Systems and methods for role-based computer security configurations
An apparatus includes a processor operatively coupled to a memory. The processor detects a software application installed on a client computing device, and/or usage data. Detected usage data is associated with a current user of the client computing device and with the software application. The processor identifies a user role for the current user based on the software application and/or usage data. The processor applies a security configuration to the client computing device based on the user role. The security configuration limits access by the current user to a portion of the software application. The processor sends an identifier of the user role to an administrative server for storage in an Active Directory (AD) database.
1. An apparatus, comprising:
a processor; and
a memory operatively coupled to the processor, the processor configured to:
identify at least one of:
a software application installed on a client computing device, or
usage data, associated with a current user of the client computing device and for the software application;
identify, based on the software application installed on the client computing device or the usage data, a user role for the current user of the client computing device;
predict, based on the user role for the current user of the client computing device, an expected behavior of the current user of the client computing device;
modify, at the client computing device and based on the expected behavior of the current user of the client computing device, a privilege level of an application control policy for the current user of the client computing device, the privilege level of the application control policy being associated with the software application;
applying, based on the expected behavior, the application control policy with the modified privilege level at the client computing device, wherein the application of the application control policy permits the user to run the software application based on the modified privilege level and the user role; and
send an identifier of the user role to an administrative server for storage in an Active Directory (AD) database.
2. The apparatus of claim 1 , wherein the processor is further configured to:
detect a behavior of the current user of the client computing device that deviates from the expected behavior; and
send an alert to the administrative server in response to detecting the behavior that deviates from the expected behavior.
3. The apparatus of claim 1 , wherein:
the processor and the memory are at the client computing device; or
the processor and the memory are at the administrative server.
4. The apparatus of claim 1 , wherein the processor is further configured to identify a security risk for the current user of the client computing device based on the user role and the usage data.
5. The apparatus of claim 1 , wherein the processor is configured to identify the usage data based on a software usage log.
6. The apparatus of claim 1 , wherein the processor is configured to identify the usage data by monitoring software usage by the current user of the client computing device over a predetermined period of time.
7. The apparatus of claim 6 , wherein:
the user role is a first user role; and
the processor is further configured to identify a second user role, different from the first user role, based on the monitored software usage.
8. The apparatus of claim 1 , wherein the usage data includes at least one of: a frequency of use of the software application, a frequency of use of a feature of the software application, a frequency of attempts to use a blocked feature of the software application, a set of accessed features of the software application, or a quantity of remote accesses of a desktop of the client computing device.
9. The apparatus of claim 1 , wherein:
the software application is a first software application; and
the processor is further configured to:
identify a second software application installed on the client computing device; and
identify the user role for the current user of the client computing device based on an association, stored within the memory, between the first software application, the second software application, and an identifier of the user role.
10. The apparatus of claim 1 , wherein the processor is further configured to apply, based on the user role for the current user of the client computing device, a security configuration to the client computing device to limit access by the current user of the client computing device to at least a portion of the software application.
11. A method, comprising:
identifying, at a client computing device, at least one of:
a software application installed on the client computing device, or
usage data, associated with a current user of the client computing device and for the software application;
identifying, based on the software application installed on the client computing device or the usage data, a user role for the current user of the client computing device;
identifying, based on the user role for the current user of the client computing device, an expected behavior of the current user of the client computing device;
applying, based on the expected behavior of the current user of the client computing device, a device control policy at the client computing device to define at least one authorized device that the current user of the client computing device can access when the at least one authorized device is operatively coupled to the client computing device; and
sending the identified user role to an administrative server.
12. The method of claim 11 , wherein the at least one authorized device includes at least one of: a universal serial bus (USB) device, a floppy drive, a compact disc (CD) drive, a printer, a camera, a microphone, a computer mouse, a keyboard, or a speaker.
13. The method of claim 11 , wherein the device control policy identifies the at least one authorized device that the current user of the client computing device can access when the at least one authorized device is wirelessly connected to the client computing device.
14. The method of claim 11 , further comprising associating a user record stored in a memory with the identified user role.
15. The method of claim 11 , wherein the identifying the usage data is based on a software usage log.
16. The method of claim 11 , wherein the identifying the usage data includes generating the usage data by monitoring software usage by the current user of the client computing device over a predetermined period of time.
17. The method of claim 16 , wherein the user role is a first user role, the method further comprising identifying a second user role, different from the first user role, based on monitored software usage.
18. The method of claim 11 , wherein the identifying the user role for the current user of the client computing device includes:
sending a signal encoding a query to the administrative server, the query including an indicator of the at least one software application installed on the client computing device and the usage data, and
receiving, from the administrative server, a response to the query including an indicator of the user role for the current user of the client computing device.
19. The method of claim 11 , wherein the identifying the usage data includes:
sending a signal encoding a query to the administrative server, the query including an indicator of the current user of the client computing device, an indicator of the client computing device, and an indicator of the software application, and
receiving, from the administrative server, a response to the query including the usage data for the software application of the at least one software application.
20. The method of claim 11 , further comprising:
detecting a behavior of the current user of the client computing device that deviates from the expected behavior; and
sending an alert to the administrative server in response to detecting the behavior that deviates from the expected behavior.
21. The method of claim 11 , wherein the usage data includes at least one of: a frequency of use of the software application, a frequency of use of a feature of the software application, a frequency of attempts to use a blocked feature of the software application, a set of accessed features of the software application, or a quantity of remote accesses of a desktop of the client computing device.
22. The method of claim 11 , further comprising identify a security risk for the current user of the client computing device based on the user role and the usage data.
23. The method of claim 11 , further comprising applying, based on the user role for the current user of the client computing device, a security configuration to the client computing device to limit access by the current user of the client computing device to at least a portion of the software application.
24. The method of claim 11 , wherein the software application is a first software application, the method further comprising:
identifying a second software application installed on the client computing device; and
identifying the user role for the current user of the client computing device based on an association, stored within a memory, between the first software application, the second software application, and an identifier of the user role.