Cybersecurity policy enforcement via correlation between entities and resource access

1 . A method for policy enforcement, comprising:

extracting access properties for an access event from access data indicating the access event, wherein the access properties include a time of the access event and a source of a first entity which initiated the access event;

correlating the access properties with entity data of a plurality of second entities in order to identify the first entity among the plurality of second entities, wherein the entity data indicates a corresponding source of each of the plurality of second entities at the time of the access event, wherein the source of each of the plurality of second entities is unique among the plurality of second entities such that only the second entity among the plurality of second entities has the corresponding source at the time of the access event, wherein the source of each of the plurality of second entities is determined based on a source identifier that uniquely identifies the corresponding second entity; and

applying a security policy based on the access event and the first entity identified as the first entity which initiated the access event.

2 . The method of claim 1 , wherein the entity data includes a plurality of network addresses of the plurality of second entities.

3 . The method of claim 2 , wherein the source of the first entity is a network address of the first entity, wherein correlating the access properties with the entity data further comprises matching the network address of the accessing entity to a first network address of the plurality of network addresses of the plurality of second entities.

4 . The method of claim 1 , further comprising:

determining at least one access activity based on the correlation, wherein the at least one access activity is performed in order to at least attempt to access a resource by the first entity; and

sending a notification indicating the first entity which initiated the access event and the resource that the first entity attempted to access via the at least one access activity.

5 . The method of claim 1 , wherein the first entity initiated the access event via an intermediary, further comprising:

identifying the intermediary based on the extracted access properties; and

analyzing data of the intermediary in order to identify the source of the first entity and the time of the access event.

6 . The method of claim 5 , where the intermediary is a secrets manager, wherein the data of the intermediary includes an access log of the secrets manager, wherein the access log of the secrets manager indicates the first entity as an entity which used the secrets manager during the access event.

7 . The method of claim 1 , further comprising:

detecting a violation of the security policy based on the identified first entity.

8 . The method of claim 7 , further comprising:

performing at least one remediation action based on the detected violation of the security policy.

9 . The method of claim 7 , further comprising:

determining that the identified accessing entity is inactive, wherein the violation of the security policy is detected based on the inactive accessing entity initiating the access event.

10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

extracting access properties for an access event from access data indicating the access event, wherein the access properties include a time of the access event and a source of a first entity which initiated the access event;

correlating the access properties with entity data of a plurality of second entities in order to identify the first entity among the plurality of second entities, wherein the entity data indicates a corresponding source of each of the plurality of second entities at the time of the access event, wherein the source of each of the plurality of second entities is unique among the plurality of second entities such that only the second entity among the plurality of second entities has the corresponding source at the time of the access event, wherein the source of each of the plurality of second entities is determined based on a source identifier that uniquely identifies the corresponding second entity; and

applying a security policy based on the access event and the first entity identified as the first entity which initiated the access event.

11 . A system for policy enforcement, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

extract access properties for an access event from access data indicating the access event, wherein the access properties include a time of the access event and a source of a first entity which initiated the access event;

correlate the access properties with entity data of a plurality of second entities in order to identify the first entity among the plurality of second entities, wherein the entity data indicates a corresponding source of each of the plurality of second entities at the time of the access event, wherein the source of each of the plurality of second entities is unique among the plurality of second entities such that only the second entity among the plurality of second entities has the corresponding source at the time of the access event, wherein the source of each of the plurality of second entities is determined based on a source identifier that uniquely identifies the corresponding second entity; and

apply a security policy based on the access event and the first entity identified as the entity which initiated the access event.

12 . The system of claim 11 , wherein the entity data includes a plurality of network addresses of the plurality of second entities.

13 . The system of claim 12 , wherein the source of the first entity is a network address of the first entity, wherein correlating the access properties with the entity data further comprises matching the network address of the accessing entity to a first network address of the plurality of network addresses of the plurality of second entities.

14 . The system of claim 11 , wherein the system is further configured to:

determine at least one access activity based on the correlation, wherein the at least one access activity is performed in order to at least attempt to access a resource by the first entity; and

sending a notification indicating the first entity which initiated the access event and the resource that the first entity attempted to access via the at least one access activity.

15 . The system of claim 11 , wherein the first entity initiated the access event via an intermediary, wherein the system is further configured to:

identify the intermediary based on the extracted access properties; and

analyze data of the intermediary in order to identify the source of the first entity and the time of the access event.

16 . The system of claim 15 , where the intermediary is a secrets manager, wherein the data of the intermediary includes an access log of the secrets manager, wherein the access log of the secrets manager indicates the first entity as an entity which used the secrets manager during the access event.

17 . The system of claim 11 , wherein the system is further configured to:

detect a violation of the security policy based on the identified first entity.

18 . The system of claim 17 , wherein the system is further configured to:

perform at least one remediation action based on the detected violation of the security policy.

19 . The system of claim 17 , wherein the system is further configured to:

determine that the identified accessing entity is inactive, wherein the violation of the security policy is detected based on the inactive accessing entity initiating the access event.