Selective and granular multi-customer support access
Disclosed herein are methods, systems, and processes to configure and facilitate selective and granular multi-customer support access in cloud-based cybersecurity computing environments. A request to authorize a multi-customer support account (MCSA) is received. Customer accounts that include an anchor tenant customer account and several secondary tenant customer accounts as well as a set of applications associated with the customer accounts are identified. The MCSA is configured to selectively access customer accounts and granularly access associated applications by being designated with a set of varying access limits for the anchor tenant customer account and another set of varying access limits for the secondary tenant customer accounts, each set of varying access limits being made applicable to various instances of applications associated with each of those customer accounts. The designation further restricts a subsequently modifiable access time of the MCSA at least at a client-level, an application level, and a feature-level. The request to authorize the MCSA is then approved.
1. A method comprising:
configuring, at a multi-customer support server (MCSS), a multi-customer support account (MCSA) that is authorized to selectively manage a plurality of applications executing on a client device;
accessing a MCSA authorization table maintained by the MCSS;
determining, from the MCSA authorization table,
a first access duration based on a security policy associated with the client device,
a second access duration for each of a plurality of permitted applications of the plurality of applications executing on the client device, and
a third access duration for each of the plurality permitted applications based on a plurality permitted operations for each of the plurality permitted applications;
determining that one or more permitted operations between two or more of the plurality permitted applications of the plurality of permitted operations are complementary;
adjusting the second access duration or the third access duration in the MCSA for the client device based on a machine learned varying access control model (VACM) by limiting durational access required to perform the one or more permitted operations; and
updating the MCSA authorization table maintained by the MCSS.
2. A non-transitory computer readable storage medium comprising program instructions executable to:
receive, at a multi-customer support server (MCSS), a request to modify configuration of a multi-customer support account (MCSA) that is authorized to manage a plurality of applications executing on a client device;
access a MCSA authorization table maintained by the MCSS;
determine, from the MCSA authorization table,
a first access duration based on a security policy associated with the client device,
a second access duration for each of a plurality of permitted applications of the plurality of applications executing on the client device, and
a third access duration for each of the plurality permitted applications based on a plurality permitted operations for each of the plurality permitted applications;
determine that one or more permitted operations between two or more of the plurality permitted applications of the plurality of permitted operations are complementary;
adjust the second access duration or the third access duration in the MCSA for the client device based on a machine learned varying access control model (VACM) by limiting durational access required to perform the one or more permitted operations; and
update the MCSA authorization table maintained by the MCSS.
3. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
receive, at a multi-customer support server (MCSS), a request to modify configuration of a multi-customer support account (MCSA) that is authorized to manage a plurality of applications executing on a client device;
access a MCSA authorization table maintained by the MCSS;
determine, from the MCSA authorization table,
a first access duration based on a security policy associated with the client device,
a second access duration for each of a plurality of permitted applications of the plurality of applications executing on the client device, and
a third access duration for each of the plurality permitted applications based on a plurality permitted operations for each of the plurality permitted applications;
determine that one or more permitted operations between two or more of the plurality permitted applications of the plurality of permitted operations are complementary;
adjust the second access duration or the third access duration in the MCSA for the client device based on a machine learned varying access control model (VACM) by limiting durational access required to perform the one or more permitted operations; and
update the MCSA authorization table maintained by the MCSS.