Techniques for providing identity cybersecurity risk assessment in digital environments

1 . A method for generating a cybersecurity risk profile based on an identity in a computing environment, comprising:

detecting a plurality of identities in a computing environment, each identity including a permission to initiate an action in the computing environment;

querying an identity and access management service to detect a permission associated with a first identity of the plurality of identities;

accessing an activity log of the computing environment;

parsing the activity log to detect an event based on the first identity;

generating an identity risk profile based on: the detected event, and the detected permission; and

determining whether the detected event represents anomalous activity by comparing the detected event and the detected permission against an individualized historical baseline statistically generated specifically for the first identity, wherein the individualized historical baseline comprises statistical measures computed from historical activities uniquely associated with the first identity, and wherein anomalous activity is identified in real-time responsive to detecting a deviation of the event in view of the detected permission from the individualized historical baseline exceeding a predetermined threshold,

wherein detecting the deviation comprises determining, based on the individualized historical baseline, a probability that the first identity initiates an action corresponding to the detected event in view of the detected permission, and wherein the deviation exceeds the predeterm ined threshold when the probability is below the predetermined threshold.

2 . The method of claim 1 , further comprising:

receiving a request to access a resource in the computing environment, the request including an identifier of the first identity; and

determining a cybersecurity risk score based on the resource, and the identity risk profile.

3 . The method of claim 2 , further comprising:

providing access to the resource in response to determining that the cybersecurity risk score exceeds a threshold; and

denying access to the resource in response to determining that the cybersecurity risk score is below the threshold.

4 . The method of claim 2 , further comprising:

initiating a mitigation action in response to detecting that the cybersecurity risk score exceeds a predetermined threshold.

5 . The method of claim 4 , further comprising:

generating an alert based on the mitigation action.

6 . The method of claim 4 , further comprising:

generating a network traffic policy in response to initiating the mitigation action.

7 . The method of claim 6 , further comprising:

configuring a firewall in the computing environment to filter network traffic based on the generated network traffic policy.

8 . The method of claim 1 , further comprising:

detecting new activity in the activity log for the first identity; and

updating the identity risk profile based on the detected new activity.

9 . The method of claim 1 , further comprising:

generating an activity baseline for the first identity based on a plurality of events detected in the activity log.

10 . A non-transitory computer-readable medium storing a set of instructions for generating a cybersecurity risk profile based on an identity in a computing environment, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

detect a plurality of identities in a computing environment, each identity including a permission to initiate an action in the computing environment;

query an identity and access management service to detect a permission associated with a first identity of the plurality of identities;

access an activity log of the computing environment;

parse the activity log to detect an event based on the first identity;

generate an identity risk profile based on: the detected event, and the detected permission; and

determine whether the detected event represents anomalous activity by comparing the detected event and the detected permission against an individualized historical baseline statistically generated specifically for the first identity, wherein the individualized historical baseline comprises statistical measures computed from historical activities uniquely associated with the first identity, and wherein anomalous activity is identified in real-time responsive to detecting a deviation of the event in view of the detected permission from the individualized historical baseline exceeding a predetermined threshold,

wherein detecting the deviation comprises determining . . . based on the individualized historical baseline, a probability that the first identity initiates an action corresponding to the detected event in view of the detected permission, and wherein the deviation exceeds the predetermined threshold when the probability is below the predetermined threshold.

11 . A system for generating a cybersecurity risk profile based on an identity in a computing environment comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

detect a plurality of identities in a computing environment, each identity including a permission to initiate an action in the computing environment;

query an identity and access management service to detect a permission associated with a first identity of the plurality of identities;

access an activity log of the computing environment;

parse the activity log to detect an event based on the first identity;

generate an identity risk profile based on: the detected event, and the detected permission; and

determine whether the detected event represents anomalous activity by comparing the detected event and the detected permission against an individualized historical baseline statistically generated specifically for the first identity, wherein the individualized historical baseline comprises statistical measures computed from historical activities uniquely associated with the first identity, and wherein anomalous activity is identified in real-time responsive to detecting a deviation of the event in view of the detected permission from the individualized historical baseline exceeding a predetermined threshold,

wherein detecting the deviation comprises determining ba ed on the individualized historical baseline, a probability that the first identity initiates an action corresponding to the detected event in view of the detected permission, and wherein the deviation exceeds the predetermined threshold when the probability is below the predetermined threshold.

12 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

receive a request to access a resource in the computing environment, the request including an identifier of the first identity; and

determine a cybersecurity risk score based on the resource, and the identity risk profile.

13 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

provide access to the resource in response to determining that the cybersecurity risk score exceeds a threshold; and

deny access to the resource in response to determining that the cybersecurity risk score is below the threshold.

14 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate a mitigation action in response to detecting that the cybersecurity risk score exceeds a predetermined threshold.

15 . The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate an alert based on the mitigation action.

16 . The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate a network traffic policy in response to initiating the mitigation action.

17 . The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

configure a firewall in the computing environment to filter network traffic based on the generated network traffic policy.

18 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect new activity in the activity log for the first identity; and

update the identity risk profile based on the detected new activity.

19 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate an activity baseline for the first identity based on a plurality of events detected in the activity log.