Community-based situation-aware access control enforcement in zero trust architectures
One example method includes identifying, in a knowledge graph that represents a ZT (zero trust) environment, communities that each comprise one or more entities, computing a risk of granting access to one of the entities, when the risk exceeds a threshold, alerting the ZT environment in its entirety about a possible threat involving the entity regarding which the risk was computed, and propagating information about the threat to the entities that are members of the community to which the one entity belongs.
1 . A method for controlling access in zero-trust architectures, said method comprising:
identifying, in a knowledge graph that represents a ZT (zero trust) environment, communities that each comprise one or more entities;
computing a risk of granting access to one of the entities;
computing a confidence score for the entity using a function that takes as input the risk of granting the access to the entity;
evaluating, by a policy decision point, the risk in conjunction with a tolerance for the entity, wherein the policy decision point determines whether a combination of the risk and the tolerance for the entity meets a threshold;
when the combination of the risk and the tolerance exceeds the threshold, alerting the ZT environment in its entirety about a possible threat involving the entity regarding which the risk was computed;
propagating the confidence score to other members of the community to which the entity belongs; and
in response to the propagated confidence score, updating, for the other members of the community, confidence scores for those other members according to the propagated confidence score, wherein the updated confidence scores are usable to re-evaluate access policies within the ZT environment.
2 . The method as recited in claim 1 , wherein the communities are identified using a CD (community detection) algorithm.
3 . The method as recited in claim 1 , wherein the identification of the communities is performed automatically.
4 . The method as recited in claim 1 , wherein the risk is determined as a function of respective conditions of the entities that are members of the community to which the one entity belongs.
5 . The method as recited in claim 1 , wherein the risk is determined dynamically in response to a change in conditions of one of the entities.
6 . The method as recited in claim 1 , wherein the risk of granting access to one of the entities comprises a risk that the one entity represents a threat to a network resource to which the entity has requested, or may request, access to.
7 . The method as recited in claim 1 , wherein the entities comprise respective hardware and/or software.
8 . The method as recited in claim 1 , wherein access is granted to the entity when the risk is below the threshold.
9 . The method as recited in claim 1 , wherein computing the risk comprises computing a risk for an application operating as one of the entities in the ZT environment, and the risk for the application is a function of one or both of a sensitivity of the application to a threat, and a risk tolerance of the application.
10 . The method as recited in claim 1 , wherein when the possible threat is detected, respective confidence scores of one or more of the entities are updated.
11 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
identifying, in a knowledge graph that represents a ZT (zero trust) environment, communities that each comprise one or more entities;
computing a risk of granting access to one of the entities;
computing a confidence score for the entity using a function that takes as input the risk of granting the access to the entity;
evaluating, by a policy decision point, the risk in conjunction with a tolerance for the entity, wherein the policy decision point determines whether a combination of the risk and the tolerance for the entity meets a threshold;
when the combination of the risk and the tolerance exceeds the threshold, alerting the ZT environment in its entirety about a possible threat involving the entity regarding which the risk was computed;
propagating the confidence score to other members of the community to which the entity belongs; and
in response to the propagated confidence score, updating, for the other members of the community, confidence scores for those other members according to the propagated confidence score, wherein the updated confidence scores are usable to re-evaluate access policies within the ZT environment.
12 . The non-transitory storage medium as recited in claim 11 , wherein the communities are identified using a CD (community detection) algorithm.
13 . The non-transitory storage medium as recited in claim 11 , wherein the identification of the communities is performed automatically.
14 . The non-transitory storage medium as recited in claim 11 , wherein the risk is determined as a function of respective conditions of the entities that are members of the community to which the one entity belongs.
15 . The non-transitory storage medium as recited in claim 11 , wherein the risk is determined dynamically in response to a change in conditions of one of the entities.
16 . The non-transitory storage medium as recited in claim 11 , wherein the risk of granting access to one of the entities comprises a risk that the one entity represents a threat to a network resource to which the entity has requested, or may request, access to.
17 . The non-transitory storage medium as recited in claim 11 , wherein the entities comprise respective hardware or software.
18 . The non-transitory storage medium as recited in claim 11 , wherein access is granted to the entity when the risk is below the threshold.
19 . The non-transitory storage medium as recited in claim 11 , wherein computing the risk comprises computing a risk for an application operating as one of the entities in the ZT environment, and the risk for the application is a function of one or both of a sensitivity of the application to a threat, and a risk tolerance of the application.
20 . The non-transitory storage medium as recited in claim 11 , wherein when the possible threat is detected, respective confidence scores of one or more of the entities are updated.