Checking for unnecessary privileges with entry point finder

1. A computer-based method of checking a target business-critical application computer system for unnecessary privileges, the method comprising:

receiving, at a computer-based privileges checking system, a listing of all privileges assigned to users in the target business-critical application computer system;

receiving, at the computer-based privileges checking system, information about end-user activities on the target business-critical application computer system over a specified period of time;

for each respective one of the end-user activities, querying a computer-based entry point finder for any privileges that were checked at the target business-critical application system for that activity; and

removing the privileges that were checked at the target business-critical application system for the end-user activities from the listing of all assigned privileges at the target business-critical application system to produce a listing of unnecessary privileges at the target business-critical application system.

2. The computer-based method of claim 1 , further comprising extracting all of the privileges assigned to the users.

3. The computer-based method of claim 1 , further comprising eliminating the unnecessary privileges at the target business-critical application system.

4. The computer-based method of claim 1 , further comprising prompting or enabling a user to specify the period of time via a computer-based user interface terminal.

5. The computer-based method of claim 1 , wherein the information about the end-user activities may comprise information about transactions started, reports started, successful function calls, and HTTP requests through a web browser.

6. The computer-based method of claim 5 , wherein the information about the transactions started, the reports started, and the successful function calls may be obtained from a security audit log or a business transaction log for the target business-critical application system, and

wherein the information about the HTTP requests may be obtained from an HTTP access log for the target business-critical application system.

7. The computer-based method of claim 1 , further comprising:

extracting, with one or more worker modules of the entry point finder, a plurality of software objects from the target business-critical application computer system;

storing the extracted software objects in a computer-based search platform;

finding relationships, with one or more of the worker modules of the entry point finder, between the extracted software objects that are stored in the computer-based search platform; and

creating a database that represents the extracted software objects and the relationships between the extracted software objects.

8. The computer-based method of claim 7 , wherein the database is a graphical database that represents each extracted software object as a node and each relationship between the extracted software objects as a connector between the nodes.

9. The computer-based method of claim 8 , wherein some of the nodes represent the user activities, wherein some of the nodes represent privilege checks for the user activities, and wherein each respective one of the privilege check nodes is connected to a corresponding one of the user activity nodes.

10. The computer-based method of claim 8 , further comprising using the entry point finder to determine which privileges were actually checked using as input the user activity.

11. A computer-based system for identifying unnecessary privileges on a target business-critical application computer system, the computer-based system comprising:

a privileges extractor to extract a listing of all privileges assigned to users at the target business-critical application computer system;

a user activity extractor to extract information about end-user activities on the target business-critical application computer system over a specified period of time;

a computer-based entry point finder to identify, for each respective one of the extracted end-user activities, any privileges that were checked at the target business-critical application computer system for that activity; and

a computer-based calculator to remove the privileges that were checked at the target business-critical application computer system for the extracted end-user activities during the specified period of time from the listing of all privileges available at the target business-critical application computer system to produce a listing of unnecessary privileges at the target business-critical application computer system.

12. The computer-based system of claim 11 , further comprising a computer-based user interface terminal to display the unnecessary privileges to a system administrator for the target business-critical application computer system.

13. The computer-based system of claim 12 , wherein the system administrator eliminates the unnecessary privileges at the target business-critical application computer system.

14. The computer-based system of claim 11 , further comprising:

a security audit log for the target business-critical application computer system;

a business transaction log for the target business-critical application computer system; and

an HTTP access log for the target business-critical application computer system,

wherein the information about the end-user activities comprises information about transactions started, reports started, successful function calls, and HTTP requests through a web browser,

wherein the information about the transactions started, the reports started, and the successful function calls is obtained from the security audit log or the business transaction log for the target business-critical application computer system, and

wherein the information about the HTTP requests is obtained from the HTTP access log for the target business-critical application computer system.

15. The computer-based system of claim 11 , whether the computer-based entry point finder comprises:

a plurality of worker modules;

a plurality of queues, wherein each one of the queues is communicatively coupled to a corresponding one or more of the worker modules;

a plurality of computer-based memory storage locations, wherein each one of the computer-based memory storage locations is communicatively coupled to a corresponding one or more of the worker modules; and

a computer-based search platform communicatively coupled to at least one of the worker modules.

16. The computer-based system of claim 15 , wherein the computer-based entry point finder is configured to:

extract, with one or more of the worker modules, a plurality of software objects from the target business-critical application computer system;

store the extracted software objects in the computer-based search platform;

find relationships, with one or more of the worker modules, between the extracted software objects that are stored in the computer-based search platform; and

create a database that represents the extracted software objects and the relationships between the extracted software objects.

17. The computer-based system of claim 16 , wherein the database includes information that graphically represents the extracted software objects as nodes and the relationships between the extracted software objects as connectors between nodes.

18. The computer-based system of claim 15 , wherein some of the nodes represent the user activities and some of the nodes represent privilege checks for the user activities, wherein each respective one of the privilege check nodes is connected to an associated one of the user activity nodes.

19. The computer-based system of claim 18 , further comprising using the entry point finder to determine which privileges were actually checked using as input the user activity.