Open access token for determining that file is accessible to everyone
Techniques for implementing proactive data security operations for files using an analysis of access permission levels for the files are disclosed. In some embodiments, a computer system performs operations comprising: determining that data of a file includes sensitive information based on an analysis of the data using a data classification model; determining that access to the file is open using an access classification model; and based on the determination that the data of the file includes sensitive information and the determination that the access to the file is open, causing a notification to be displayed on a computing device of a user, the notification comprising an indication that the file includes sensitive information and that access to the file is open.
1. A computer-implemented method performed by a computer system having a memory and at least one hardware processor, the computer-implemented method comprising:
determining, using a data classification model, that data of a file includes sensitive information based on the data satisfying sensitive information criteria of the data classification model, the sensitive information criteria comprising one or more keywords or a format of data content;
determining, using an access classification model, that access to the file is open based on a permission attribute of the file satisfying an open access criteria of the access classification model, the permission attribute indicating a set of users or machines to which the file is accessible; and
based on the determination that the data of the file includes sensitive information and the determination that the access to the file is open, causing a notification to be displayed on a computing device of a user, the notification comprising an indication that the file includes sensitive information and that access to the file is open.
2. The computer-implemented method of claim 1 , wherein the data classification model comprises a machine learning model that is trained to classify the data of the file as including sensitive information based on the data of the file.
3. The computer-implemented method of claim 1 , wherein the open access criteria comprises the file being open to domain users, the file being open to authenticated users, or the file being open to all users.
4. The computer-implemented method of claim 1 , wherein the access classification model comprises a machine learning model that is trained to classify the access to the file as being open based on metadata of the file.
5. The computer-implemented method of claim 4 , wherein the metadata of the file comprises a plurality of security identifiers having permission to access the file, and the machine learning model is configured to classify the access to the file being open based on, for each one of the plurality of security identifiers, a total number of files to which the security identifier has permission to access.
6. The computer-implemented method of claim 4 , wherein the metadata of the file comprises a plurality of security identifiers having permission to access the file, and the machine learning model is configured to classify the access to the file being open based on, for each one of the plurality of security identifiers, a total number of separate independent machines on which the security identifier is used.
7. The computer-implemented method of claim 1 , further comprising determining that anomalous user activity has been directed towards the file based on an analysis of metadata of the file, wherein the notification further comprises another indication of the anomalous user activity directed towards the file based on the determination that the anomalous user activity has been directed towards the file.
8. The computer-implemented method of claim 7 , wherein the metadata of the file comprises a frequency at which the file has been read or modified, and the determination that the anomalous user activity has been directed towards the file is based on a determination that the frequency satisfies a minimum frequency threshold value.
9. The computer-implemented method of claim 1 , wherein the causing the notification to be displayed further comprises causing a remediation recommendation to be displayed on the computing device of the user, the remediation recommendation being configured to prompt the user to trigger an automated performance of a data management action directed towards the file via one or more selectable user interface elements.
10. The computer-implemented method of claim 9 , wherein the data management action comprises changing the permission attribute or a second permission attribute of the file to reduce a level of access to the file.
11. The computer-implemented method of claim 1 , further comprising determining that an amount of user activity directed towards the file is below a minimum activity threshold value based on an analysis of metadata associated with the file, wherein the notification further comprises another indication that the file is stale based on the determination that the amount of user activity directed towards the file is below the minimum activity threshold value.
12. The computer-implemented method of claim 11 , wherein the causing the notification to be displayed further comprises causing a remediation recommendation to be displayed on the computing device of the user based on the determination that the amount of user activity directed towards the file is below the minimum activity threshold value, the remediation recommendation being configured to prompt the user to trigger an automated performance of a data management action directed towards the file via one or more selectable user interface elements.
13. The computer-implemented method of claim 12 , wherein the data management action comprises changing the permission attribute or a second permission attribute of the file to reduce a level of access to the file or removing the file from a file system.
14. A system of comprising:
at least one hardware processor of a managed private cloud architecture serving an organization; and
a non-transitory computer-readable medium storing executable instructions that, when executed, cause the at least one hardware processor to perform operations comprising:
determining, using a data classification model, that data of a file includes sensitive information based on the data satisfying sensitive information criteria of the data classification model, the sensitive information criteria comprising one or more keywords or a format of data content;
determining, using an access classification model, that access to the file is open based on a permission attribute of the file satisfying an open access criteria of the access classification model, the permission attribute indicating a set of users or machines to which the file is accessible; and
based on the determination that the data of the file includes sensitive information and the determination that the access to the file is open, causing a notification to be displayed on a computing device of a user, the notification comprising an indication that the file includes sensitive information and that access to the file is open.
15. The system of claim 14 , wherein the causing the notification to be displayed farther comprises causing a remediation recommendation to be displayed on the computing device of the user, the remediation recommendation being configured to prompt the user to trigger an automated performance of a data management action directed towards the file via one or more selectable user interface elements.
16. The system of claim 15 , wherein the data management action comprises changing the permission attribute or a second permission attribute of the file to reduce a level of access to the file.
17. The system of claim 14 , wherein the executable instructions, when executed, cause the at least one hardware processor to perform further operations comprising:
determining that anomalous user activity has been directed towards the file based on an analysis of metadata of the file, wherein the notification further comprises another indication of the anomalous user activity directed towards the file based on the determination that the anomalous user activity has been directed towards the file.
18. The system of claim 17 , wherein the metadata of the file comprises a frequency at which the file has been read or modified, and the determination that anomalous user activity has been directed towards the file is based on a determination that the frequency satisfies a minimum frequency threshold value.
19. The system of claim 14 , wherein the executable instructions, when executed, cause the at least one hardware processor to perform further operations comprising:
determining that an amount of user activity directed towards the file is below a minimum activity threshold value based on an analysis of metadata associated with the file, wherein the notification further comprises another indication that the file is stale based on the determination that the amount of user activity directed towards the file is below the minimum activity threshold value.
20. A non-transitory machine-readable storage medium tangibly embodying a set of instructions that, when executed by at least one hardware processor, causes the at least one hardware processor to perform operations comprising:
determining, using a data classification model, that data of a file includes sensitive information based on the data satisfying sensitive information criteria of the data classification model, the sensitive information criteria comprising one or more keywords or a format of data content;
determining, using an access classification model, that access to the file is open based on a permission attribute of the file satisfying an open access criteria of the access classification model, the permission attribute indicating a set of users or machines to which the file is accessible; and
based on the determination that the data of the file includes sensitive information and the determination that the access to the file is open, causing a notification to be displayed on a computing device of a user, the notification comprising an indication that the file includes sensitive information and that access to the file is open.