System, method, and computer program product for securing data on a server based on a heuristic analysis
A system, method, and computer program product are provided for securing data on a server based on a heuristic analysis. In use, information associated with attempts to access data on a server is recorded. Additionally, the information is heuristically analyzed. Further, the data is secured on the server based on the heuristic analysis.
1. A method, comprising:
recording information associated with attempts to access data on a server, wherein the attempts are provided remotely over a network to which the server is coupled;
heuristically analyzing the information, which includes comparing a previous attempt to access the data with a latest attempt to access the data in order to identify a pattern associated with data leakage; and
securing the data on the server such that access to the data is prevented for a predefined period of time based on the pattern.
2. The method of claim 1 , wherein the data includes a selected one of a group of elements, the group consisting of:
a) an electronic mail message;
b) an access control list;
c) certain data that is particular to a user; and
d) certain data that is accessible utilizing identification data associated with a user.
3. The method of claim 1 , wherein an action to secure the data is determined based on a type of access attempted such that different actions are associated with different types of access attempts.
4. The method of claim 3 , wherein at least one of the different actions includes securing an access control list based on a number of modifications to the access control list.
5. The method of claim 1 , wherein the data is accessible using an identification file that comprises a private key that can be associated with a public key for accessing the data on the server.
6. The method of claim 1 , wherein the information describes an attempt to modify the data and identifies an Internet protocol (IP) address associated with a source.
7. The method of claim 1 , wherein the attempts include attempts to modify permissions in an access control list.
8. The method of claim 1 , wherein the attempts to access the data include a first user attempting to access data particular to a second user.
9. The method of claim 8 , wherein the attempts to access data particular to the second user utilizes identification data associated with the second user.
10. The method of claim 9 , wherein the identification data includes an identification file.
11. The method of claim 1 , wherein the attempts to access the data include an attempt by a first user and an attempt by a second user to access particular data at a substantially simultaneous time.
12. The method of claim 1 , wherein heuristically analyzing the information includes determining if access to the data has been attempted a threshold number of times.
13. A server, comprising:
a processor coupled to a memory such that the server is configured to:
record information associated with attempts to access data on the server, wherein the attempts are provided remotely over a network to which the server is coupled;
analyze the information, which includes comparing a previous attempt to access the data with a latest attempt to access the data in order to identify a pattern associated with data leakage; and
secure the data on the server such that access to the data is prevented for a predefined period of time based on the pattern.
14. The server of claim 13 , wherein the data includes a selected one of a group of elements, the group consisting of:
a) an electronic mail message;
b) an access control list;
c) certain data that is particular to a user; and
d) certain data that is accessible utilizing identification data associated with a user.
15. The server of claim 13 , wherein an action to secure the data is determined based on a type of access attempted such that different actions are associated with different types of access attempts.
16. The server of claim 13 , wherein at least one of the different actions includes securing an access control list based on a number of modifications to the access control list.
17. The server of claim 13 , wherein the information describes an attempt to modify the data and identifies an Internet protocol (IP) address associated with a source.
18. The server of claim 13 , wherein analyzing the information includes heuristically determining if access to the data has been attempted a threshold number of times.
19. A computer program product embodied on a non-transitory computer readable medium for:
recording information associated with attempts to access data on a server, wherein the attempts are provided remotely over a network to which the server is coupled;
heuristically analyzing the information, which includes comparing a previous attempt to access the data with a latest attempt to access the data in order to identify a pattern associated with data leakage; and
securing the data on the server such that access to the data is prevented for a predefined period of time based on the pattern.
20. The non-transitory computer readable medium of claim 19 , wherein the data includes a selected one of a group of elements, the group consisting of:
a) an electronic mail message;
b) an access control list;
c) certain data that is particular to a user; and
d) certain data that is accessible utilizing identification data associated with a user.
21. The non-transitory computer readable medium of claim 19 , wherein an action to secure the data is determined based on a type of access attempted such that different actions are associated with different types of access attempts.
22. The non-transitory computer readable medium of claim 21 , wherein at least one of the different actions includes securing an access control list based on a number of modifications to the access control list.
23. The non-transitory computer readable medium of claim 19 , wherein the data is accessible using an identification file that comprises a private key that can be associated with a public key for accessing the data on the server.
24. The non-transitory computer readable medium of claim 19 , wherein the information describes an attempt to modify the data and identifies an Internet protocol (IP) address associated with a source.
25. The non-transitory computer readable medium of claim 19 , wherein the attempts include attempts to modify permissions in an access control list.
26. The non-transitory computer readable medium of claim 19 , wherein the attempts to access the data include a first user attempting to access data particular to a second user.
27. The non-transitory computer readable medium of claim 19 , wherein the attempts to access data particular to the second user utilizes identification data associated with the second user.
28. The non-transitory computer readable medium of claim 20 , wherein the identification data includes an identification file.
29. The non-transitory computer readable medium of claim 19 , wherein the attempts to access the data include an attempt by a first user and an attempt by a second user to access particular data at a substantially simultaneous time.
30. The non-transitory computer readable medium of claim 19 , wherein heuristically analyzing the information includes determining if access to the data has been attempted a threshold number of times.