources, determine a set of one or more vulnerability detection strategies to apply to detect the security vulnerabilities;

based on the set of one or more vulnerability detection strategies, collect data from the data sources, wherein during data collection a given data source of the set of data sources is invoked just once to collect data for all of the set of one or more vulnerability detection strategies;

based on the data collected, execute the set of one or more vulnerability detection strategies; and

update at least one vulnerability detection strategy as the set of data sources is changed or updated.

8. The apparatus as described in claim 7 wherein first and second data sources of the set of data sources provide distinct types of data from one another.

9. The apparatus as described in claim 7 wherein the types of data include one of:

live data, static data, and a combination of live and static data.

10. The apparatus as described in claim 7 wherein the computer program instructions that determine a set of one or more vulnerability detection strategies determine a strategy for vulnerability detection that, relative to at least one other strategy for vulnerability detection, is optimized based on the types of data supported by the set of data sources.

11. The apparatus as described in claim 7 wherein the computer program instructions that determine a set of one or more vulnerability detection strategies determine a strategy for vulnerability detection that, relative to at least one other strategy for vulnerability detection, is optimized based on an operating environment in which the security vulnerabilities are to be detected.

12. The apparatus as described in claim 7 wherein the IAM system is associated with a multi-tenant cloud compute environment, and wherein a vulnerability detection strategy for a first tenant is distinct from a vulnerability detection strategy for a second tenant.

13. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, facilitate detection of security vulnerabilities in accounts provisioned in an identity and access management (IAM) system, the computer program instructions operative to:

determine types of data supported by a set of data sources;

based on the types of data supported by the set of data sources, determine a set of one or more vulnerability detection strategies to apply to detect the security vulnerabilities;

based on the set of one or more vulnerability detection strategies, collect data from the data sources, wherein during data collection a given data source of the set of data sources is invoked just once to collect data for all of the set of one or more vulnerability detection strategies;

based on the data collected, execute the set of one or more vulnerability detection strategies; and

update at least one vulnerability detection strategy as the set of data sources is changed or updated.

14. The computer program product as described in claim 13 wherein first and second data sources of the set of data sources provide distinct types of data from one another.

15. The computer program product as described in claim 13 wherein the types of data include one of:

live data, static data, and a combination of live and static data.

16. The computer program product as described in claim 13 wherein the computer program instructions that determine a set of one or more vulnerability detection strategies determine a strategy for vulnerability detection that, relative to at least one other strategy for vulnerability detection, is optimized based on the types of data supported by the set of data sources.

17. The computer program product as described in claim 13 wherein the computer program instructions that determine a set of one or more vulnerability detection strategies determine a strategy for vulnerability detection that, relative to at least one other strategy for vulnerability detection, is optimized based on an operating environment in which the security vulnerabilities are to be detected.

18. The computer program product as described in claim 13 wherein the IAM system is associated with a multi-tenant cloud compute environment, and wherein a vulnerability detection strategy for a first tenant is distinct from a vulnerability detection strategy for a second tenant.