Intelligent data protection
A technological approach can be employed to protect data. Datasets from distinct computing environments of an organization can be scanned to identify data elements subject to protection, such as sensitive data. The identified elements can be automatically protected such as by masking, encryption, or tokenization. Data lineage including relationships amongst data and linkages between computing environments can be determined along with data access patterns to facilitate understanding of data. Further, personas and exceptions can be determined and employed as bases for access recommendations.
1. A system, comprising:
a processor coupled to a memory that stores instructions that when executed by the processor cause the processor to:
determine attributes associated with a user requesting access to data;
match the user to a persona of a set of personas based on the attributes, wherein the set of personas is generated based on historical data access patterns;
determine a consistency level associated with an access request of the user and the persona, wherein the consistency level identifies an extent to which the access request of the user corresponds to one or more access requests known to be associated with the persona; and
generate an access recommendation of one of grant, deny, or revoke based on comparison of the consistency level to a predetermined threshold.
2. The system of claim 1 , wherein the instructions further cause the processor to employ unsupervised learning to identify clusters of access data.
3. The system of claim 2 , wherein the instructions further cause the processor to generate a persona from each of the clusters.
4. The system of claim 1 , wherein the instructions further cause the processor to employ supervised learning to match the user to the persona.
5. The system of claim 1 , wherein the instructions further cause the processor to initiate transmission of the recommendation to an access control system.
6. The system of claim 1 , wherein the data to which access is requested is one of sensitive data or confidential data.
7. The system of claim 1 , wherein the instructions further cause the processor to determine an exception applies based on the attributes and requested data, and generate an access recommendation to deny or revoke access.
8. The system of claim 7 , wherein the exception is a geographic location and a current location of the user is outside a predetermined geographic location.
9. The system of claim 7 , wherein the exception is a particular use and the user is a member of a group that is excluded from use.
10. The system of claim 1 , the instructions further cause the processor to determine and recommend an access level based on the persona.
11. A method, comprising:
executing, on a processor, instructions that cause the processor to perform operations comprising:
determining attributes associated with a user requesting access to data;
matching the user to a persona of a set of personas based on the attributes,
wherein the set of personas is generated based on historical data access patterns;
determining a consistency level associated with an access request of the user and the persona, wherein the consistency level identifies an extent to which the access request of the user corresponds to one or more access requests known to be associated with the persona; and
generating an access recommendation of one of grant, revoke, or deny based on comparison of the consistency level to a predetermined threshold.
12. The method of claim 11 , wherein the operations further comprise identifying clusters of access data with an unsupervised learning technique.
13. The method of claim 12 , wherein the operations further comprise generating a persona from each of the clusters.
14. The method of claim 11 , wherein the operations further comprise employing supervised learning to match the user to the persona.
15. The method of claim 11 , wherein the operations further comprise determining that an exception applies based on the attributes and requested data, and generating an access recommendation denying access.
16. The method of claim 11 , wherein the operations further comprise determining and recommending an access level based on the persona.