Automated access control management for computing systems
Normalized access control policies associated with entities in an information technology (IT) infrastructure comprising a plurality of subsystems may be obtained based on a stored access control policy representation governing access to resources in the IT infrastructure. Based on the normalized access control policies, entity clusters associated with the entities may be determined. Further, derived access control policies corresponding to the at least one entity cluster may be determined. A set of non-compliant access control policies may be determined where the set of non-compliant access control policies may comprise: a subset of the normalized access control policies that are non-compliant with stated access control policies applicable to the entity clusters, and/or a subset of the derived access control policies that are non-compliant with the stated access control policies. Machine learning and/or Artificial Intelligence techniques may be used to determine, maintain, and audit policies for the IT infrastructure.
1. A processor-implemented method comprising:
obtaining one or more normalized access control policies associated with one or more first entities based on a stored access control policy representation governing access to a set of resources in an information technology (IT) infrastructure comprising a plurality of subsystems;
determining, based on the one or more normalized access control policies, at least one entity cluster associated with the one or more first entities by clustering the one or more first entities based on the stored access control policy representation and an attribute of the entities of the entity cluster;
determining one or more derived access control policies corresponding to the at least one entity cluster by deriving the derived access control policies from an access pattern or utilization pattern associated with the entities of the entity cluster; and
determining a set of non-compliant access control policies, wherein the set of non-compliant access control policies comprises:
a first subset of the one or more normalized access control policies that are non-compliant with one or more stated access control policies applicable to the at least one entity cluster, or
a subset of the one or more derived access control policies that are non-compliant with the one or more stated access control policies, or
a combination thereof.
2. The method of claim 1 , wherein the policy representation comprises one or more second entities with access to the one or more first entities, or one or more third entities accessible to the one or more first entities; or a combination thereof.
3. The method of claim 2 , wherein each entity cluster in the at least one entity cluster is determined based on at least one attribute common to one or more of:
a subset of the one or more first entities, or
a subset of the one or more second entities, or
a subset of the one or more third entities.
4. The method of claim 3 , wherein the at least one attribute comprises at least one of:
an access privilege, or
an access pattern, or
an activity pattern, the activity pattern comprising one or more of: an activity type, or an activity volume over a time period, or an activity time, or
a variance of one or more parameters associated with a current activity pattern in relation to corresponding parameters for a historical activity pattern, or
a location, or
a user or user group, or
a role, or
a device type, or
an access domain associated with the IT infrastructure, or
a combination thereof.
5. The method of claim 1 , wherein determining the one or more derived access control policies comprises:
determining, for the at least one entity cluster, one or more corresponding resource access patterns or one or more resource utilization patterns, or a combination thereof, for one or more resources associated with the at least one entity cluster, the one or more resources comprised in the set of resources; and
determining, based on one or more of: the corresponding resource access patterns, or the resource utilization patterns, the one or more derived access control policies.
6. The method of claim 5 , wherein the one or more derived access control policies are determined using a machine learning model.
7. The method of claim 1 , wherein determining the first subset of the one or more normalized access control policies comprises:
determining one or more non-compliant entities in the at least one entity cluster with attributes that are inconsistent with access control parameters associated with a resource accessed by the at least one entity cluster in the set of resources, the access control parameters being specified in at least one stated access control policy applicable to the resource, and
adding, for each non-compliant entity, corresponding normalized policies governing access to the resource to the first subset.
8. The method of claim 1 , further comprising:
determining a second subset of the one or more normalized access control policies applicable to entities in the at least one entity cluster that differ from: the one or more stated access control policies, or at least one stated access control policy applicable to a resource accessed by the entity cluster in the set of resources, or a combination thereof.
9. The method of claim 1 , wherein the one or more normalized access control policies are automatically configurable.
10. The method of claim 1 , wherein the stored access control policy representation comprises the stated access control policies and the derived access control policies.
11. The method of claim 1 , further comprising:
initiating at least one corrective action in relation to the set of non-compliant access control policies.
12. The method of claim 11 , wherein initiating the at least one corrective action in relation to the set of non-compliant access control policies comprises:
disabling the set of non-compliant access control policies; or
initiating transmission of a message identifying the set of non-compliant access control policies, or
flagging the set of non-compliant access control policies for evaluation; or
increasing a risk score associated with each non-compliant access control policy in the set of non-compliant access control policies;
a combination thereof.
13. The method of claim 1 , further comprising:
determining a third subset of the one or more normalized access control policies applicable to entities in the at least one entity cluster that differ from the one or more derived access control policies applicable to the at least one entity cluster.
