Global object access auditing
View Patent ↗Global object access auditing techniques are described. In an implementation, a global SACL for a resource and an object SACL are merged to form a merged SACL responsive to a request for access to an object. The merged SACL is checked to determine what activity is to generate an audit event.
1. A method comprising:
defining, by one or more computing devices, a global system access control list (SACL) for a resource that includes a plurality of objects, the global SACL configured to indicate one or more activities associated with the resource that are to be audited; and
distributing, by the one or more computing devices, a group policy that contains the global SACL as part of a list of SACLs, such that one or more processors associated with the resource, in response to an attempt to access to a particular said object associated with the resource, identifies the global SACL within the list of SACLs based, at least in part, on a type associated with the resource, and merges the global SACL with an object SACL for the particular said object associated with the resource to audit the attempt to access the particular said object associated with the resource, the global SACL is not promulgated among SACLs corresponding to said objects associated with resource before the attempted access to each of said objects associated with the resource.
2. The method of claim 1 , wherein the particular said object associated with the resource is one or more of:
a file included on a networked computer,
a folder including one or more said objects, or
a registry key.
3. The method of claim 1 , wherein one or more of the global SACL or the object SACL include one or more of:
a security principal to be audited,
a security attribute,
an access mask that indicates what access type is to be audited; or
a flag.
4. The method of claim 1 , wherein one or more of the global SACL or the object SACL include a security principal that is associated with one or more of:
a user that is to be audited,
a computing device, or
a group of users that is to be audited.
5. The method of claim 1 , further comprising determining whether access to the particular said object associated with the resource is permitted using a discretionary access control list (DACL).
6. The method of claim 1 , wherein the group policy is configured to cause one or more processors associated with the resource to calculate a union of the global SACL and the object SACL, responsive to the attempted access to the particular said object.
7. The method of claim 1 , the global SACL including an entry designating whether to track failed access attempts to particular said object associated with the resource.
8. A method comprising:
responsive to a request for access to an object associated with a resource, merging, using a computing device, a global system access control list (SACL) for the resource with an object SACL for the object to form a merged SACL, the global SACL determined based, at least in part, on a resource type contained within the global SACL, the merging comprising selecting the global SACL from a list of global SACLs using the resource type, the global SACL is further configured to indicate, for a plurality of objects, one or more activities associated with the resource that are to be audited for an object of the plurality of objects, and the object SACL is configured to indicate one or more activities associated with the object of the plurality of objects that are to be audited; and
checking, using the computing device, the merged SACL to determine what activity is to generate an audit event.
9. The method of claim 8 , further comprising generating, using the computing device, an audit record including data in an identifier associated with the request.
10. The method of claim 9 , further comprising forwarding the generated audit record to centralized storage.
11. The method of claim 8 , wherein one or more of the global SACL or the object SACL include one or more of:
a security principal to be audited,
a security attribute,
an access mask that indicates what access type is to be audited, or
a flag.
12. The method of claim 8 , wherein the resource is one or more of:
a file system,
an application,
a registry, or
a directory service.
13. The method of claim 8 , wherein merging includes concatenating the global SACL and the object SACL.
14. The method of claim 8 , wherein the global SACL for the resource is not promulgated among SACLs for objects included in the resource prior to the request to for access.
15. The method of claim 8 , wherein checking includes tracking an outcome of the request in a security event log.
16. One or more computer-readable storage media device comprising instructions that are executable by a computer to:
check a merged system access control list (SACL) to determine what activity associated with a resource is to generate an audit event, in which the merged SACL is concatenated from a global SACL for a file system that includes an object and an object SACL for the object, the instructions further configured to concatenate the global SACL and the object SACL responsive to a request for access to the object associated with the resource, the global SACL configured to indicate, for a plurality of objects, one or more activities associated with the resource that are to be audited for an object of the plurality of objects, the object SACL configured to indicate one or more activities associated with the object of the plurality of objects that are to be audited; and
generate an audit record corresponding to the audit event, wherein to generate the audit record includes an ability to generate the audit record on a periodic basis.
17. One or more computer-readable storage media device as described in claim 16 , wherein the audit record is associated with one or more of:
a failure to access the file system,
a successful file system access,
a failure to access said object, or
a successful object access.
18. One or more computer-readable storage media device as described in claim 16 , wherein one or more of the global SACL, the merged SACL, or the object SACL include one or more of:
a security principal to be audited,
a security attribute,
an access mask that indicates what access type is to be audited, or
a flag.
19. One or more computer-readable storage media device as described in claim 16 , wherein the file system is associated with an operating system that is to be executed on a computer that is to execute the instructions.
20. One or more computer-readable storage media device as described in claim 16 , wherein the merged SACL is a union of the global SACL and the object SACL.