Access control techniques based on software bill of materials

1 . A method comprising:

identifying, by a service provider computing device, a number of software applications capable of being accessed by computing devices in an organization;

determining, by the service provider computing device, a number of components associated with the number of software applications;

identifying, by the service provider computing device, a number of current security threats associated with the number of components;

determining, by the service provider computing device based on the number of current security threats, a risk score associated with each of the number of software applications;

generating policy data by, for each of the computing devices in the organization:

receiving, at the service provider computing device in relation to the organization, an indication of a level of risk associated with a second computing device of the computing devices in the organization;

generating, by the service provider computing device based on the risk score associated with the number of software applications and the level of risk for the second computing device of the computing devices, an indication of at least one software application of the number of software application that cannot be accessed on the second computing device; and

combining the indications of the at least one software application associated with each of the computing devices in the organization into the policy data;

providing, by the service provider computing device, the policy data to at least one edge device associated with the organization, wherein the policy data is caused to be implemented in that:

upon detecting network traffic directed between a target computing device of the computing devices and a target software application, the at least one edge device is caused to make a determination as to whether the target computing device is prevented from accessing the target software application; and

upon determining that the target computing device is prevented from accessing the target software application, the at least one edge device is caused to block that network traffic.

2 . The method of claim 1 , wherein the number of components associated with the number of software applications is determined based on a software bill of materials.

3 . The method of claim 2 , wherein the software bill of materials is implemented as a blockchain ledger.

4 . The method of claim 1 , wherein the number of current security threats associated with the number of components is determined based on information obtained from a vulnerability management service.

5 . The method of claim 4 , wherein the information obtained from the vulnerability management service comprises, for each current security threat of the number of current security threats: at least one of an indication of a severity for the current security threat, a type or category of the current security threat, or an indication of one or more components that are affected by the current security threat.

6 . The method of claim 1 , wherein the risk score associated with each of the number of software applications is calculated based on a vulnerability of components associated with the respective software application to at least one current security threat of the number of current security threats.

7 . The method of claim 6 , wherein the risk score is further calculated based on a severity of the at least one current security threat or a type of the at least one current security threat.

8 . The method of claim 1 , wherein the number of software applications comprises at least one software application hosted on a remote server device.

9 . The method of claim 8 , wherein the at least one software application hosted on a remote server device comprise one or more cloud computing software applications hosted by a cloud computing platform.

10 . A service provider computing device comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the service provider computing device to perform operations comprising:

identifying a number of software applications capable of being accessed by computing devices in an organization;

determining a number of components associated with the number of software applications;

identifying a number of current security threats associated with the number of components;

determining, based on the number of current security threats, a risk score associated with each of the number of software applications;

generating policy data by, for each of the computing devices in the organization:

receiving, in relation to the organization, an indication of a level of risk associated with a second computing device of the computing devices in the organization;

generating, based on the risk score associated with the number of software applications and the level of risk for the second computing device of the computing devices, an indication of at least one software application of the number of software application that cannot be accessed on the second computing device; and

combining the indications of the at least one software application associated with each of the computing devices in the organization into the policy data;

providing the policy data to at least one edge device associated with the organization, wherein the policy data is caused to be implemented in that:

upon detecting network traffic directed between a target computing device of the computing devices and a target software application, the at least one edge device is caused to make a determination as to whether the target computing device is prevented from accessing the target software application; and

upon determining that the target computing device is prevented from accessing the target software application, the at least one edge device is caused to block that network traffic.

11 . The service provider computing device of claim 10 , wherein the level of risk for the second computing device of the computing devices in the organization comprises a maximum risk score threshold.

12 . The service provider computing device of claim 10 , wherein the level of risk for the second computing device of the computing devices in the organization is determined based on a role of a user associated with the second computing device.

13 . The service provider computing device of claim 10 , wherein the policy data comprises a blacklist that includes software applications that cannot be accessed by one or more individual computing devices of the computing devices in the organization.

14 . The service provider computing device of claim 10 , wherein the second computing device comprises a personal computing device operated by a user.

15 . One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

identifying a number of software applications capable of being accessed by computing devices in an organization;

determining a number of components associated with the number of software applications;

identifying a number of current security threats associated with the number of components;

determining, based on the number of current security threats, a risk score associated with each of the number of software applications;

generating policy data by, for each of the computing devices in the organization:

receiving, in relation to the organization, an indication of a level of risk associated with a second computing device of the computing devices in the organization;

generating, based on the risk score associated with the number of software applications and the level of risk for the second computing device of the computing devices an indication of at least one software application of the number of software application that can or cannot be accessed on the second computing device; and

combining the indications of the at least one software application associated with each of the computing devices in the organization into the policy data; and

providing the policy data to at least one edge device associated with the organization, wherein the policy data is caused to be implemented in that;

upon detecting network traffic directed between a target computing device of the computing devices and a target software application, the at least one edge device is caused to make a determination as to whether the target computing device is prevented from accessing the target software application; and

upon determining that the target computing device is prevented from accessing the target software application the at least one edge device is caused to block that network traffic.

16 . The one or more non-transitory computer-readable media of claim 15 , wherein the number of components associated with the number of software applications is determined based on a software bill of materials.

17 . The one or more non-transitory computer-readable media of claim 15 , wherein the number of current security threats associated with the number of components is determined based on information obtained from a vulnerability management service.

18 . The one or more non-transitory computer-readable media of claim 17 , wherein the information obtained from the vulnerability management service comprises, for each current security threat of the number of current security threats: at least one of an indication of a current severity threat, a type or category of the current security threat, or an indication of one or more components that are affected by the current security threat.