14. The method of claim 1 , further comprising:
determining, for the one or more first entities, a set of unexercised normalized access control policies, the set of unexercised normalized access control policies comprising normalized access control policies associated with the one or more first entities that were not invoked over a time period.
15. A computing system comprising: a memory, and a processor coupled to the memory, wherein the processor is configured to:
obtain one or more normalized access control policies associated with one or more first entities based on a stored access control policy representation governing access to a set of resources in an information technology (IT) infrastructure comprising a plurality of subsystems;
determine, based on the one or more normalized access control policies, at least one entity cluster associated with the one or more first entities by clustering the one or more first entities based on the stored access control policy representation and an attribute of the entities of the entity cluster;
determine one or more derived access control policies corresponding to the at least one entity cluster by deriving the derived access control policies from an access pattern or utilization pattern associated with the entities of the entity cluster; and
determine a set of non-compliant access control policies, wherein the set of non-compliant access control policies comprises:
a first subset of the one or more normalized access control policies that are non-compliant with one or more stated access control policies applicable to the at least one entity cluster, or
a subset of the one or more derived access control policies that are non-compliant with the one or more stated access control policies, or
a combination thereof.
16. The computing system of claim 15 , wherein the policy representation comprises one or more second entities with access to the one or more first entities, or one or more third entities accessible to the one or more first entities; or a combination thereof.
17. The computing system of claim 16 , wherein each entity cluster in the at least one entity cluster is determined based on at least one attribute common to one or more of:
a subset of the one or more first entities, or
a subset of the one or more second entities, or
a subset of the one or more third entities.
18. The computing system of claim 17 , wherein the at least one attribute comprises at least one of:
an access privilege, or
an access pattern, or
an activity pattern, the activity pattern comprising one or more of: an activity type, or an activity volume over a time period, or an activity time, or
a variance of one or more parameters associated with a current activity pattern in relation to corresponding parameters for a historical activity pattern, or
a location, or
a user or user group, or
a role, or
a device type, or
an access domain associated with the IT infrastructure, or
a combination thereof.
19. The computing system of claim 15 , wherein to determine the one or more derived access control policies, the processor is configured to:
determine, for the at least one entity cluster, one or more corresponding resource access patterns or one or more resource utilization patterns, or a combination thereof, for one or more resources associated with the at least one entity cluster, the one or more resources comprised in the set of resources; and
determine, based on one or more of: the corresponding resource access patterns, or the resource utilization patterns, the one or more derived access control policies.
20. The computing system of claim 19 , wherein the one or more derived access control policies are determined using a machine learning model.
21. The computing system of claim 15 , wherein to determine the first subset of the one or more normalized access control policies, the processor is configured to:
determine one or more non-compliant entities in the at least one entity cluster with attributes that are inconsistent with access control parameters associated with a resource accessed by the at least one entity cluster in the set of resources, the access control parameters being specified in at least one stated access control policy applicable to the resource, and
add, for each non-compliant entity, corresponding normalized policies governing access to the resource to the first subset.
22. The computing system of claim 15 , wherein the processor is further configured to:
determine a second subset of the one or more normalized access control policies applicable to entities in the at least one entity cluster that differ from: the one or more stated access control policies, or at least one stated access control policy applicable to a resource accessed by the at least one entity cluster in the set of resources, or a combination thereof.
23. The computing system of claim 15 , wherein the one or more normalized access control policies are automatically configurable.
24. The computing system of claim 15 , wherein the stored access control policy representation comprises the stated access control policies and the derived access control policies.
25. The computing system of claim 15 , further comprising:
initiating at least one corrective action in relation to the set of non-compliant access control policies.
26. The computing system of claim 15 , wherein the processor is further configured to:
determine a third subset of the one or more normalized access control policies applicable to entities in the at least one entity cluster that differ from the one or more derived access control policies applicable to the at least one entity cluster.
27. A non-transitory computer readable medium comprising instructions to configure a processor to:
obtain one or more normalized access control policies associated with one or more first entities based on a stored access control policy representation governing access to a set of resources in an information technology (IT) infrastructure comprising a plurality of subsystems;
determine, based on the one or more normalized access control policies, at least one entity cluster associated with the one or more first entities by clustering the one or more first entities based on the stored access control policy representation and an attribute of the entities of the entity cluster;
determine one or more derived access control policies corresponding to the at least one entity cluster by deriving the derived access control policies from an access pattern or utilization pattern associated with the entities of the entity cluster; and
determine a set of non-compliant access control policies, wherein the set of non-compliant access control policies comprises:
a first subset of the one or more normalized access control policies that are non-compliant with one or more stated access control policies applicable to the at least one entity cluster, or
a subset of the one or more derived access control policies that are non-compliant with the one or more stated access control policies, or
a combination thereof.