Privilege level assignments to groups

1. An apparatus comprising:

a processor; and

a memory on which is stored machine-readable instructions that cause the processor to:

determine an assigned privilege level of a specific group of a plurality of members for accessing data on a first resource, the assigned privilege level being a highest access level that each member in the specific group is assigned to access the data on the first resource;

determine privilege levels used by each of the members in the specific group to access the data on the first resource over a predefined time period;

determine a count of the members in the specific group who used privilege levels that are lower than the assigned privilege level of the specific group;

determine whether the determined count of the members who used the privilege levels that are lower than the assigned privilege level of the specific group exceeds a threshold value; and

based on the determined count exceeding the threshold value, modify the assigned privilege level of the specific group to a privilege level that is lower than assigned privilege level.

2. The apparatus of claim 1 , wherein the instructions cause the processor to:

determine, for each of the members in the specific group, historical usage of the first resource; and

determine the assigned privilege level of each of the members in the specific group based on the determined historical usage of the first resource.

3. The apparatus of claim 1 , wherein the instructions cause the processor to:

based on a determination that the determined count does not exceed the threshold value, determine that the assigned privilege level of the specific group is not to be modified;

identify a member of the specific group that used a privilege level that is lower than the assigned privilege level of the specific group;

assign the privilege level that is lower than the assigned privilege level of the specific group to the identified member for accessing the first resource; and

apply the privilege level that is lower than the assigned privilege level of the specific group to the identified member for accessing the first resource.

4. The apparatus of claim 1 , wherein the instructions cause the processor to:

identify any of the members of the specific group who used a privilege level that exceeds the assigned privilege level of the specific group for accessing the first resource; and

assign and apply the privilege level that exceeds the assigned privilege level of the specific group to the identified members of the specific group for accessing the first resource.

5. The apparatus of claim 1 , wherein the instructions cause the processor to:

based on a determination that the determined count does not exceed the threshold value, partition the specific group into a first sub-group and a second sub-group;

assign the assigned privilege level of the specific group to the first sub-group; and

assign the privilege level that is lower than the assigned privilege level to the second sub-group.

6. The apparatus of claim 5 , wherein the instructions cause the processor to:

assign members of the specific group who did not use the privilege levels that are lower than the assigned privilege level to the first sub-group; and

assign members of the specific group who used the privilege levels that are lower than the assigned privilege level to the second sub-group.

7. The apparatus of claim 5 , wherein the instructions cause the processor to:

determine whether partitioning the specific group would exceed a complexity threshold; and

partition the specific group into the first sub-group and the second sub-group based on a determination that the partitioning would not exceed the complexity threshold.

8. The apparatus of claim 1 , wherein the instructions cause the processor to:

determine a privilege level assigned to each of the members in the specific group for usage of a second resource;

determine, based on the determined privilege level assigned to each of the members in the specific group for usage of the second resource, a second privilege level to be assigned to the specific group for usage of the second resource;

assign the determined second privilege level to the specific group for usage of the second resource; and

apply the assigned second privilege level to the specific group for usage of the second resource.

9. A method comprising:

identifying, by a processor, an assigned privilege level of a specific group of a plurality of members for accessing data on a first resource, the assigned privilege level being a highest access level that each member in the specific group is assigned to access the data on the first resource;

determining, by the processor, privilege levels used by each of the members in the specific group to access the data on the first resource over a predefined time period;

determining, by the processor, a count of the members in the specific group who used privilege levels that are lower than the assigned privilege level of the specific group;

determining, by the processor, whether the determined count of the members who used the privilege levels that are lower than the assigned privilege level of the specific group exceeds a threshold value; and

based on the determined count exceeding the threshold value, modifying, by the processor, the assigned privilege level of the specific group to a privilege level that is lower than assigned privilege level.

10. The method of claim 9 , further comprising:

based on a determination that the determined count does not exceed the threshold value, determining that the assigned privilege level of the specific group is not to be modified;

identifying a member of the specific group that used a privilege level that is lower than the assigned privilege level of the specific group;

assigning the privilege level that is lower than the assigned privilege level to the identified member; and

applying the assigned lower privilege level to the identified member.

11. The method of claim 9 , further comprising:

identifying any of the members of the specific group who used a privilege level that exceeds the assigned privilege level over the first resource; and

assigning the privilege level that exceeds the assigned privilege level to the identified members of the specific group for usage of the first resource.

12. The method of claim 9 , further comprising:

based on a determination that the determined count does not exceed the threshold value, partitioning the specific group into a first sub-group and a second sub-group;

assigning the assigned privilege level of the specific group to the first sub-group; and

assigning the privilege level that is lower than the assigned privilege level to the second sub-group.

13. The method of claim 12 , further comprising:

assigning members of the specific group who did not use the privilege levels that are lower than the assigned privilege level to the first sub-group; and

assigning members of the specific group who used the privilege levels that are lower than the assigned privilege level to the second sub-group.

14. The method of claim 12 , further comprising:

determining whether partitioning the specific group would exceed a complexity threshold; and

partitioning the specific group into the first sub-group and the second sub-group based on a determination that the partitioning would not exceed the complexity threshold.

15. A non-transitory computer-readable medium on which is stored computer-readable instructions that when executed by a processor, cause the processor to:

identify an assigned privilege level of a specific group of a plurality of members for accessing data on a first resource, the assigned privilege level being a highest access level that each member in the specific group is assigned to access the data on the first resource;

determine privilege levels used by each of the members in the specific group to access the data on the first resource over a predefined time period;

determine a count of the members in the specific group who used privilege levels that are lower than the assigned privilege level of the specific group;

determine whether the determined count of the members who used the privilege levels that are lower than the assigned privilege level of the specific group exceeds a threshold value; and

based on the determined count exceeding the threshold value, modify the assigned privilege level of the specific group to a privilege level that is lower than assigned privilege level.

16. The non-transitory computer-readable medium of claim 15 , wherein

the instructions further cause the processor to:

based on a determination that the determined count does not exceed the threshold value, determine that the assigned privilege level of the specific group is not to be modified;

identify a member of the specific group who used a privilege level that is lower than the assigned privilege level of the specific group; and

assign and store the privilege level that is lower than the assigned privilege level to the identified member.

17. The non-transitory computer-readable medium of claim 15 , wherein the instructions further cause the processor to:

based on a determination that the determined count does not exceed the threshold value, partition the specific group into a first sub-group and a second sub-group;

assign members of the specific group who did not use the privilege levels that are lower than the assigned privilege level to the first sub-group; and

assign members of the specific group who used the privilege levels that are lower than the assigned privilege level to the second sub-group.