Granted Patent B1

US 10,282,557 · App. 14/946,407 · Granted May 7, 2019

Abstract

Claims (68)

1. A computer-implemented method for protecting sensitive data against data loss, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying a resource, maintained by an organization, comprising sensitive data;

establishing, for the resource, an accessibility threshold that indicates a limit on permissions to access the resource, wherein:

the limit on permissions comprises a limit on a total number of user accounts of users employed by the organization that have permission to access the resource;

the accessibility threshold indicates that a security action will be triggered if a current total number of user accounts with permission to access the resource surpasses a baseline number by more than a threshold amount;

monitoring how the permissions to access the resource drift over time by:

identifying, based on group membership information from a directory service managed by a security service, a plurality of different subgroups within the organization, each of which has a different type of permission to access the resource;

identifying, by adding a number of user accounts within each subgroup, a total number of user accounts that have permission to access the resource;

based on changes to the group membership information over time, tracking changes in the total number of user accounts that have permission to access the resource;

detecting, while tracking the changes in the total number of user accounts that have permission to access the resource over time, that the total number has surpassed the accessibility threshold;

in response to detecting that the total number has surpassed the accessibility threshold, performing the security action to protect the sensitive data from potentially being exposed.

2. The computer-implemented method of claim 1 , wherein the threshold amount comprises a predefined percentage of the baseline number.

3. The computer-implemented method of claim 1 , wherein the baseline number comprises a number selected by a user.

4. The computer-implemented method of claim 1 , wherein the baseline number comprises a total number of user accounts with permission to access the resource at the time the accessibility threshold is established.

5. The computer-implemented method of claim 1 , wherein tracking the changes in the total number of user accounts that have permission to access the resource comprises tracking only instances in which a number of user accounts with permission to access the resource increases.

6. The computer-implemented method of claim 1 , wherein the different types of permission to access the resource comprise at least one of:

permission to read the resource;

permission to modify the resource;

permission to perform management functions for the resource.

7. The computer-implemented method of claim 6 , wherein performing the security action comprises revoking the access of one or more user accounts to the resource.

8. The computer-implemented method of claim 1 , wherein performing the security action comprises at least one of:

sending, to an administrator that manages security of the resource, an alert indicating that the resource is potentially at risk of being exposed;

blocking the access of one or more user accounts to the resource;

limiting the access of one or more user accounts to the resource.

9. The computer-implemented method of claim 1 , wherein identifying the resource comprises:

scanning the organization's unstructured data for resources comprising sensitive information;

identifying the resource as a result of the scanning.

10. The computer-implemented method of claim 1 , wherein the group membership information comprises information in an active directory.

11. A system for protecting sensitive data against data loss, the system comprising:

an identification module, stored in memory, that identifies a resource, maintained by an organization, comprising sensitive data;

a threshold module, stored in memory, that establishes, for the resource, an accessibility threshold that indicates a limit on permissions to access the resource, wherein:

the limit on permissions comprises a limit on a total number of user accounts of users employed by the organization that have permission to access the resource;

the accessibility threshold indicates that a security action will be triggered if a current total number of user accounts with permission to access the resource surpasses a baseline number by more than a threshold amount;

a monitoring module, stored in memory, that:

monitors how the permissions to access the resource drift over time by:

identifying, based on group membership information from a directory service managed by a security service, a plurality of different subgroups within the organization, each of which has a different type of permission to access the resource;

identifying, by adding a number of user accounts within each subgroup, a total number of user accounts that have permission to access the resource;

based on changes to the group membership information over time, tracking changes in the total number of user accounts that have permission to access the resource;

detects, while tracking the changes in the total number of user accounts that have permission to access the resource over time that the total number has surpassed the accessibility threshold;

a security module, stored in memory, that, in response to the detection, performs the security action to protect the sensitive data from potentially being exposed;

at least one physical processor configured to execute the identification module, the threshold module, the monitoring module, and the security module.

12. The system of claim 11 , wherein the threshold amount comprises a predefined percentage of the baseline number.

13. The system of claim 11 , wherein the baseline number comprises a number selected by a user.

14. The system of claim 11 , wherein the baseline number comprises a number of user accounts with permission to access the resource at the time the accessibility threshold is established.

15. The system of claim 11 , wherein the monitoring module tracks the changes in the total number of user accounts that have permission to access the resource by tracking only instances in which a number of user accounts with permission to access the resource increases.

16. The system of claim 11 , wherein the different types of permission to access the resource comprise at least one of:

permission to read the resource;

permission to modify the resource;

permission to perform management functions for the resource.

17. The system of claim 16 , wherein the security module performs the security action by revoking the access of one or more user accounts to the resource.

18. The system of claim 11 , wherein the security module performs the security action by at least one of:

sending, to an administrator that manages security of the resource, an alert indicating that the resource is potentially at risk of being exposed;

blocking the access of one or more user accounts to the resource;

limiting the access of one or more user accounts to the resource.

19. The system of claim 11 , wherein the identification module identifies the resource by:

scanning the organization's unstructured data for resources comprising sensitive information;

identifying the resource as a result of the scanning.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify a resource, maintained by an organization, comprising sensitive data;

establish, for the resource, an accessibility threshold that indicates a limit on permissions to access the resource, wherein:

the limit on permissions comprises a limit on a total number of user accounts of users employed by the organization that have permission to access the resource;

the accessibility threshold indicates that a security action will be triggered if a current total number of user accounts with permission to access the resource surpasses a baseline number by more than a threshold amount;

monitor how the permissions to access the resource drift over time by:

identifying, based on group membership information from a directory service managed by a security service, a plurality of different subgroups within the organization, each of which has a different type of permission to access the resource;

identifying, by adding a number of user accounts within each subgroup, a total number of user accounts that have permission to access the resource;

based on changes to the group membership information over time, tracking changes in the total number of user accounts that have permission to access the resource;

detect, while tracking the changes in the total number of user accounts that have permission to access the resource over time, that the total number has surpassed the accessibility threshold;

in response to the detection, perform a security action to protect the sensitive data from potentially being exposed.

Assignments (16)

Cited By (4)

US 12,199,984 US 12,537,823 US 12,585,817 US 12,699,793