Data modeling to improve security
Systems and techniques for determining data assessment scores indicative of potential security vulnerabilities and enacting measures to protect sensitive information by controlling permissions and access to sensitive information and systems are provided herein. A data assessment model receives inputs of user access data, user role type, baseline permissions for the user role type, and produces a score. The score is useful for identifying potential security vulnerabilities and enacting proactive security measures to lock down potential vulnerabilities by blocking or changing permissions to reduce risk scores.
1. A computer-implemented method, comprising:
receiving user access data describing permission to interact with one or more systems associated with a work environment;
receiving baseline access data describing baseline access for a role type associated with the work environment, the baseline access for the role type determined based at least in part on responsibilities for entities associated with the role type;
receiving role data describing changes to the role type over time;
determining, based at least in part on the role data, a change in the user access data over a time interval that is associated with changes other than the changes to the role type;
training a machine learning model using historical score data, the machine learning model receiving inputs of the user access data, the role data, and the baseline access data;
receiving, as output from the machine learning model, a score;
determining whether the score exceeds a threshold;
generating a notification in accordance with the score exceeding the threshold;
presenting the notification to a supervisory user at a user device within the work environment; and
generating an authentication request, by the supervisory user, in accordance with the score exceeding the threshold, the authentication request requesting authentication data from a user via the user device.
2. The computer-implemented method of claim 1 , wherein the baseline access comprises an average of user accesses for a plurality of users associated with the role type.
3. The computer-implemented method of claim 1 , further comprising:
receiving score data for a plurality of users associated with the role type; and
determining an average for the score data, and wherein generating the notification comprises generating the notification for each of a subset of the plurality of users in response to the score data for the subset of the plurality of users exceeding the average by more than a second threshold.
4. The computer-implemented method of claim 1 , further comprising blocking permissions to one or more systems in response to the notification.
5. A computer-implemented method, comprising:
receiving user access data describing account permissions associated with a role type;
receiving baseline access data describing baseline access for the role type;
determining a change in the user access data over a time interval, wherein the role type is constant over the time interval;
determining a score based at least in part on the user access data, the change in the user access data, and the baseline access data; and
generating a notification in response to the score exceeding a threshold, the notification comprising the score and instructions to audit the account permissions; and
presenting the notification at a user device.
6. The computer-implemented method of claim 5 , further comprising blocking permission changing the user access data to block permission to one or more systems in response to generating the notification.
7. The computer-implemented method of claim 5 , wherein determining the score comprises:
comparing the user access data to the baseline access data; and
increasing the score in response to the user access data exceeding the baseline access data.
8. The computer-implemented method of claim 5 , wherein determining the score comprises increasing the score in response to determining an increase in the user access data is associated with a change other than a change in the role type.
9. The computer-implemented method of claim 5 , wherein determining the score comprises inputting the user access data, the change in user access data, and the baseline access data into a machine learning algorithm trained using historical score data.
10. The computer-implemented method of claim 5 , further comprising receiving score data for a plurality of users, and wherein the notification comprises instructions instructing further data protection measures in response to determining a subset of the score data exceeds a second threshold.
11. The computer-implemented method of claim 5 , further comprising:
receiving score data for a plurality of users associated with the role type; and
determining an average for the score data, and wherein generating the notification comprises generating the notification for each of a subset of the plurality of users in response to the score data for the subset of the plurality of users exceeding the average by more than a second threshold.
12. The computer-implemented method of claim 5 , wherein determining the score is further based at least in part on user role data describing one or more role types assigned to a user over time.
13. The computer-implemented method of claim 12 , wherein determining the score based at least in part on the user role data and the change in the user access data comprises increasing the score in response to determining an increase in the user access data is not associated with a change in the user role data.
14. A non-transitory computer-readable storage medium storing computer-executable instructions that, when executed by a computer system, configure the computer system to perform operations comprising:
receiving user access data describing account permissions associated with a role type;
receiving baseline access data describing baseline access for the role type;
determining a change in the user access data over a time interval that is associated with changes other than changes to the role type;
determining a score based at least in part on the user access data, the change in the user access data, and the baseline access data;
generating a notification in response to the score exceeding a threshold, the notification comprising the score and instructions to audit the account permissions; and
presenting the notification at a user device.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions comprise further instructions that, when executed by the computer system, configure the computer system to perform additional operations comprising changing the user access data for a user associated with the user access data to block permission to one or more systems in response to generating the notification.
16. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions comprise further instructions that, when executed by the computer system, configure the computer system to perform additional operations comprising blocking physical access to one or more workplace environments in response to generating the notification.
17. The non-transitory computer-readable storage medium of claim 14 , wherein determining the score comprises inputting the user access data, the change in user access data, and the baseline access data into a machine learning algorithm trained using historical score data.
18. The non-transitory computer-readable storage medium of claim 14 , wherein determining the score comprises increasing the score in response to determining an increase in the user access data is associated with a change other than a change in role type.
19. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions comprise further instructions that, when executed by the computer system, configure the computer system to perform additional operations comprising:
receiving score data for a plurality of users associated with the role type;
determining an average for the score data; and
generating a second notification for a subset of the plurality of users in response to the score data for the subset of the plurality of users exceeding the average by more than a second threshold.
20. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions comprise further instructions that, when executed by the computer system, configure the computer system to perform additional operations comprising:
receiving score data for a plurality of users; and
generating a second notification instructing further data protection measures in response to determining a subset of the score data exceeds a second threshold.