Reputation-based auditing of enterprise application authorization models
Reputation metrics are used to gauge risk of individuals to an organization, such as employees of a business. The reputation metrics may be calculated from both internal and external data sources, including social network profiles of the individuals. Calculations of risk are used to make determinations regarding the activities the individuals are authorized to engage in.
1. A method for managing one or more computer authorization policies of an enterprise based on electronic reputation auditing of employees of the enterprise, the method comprising:
obtaining electronic information associated with an employee of the enterprise from each of a plurality of electronic data sources, wherein the plurality of electronic data sources include at least one data source internal to the enterprise and at least one data source external to the enterprise;
accessing electronically stored reputation information for the employee, the reputation information including one or more reputation metrics, the one or more reputation metrics indicating an influence of the employee to be a risk to the enterprise associated with the employee;
updating the one or more reputation metrics for the employee based on the obtained electronic information;
via one or more computer processors selectively iterating;
calculating a risk score for the employee using the electronically stored one or more reputation metrics;
calculating a risk score for the employee using the updated one or more reputation metrics;
selectively determining to update the one or more computer authorization policies of the enterprise responsive to determining a change in the risk scores exceeds a predetermined threshold amount; and
updating the one or more computer authorization policies of the enterprise based at least in part on the selectively determining, wherein the updating the one or more computer authorization policies comprises selectively increasing and selectively decreasing the employee's level of access to data and program features within the enterprise.
2. The method of claim 1 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises:
making a numerical estimate of a derivative of the risk score calculated using the electronically stored one or more reputation metrics and the risk score calculated using the updated one or more reputation metrics; and
determining to update the one or more computer authorization policies of the enterprise when the numerical estimate of the derivative of the risk scores indicates a change in the risk scores that exceeds a threshold amount.
3. The method of claim 1 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises:
generating a user interface including an indication of a change in risk associated with the employee based on updating the one or more reputation metrics for the employee;
presenting the user interface to a user;
receiving from the user through the user interface an indication of an update to the one or more computer authorization policies of the enterprise; and
updating the one or more computer authorization policies of the enterprise based at least in part on the received indication.
4. The method of claim 1 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises:
accessing a credit score of the employee; and
calculating at least one of the one or more reputation metrics based on the credit score of the employee.
5. The method of claim 1 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises: increasing an amount of activities in which the employee is allowed to engage, when updating the one or more reputation metrics for the employee, based on the obtained information, results in an increase in the one or more reputation metrics.
6. The method of claim 1 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises: decreasing an amount of activities in which the employee is allowed to engage, when updating the one or more reputation metrics for the employee, based on the obtained information, results in a decrease in the one or more reputation metrics.
7. A system comprising:
a processor; and
a memory coupled with and readable by the processor and storing therein a set of instructions which, when executed by the processor, causes the processor to manage one or more computer authorization policies of an enterprise based on electronic reputation auditing of employees of the enterprise by:
obtaining electronic information associated with an employee of the enterprise from each of a plurality of electronic data sources, wherein the plurality of electronic data sources include at least one data source internal to the enterprise and at least one data source external to the enterprise;
accessing electronically stored reputation information for the employee, the reputation information including one or more reputation metrics, the one or more reputation metrics indicating an influence of the employee to be a risk to the enterprise associated with the employee; updating the one or more reputation metrics for the employee based on the obtained electronic information;
via one or more computer processors selectively iterating:
calculating a risk score for the employee using the electronically stored one or more reputation metrics:
calculating a risk score for the employee using the updated one or more reputation metrics:
selectively determining to update the one or more computer authorization policies of the enterprise responsive to determining a change in the risk scores exceeds a predetermined threshold amount; and
updating the one or more computer authorization policies of the enterprise based at least in part on the selectively determining, wherein the updating the one or more computer authorization policies comprises selectively increasing and selectively decreasing the employee's level of access to data and program features within the enterprise.
8. The system of claim 7 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises:
making a numerical estimate of a derivative of the risk score calculated using the electronically stored one or more reputation metrics and the risk score calculated using the updated one or more reputation metrics; and
determining to update the one or more computer authorization policies of the enterprise when the numerical estimate of the derivative of the risk scores indicates a change in the risk scores that exceeds a threshold amount.
9. The system of claim 7 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises:
generating a user interface including an indication of a change in risk associated with the employee based on updating the one or more reputation metrics for the employee;
presenting the user interface to a user;
receiving from the user through the user interface an indication of an update to the one or more computer authorization policies of the enterprise; and
updating the one or more computer authorization policies of the enterprise based at least in part on the received indication.
10. The system of claim 7 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises:
accessing a credit score of the employee; and
calculating at least one of the one or more reputation metrics based on the credit score of the employee.
11. The system of claim 7 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises: increasing an amount of activities in which the employee is allowed to engage, when updating the one or more reputation metrics for the employee, based on the obtained information, results in an increase in the one or more reputation metrics.
12. The system of claim 7 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises: decreasing an amount of activities in which the employee is allowed to engage, when updating the one or more reputation metrics for the employee , based on the obtained information, results in a decrease in the one or more reputation metrics.
13. A computer-readable memory comprising a set of instructions stored therein which, when executed by a processor, causes the processor to manage one or more computer authorization policies of an enterprise based on electronic reputation auditing of employees of the enterprise by:
obtaining electronic information associated with an employee of the enterprise from each of a plurality of electronic data sources, wherein the plurality of electronic data sources include at least one data source internal to the enterprise and at least one data source external to the enterprise;
accessing electronically stored reputation information for the employee, the reputation information including one or more reputation metrics, the one or more reputation metrics indicating an influence of the employee to be a risk to the enterprise associated with the employee;
updating the one or more reputation metrics for the employee based on the obtained electronic information;
via one or more computer processors selectively iterating:
calculating a risk score for the employee using the electronically stored one or more reputation metrics:
calculating a risk score for the employee using the updated one or more reputation metrics:
selectively determining to update the one or more computer authorization policies of the enterprise responsive to determining a change in the risk scores exceeds a predetermined threshold amount; and
updating the one or more computer authorization policies of the enterprise based at least in part on the selectively determining, wherein the updating the one or more computer authorization policies comprises selectively increasing and selectively decreasing the employee's level of access to data and program features within the enterprise.
14. The computer-readable memory of claim 13 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises:
making a numerical estimate of a derivative of the risk score calculated using the electronically stored one or more reputation metrics and the risk score calculated using the updated one or more reputation metrics; and
determining to update the one or more computer authorization policies of the enterprise when the numerical estimate of the derivative of the risk scores indicates a change in the risk scores that exceeds a threshold amount.
15. The computer-readable memory of claim 13 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises:
generating a user interface including an indication of a change in risk associated with the employee based on updating the one or more reputation metrics for the employee;
presenting the user interface to a user;
receiving from the user through the user interface an indication of an update to the one or more computer authorization policies of the enterprise; and
updating the one or more computer authorization policies of the enterprise based at least in part on the received indication.
16. The computer-readable memory of claim 13 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises:
accessing a credit score of the employee; and
calculating at least one of the one or more reputation metrics based on the credit score of the employee.
17. The computer-readable memory of claim 13 , wherein selectively determining to update the one or more computer authorization policies of the enterprise comprises: increasing an amount of activities in which the employee is allowed to engage, when updating the one or more reputation metrics for the employee, based on the obtained information, results in an increase in the one or more reputation metrics.