Security configuration optimizer systems and methods
Security configuration optimizer system and methods create optimized access control policies. The systems and methods analyze constraints on the secured system and produce a plurality of proposals for an updated security configuration. The proposals are analyzed and filtered. A resulting set of proposals are graded or ranked according to a variety of desirable outcomes. A proposal is selected according to criteria based on the balance of security and complexity. The security configuration is updated according to the selected proposal.
1 . A computer implemented method for configuring a system utilizing cloud computing resources, the method comprising:
generating a first plurality of proposals for a security configuration for the system, each proposal in the first plurality including a set of privileges for accessing the system and its cloud computing resources by at least one principal, at least one proposal of the first plurality of proposals having the set of required privileges and the remaining proposals of the first plurality having the set of required privileges and optional privileges;
scoring each proposal in the first plurality of proposals with a score assigned to indicate a proposal fitness;
filtering the first plurality of proposals to produce a second plurality of proposals, where proposals in the second plurality are fewer in number than proposals in the first plurality of proposals;
evaluating, using proposal metrics, each proposal in the second plurality of proposals for risk and complexity to produce a third plurality of proposals; and
selecting a proposal from the third plurality of proposals to implement in the secured system,
wherein selecting a proposal from the third plurality comprises selecting the proposal representing maximal access by the at least one principal with minimal risk to the secured system, where the selected proposal from the third plurality includes only required privileges for the at least one principal and no optional privileges, and the selection is executed using one or more fork trees among the third plurality of proposals.
2 . The method of claim 1 , wherein generating the first plurality of proposals comprises generating permission policies based on information and receiving the policy information, the permission policies specifying what actions are permitted for multiple identities.
3 . The method of claim 1 , wherein the at least one principal comprises a user or administrator entity with permission policies, and the set of required privileges includes read permissions for target actions while optional privileges include non-removed permissions such as write-log actions.
4 . The method of claim 1 , wherein scoring each proposal in the first plurality of proposals comprises creating a higher or lower privilege score based on permissions policies corresponding to risk scores and viewing scores in different departments.
5 . The method of claim 1 , wherein filtering the first plurality of proposals comprises applying one or more filters to reduce the number of proposals to a manageable level for system efficiency reasons.
6 . The method of claim 1 , wherein evaluating each proposal in the second plurality of proposals comprises using proposal metrics related to the proposal fitness, each proposal in the second plurality for risk and complexity to produce the third plurality.