Policy violation detection using a multi-sourced unified data model
Systems, devices, and computer-implemented methods are presented for monitoring distinct enterprise systems for violations of security policies. In one embodiment, a network security system collects data from a plurality of monitored systems within an enterprise and generates a unified data model using the data. The unified data model establishes connections between two or more of the monitored systems, and more particularly, between objects within the monitored systems based on matching corresponding parameters. The connections provide the network security system with insight into other data in the monitored systems allowing the network security system to identify violations of security policies by leveraging the connections. The network security system can output alerts and remediate the violations in a given monitored system.
1 . A computer-implemented method, comprising:
obtaining, by a network security system (NSS), first data from a first monitored system associated with an enterprise;
obtaining, by the NSS, second data from a second monitored system associated with the enterprise;
generating, by the NSS, a unified data model using the first data and the second data, wherein generating the unified data model comprises:
identifying a first parameter of a first object in the first data and a first parameter of a second object in the second data based at least in part on the first parameters of the first and second objects matching, and establishing a connection between the first object and the second object based on the identification; and
identifying, by the NSS, a violation of a security policy of the enterprise based on searching the unified data model in response to identifying a change in one or more of the first data and the second data, wherein the searching comprises leveraging the connection and a second parameter of the first object to find corresponding information in the second data that is associated with the second parameter and in violation of the security policy.
2 . The method of claim 1 , further comprising:
responsive to identifying the violation of the security policy, updating, by the NSS, the corresponding information in the second data of the second monitored system to remediate the violation of the security policy.
3 . The method of claim 1 , wherein:
the first parameters of the first and second objects include a user identifier associated with a user account of the first and second monitored systems;
the second parameter of the first object includes a role associated with the user account; and
the corresponding information in the second data includes an access parameter of a document indicating authorized access to the document by user accounts having a different role than the role associated with the user account, and an indication of access of the document by the user account in violation of the security policy.
4 . The method of claim 1 , wherein:
the first parameters of the first and second objects include a user identifier associated with a user account of the first and second monitored systems;
the second parameter of the first object includes a terminated employment status associated with the user account; and
the corresponding information in the second data includes a valid login key parameter indicating authorized access to the second monitored system by user accounts having an active employment status, and an indication of a valid login key parameter associated with the user account in violation of the security policy.
5 . The method of claim 1 , further comprising:
obtaining, by the NSS, third data from a third monitored system associated with the enterprise; and
updating, by the NSS, the unified data model using the third data, wherein updating the unified data model comprises:
identifying a first parameter of a third object in the third data and the first parameter of the second object in the second data based at least in part on the first parameters of the second and third objects matching,
establishing a connection between the second object and the third object based on the identification, and
establishing a connection between the first object and the third object based on the connection between the second object and the third object.
6 . The method of claim 1 , wherein identifying the change in the one or more of the first data and the second data comprises receiving a notification from a respective one of the first monitored system or the second monitored system.
7 . The method of claim 1 , wherein searching the unified data model comprises searching, by the NSS, the unified data model responsive to receiving, via a user interface of the NSS, a security policy query that includes indications of the security policy with respect to objects and parameters of the first data and objects and parameters of the second data, and wherein the method further comprises displaying, by the NSS, an indication of the violation of the security policy on the user interface.
8 . The method of claim 7 , wherein receiving the security policy query via the user interface of the NSS comprises, by the NSS:
exposing the objects and the parameters of the first and second data in a first code language;
receiving the indications of the security policy in accordance with the first code language; and
converting the indications from the first code language to a second code language native to the unified data model and with which to search the unified data model, facilitating generation of the security policy query.
9 . The method of claim 1 , wherein searching the unified data model comprises, by the NSS:
receiving, via a user interface of the NSS, a security policy query that includes indications of the security policy with respect to objects and parameters of the first data and objects and parameters of the second data;
enqueuing the security policy query in a queue; and
searching the unified data model based on the enqueued security policy query on a periodic basis.
10 . The method of claim 1 , wherein:
the first and second objects comprise one of:
a user account,
a document,
a task,
an asset,
and an event; and
the first and second parameters comprise one of:
a user identifier,
a role,
a user status,
a document status,
a document type,
a company category, and
a permissions indicator.
11 . The method of claim 1 , further comprising:
responsive to identifying the violation of the security policy, outputting, by the NSS, a notification of the violation of the security policy.
12 . A computing apparatus comprising:
one or more computer-readable storage media; and program instructions stored on the one or more computer-readable storage media executable by a processor of a device that, based on being read and executed by the processor of the device, direct the processor of the device to:
obtain first data from a first monitored system associated with an enterprise;
obtain second data from a second monitored system associated with the enterprise;
generate a unified data model using the first data and the second data, wherein to generate the unified data model, the program instructions direct the processor of the device to:
identify a first parameter of a first object in the first data and a first parameter of a second object in the second data based at least in part on the first parameters of the first and second objects matching, and establish a connection between the first object and the second object based on the identification; and
identify a violation of a security policy of the enterprise based on searching the unified data model in response to identifying a change in one or more of the first data and the second data, wherein the searching comprises leveraging the connection and a second parameter of the first object to find corresponding information in the second data that is associated with the second parameter and in violation of the security policy.
13 . The computing apparatus of claim 12 , wherein the program instructions further direct the processor of the device to:
responsive to identifying the violation of the security policy, update the corresponding information in the second data of the second monitored system to remediate the violation of the security policy.
14 . The computing apparatus of claim 12 , wherein:
the first parameters of the first and second objects include a user identifier associated with a user account of the first and second monitored systems;
the second parameter of the first object includes a role associated with the user account; and
the corresponding information in the second data includes an access parameter of a document indicating authorized access to the document by user accounts having a different role than the role associated with the user account, and an indication of access of the document by the user account in violation of the security policy.
15 . The computing apparatus of claim 12 , wherein:
the first parameters of the first and second objects include a user identifier associated with a user account of the first and second monitored systems;
the second parameter of the first object includes a terminated employment status associated with the user account; and
the corresponding information in the second data includes a valid login key parameter indicating authorized access to the second monitored system by user accounts having an active employment status, and an indication of a valid login key parameter associated with the user account in violation of the security policy.
16 . The computing apparatus of claim 12 , wherein the program instructions further direct the processor of the device to:
obtain third data from a third monitored system associated with the enterprise; and
update the unified data model using the third data, wherein to update the unified data model, the program instructions direct the processor of the device to:
identify a first parameter of a third object in the third data and the first parameter of the second object in the second data based at least in part on the first parameters of the second and third objects matching,
establish a connection between the second object and the third object based on the identification, and
establish a connection between the first object and the third object based on the connection between the second object and the third object.
17 . The computing apparatus of claim 12 , wherein to search the unified data model, the program instructions direct the processor of the device to search the unified data model responsive to receiving, via a user interface, a security policy query that includes indications of the security policy with respect to objects and parameters of the first data and objects and parameters of the second data, and wherein the program instructions further direct the processor of the device to display an indication of the violation of the security policy on the user interface.
18 . A system comprising:
a memory;
a data collection engine configured to:
obtain first data from a first monitored system associated with an enterprise, and obtain second data from a second monitored system associated with the enterprise;
a connector engine configured to:
generate a unified data model using the first data and the second data, wherein to generate the unified data model, the connector engine is configured to: identify a first parameter of a first object in the first data and a first parameter of a second object in the second data based at least in part on the first parameters of the first and second objects matching, and establish a connection between the first object and the second object based on the identification; and
a security policy query engine configured to:
identify a violation of a security policy of the enterprise based on searching the unified data model in response to identifying a change in one or more of the first data and the second data, wherein the searching comprises leveraging the connection and a second parameter of the first object to find corresponding information in the second data that is associated with the second parameter and in violation of the security policy.
19 . The system of claim 18 , wherein the security policy query engine is further configured to:
responsive to identifying the violation of the security policy, update the corresponding information in the second data of the second monitored system to remediate the violation of the security policy.
20 . The system of claim 18 , wherein:
the system further comprises a user interface engine configured to:
provide a user interface,
receive a security policy query that includes indications of the security policy with respect to objects and parameters of the first data and objects and parameters of the second data via the user interface, and
provide the security policy query to the connector engine;
to search the unified data model, the connector engine is configured to search the unified data model responsive to receiving the security policy query; and
the user interface engine is further configured to display an indication of the violation of the security policy on the user interface.