Privilege level assignments to groups
According to examples, an apparatus may include a memory on which is stored machine-readable instructions that may cause a processor to determine, for each of a plurality of members in a group, a respective least privilege level for a resource and determine, based on the determined respective least privilege levels, a privilege level to be assigned to the group for the resource. The instructions may also cause the processor to assign the determined privilege level to the group for the resource and apply the assigned privilege level to the members of the group for the resource.
1 . An apparatus comprising:
a processor; and
a memory on which is stored machine-readable instructions that, when executed by the processor, cause the processor to:
query an access log stored in a distributed access store to identify a plurality of members that perform a common duty or function;
determine historical usage of a plurality of resources that one or more members of the plurality of members has accessed;
determine a plurality of privilege levels associated with the plurality of members for accessing one or more of the plurality of resources;
determine a plurality of lowest privilege levels of the plurality of privilege levels that a first subset of members of the plurality of members have used to access data on a first resource of the plurality of resources to perform the common duty or function based on historical usage of the first resource;
determine that a majority of the first subset of members comprise a lowest privilege level from the plurality of the lowest privilege levels;
assign the lowest privilege level as an assigned privilege level to the plurality of members, wherein for the assigned privilege level comprises a highest access level that each member in the plurality of members is assigned to access the data on the first resource;
determine a count of members in the plurality of members who used one or more privilege levels that are lower than the assigned privilege level over a predefined time period;
iteratively partition the plurality of members into a plurality of subgroups based on a determination that the count exceeds a predefined threshold value,;
assign members of the plurality of members who did not use the one or more privilege levels that are lower than the assigned privilege level to a first sub-group of the plurality of sub-groups;
assign members of the plurality of members who used the one or more privilege levels that are lower than the assigned privilege level to a second sub-group of the plurality of subgroups; and
modify the assigned privilege level stored in a data store for a second subset of members in the second sub-group to a lower privilege level than the assigned privilege level, thereby restricting access to the first resource by the second subset of members in the second sub-group to the lower privilege level.
2 . The apparatus of claim 1 , wherein the instructions cause the processor to:
based on a determination that the count does not exceed the predefined threshold value, determine that the assigned privilege level of the plurality of members is not to be modified;
identify a member of the plurality of members that used a privilege level that is lower than the assigned privilege level of the plurality of members;
assign the privilege level that is lower than the assigned privilege level of the plurality of members to the identified member for accessing the first resource; and
apply the privilege level that is lower than the assigned privilege level of the plurality of members to the identified member for accessing the first resource.
3 . The apparatus of claim 1 , wherein the instructions cause the processor to:
identify any of the members of the plurality of members who used a privilege level that exceeds the assigned privilege level of the plurality of members for accessing the first resource; and
assign and apply the privilege level that exceeds the assigned privilege level of the plurality of members to the identified members of the plurality of members for accessing the first resource.
4 . The apparatus of claim 1 , wherein the instructions cause the processor to:
determine whether partitioning the plurality of members exceeds a complexity threshold; and
partition the plurality of members into the first sub-group and the second sub-group based on a determination that the partitioning does not exceed the complexity threshold.
5 . The apparatus of claim 1 , wherein the instructions cause the processor to:
determine a privilege level assigned to each of the members in the plurality of members for usage of a second resource;
determine, based on the privilege level assigned to each of the members in the plurality of members for usage of the second resource, a second privilege level to be assigned to the plurality of members for usage of the second resource;
assign the second privilege level to the plurality of members for usage of the second resource; and
apply the second privilege level to the plurality of members for usage of the second resource.
6 . A method comprising:
querying, by a processor, an access log stored in a distributed access store to identify a plurality of members that perform a common duty or function;
determining, by the processor, historical usage of a plurality of resources that one or more members of the plurality of members has accessed;
determining, by the processor, a plurality of privilege levels associated with the plurality of members for accessing one or more of the plurality of resources;
determining, by the processor, a plurality of lowest privilege levels of the plurality of privilege levels that a first subset of members of the plurality of members have used to access data on a first resource of the plurality of resources to perform the common duty or function based on historical usage of the first resource;
determining, by the processor, that a majority of the first subset of members comprise a lowest privilege level from the plurality of privilege levels;
assigning, by the processor, the lowest privilege level as an assigned privilege level to the plurality of the members, wherein the assigned privilege level comprises a highest access level that each member in the plurality of members is assigned to access the data on the first resource;
determining, by the processor, a count of members in the plurality of members who used one or more privilege levels that are lower than the assigned privilege level over a predefined time period;
iteratively partitioning, by the processor, the plurality of members into a plurality of subgroups based on a determination that the count does not exceed a predefined threshold value;
assigning, by the processor, members of the plurality of members who did not use the one or more privilege levels that are lower than the assigned privilege level to a first sub-group of the plurality of sub-groups;
assigning, by the processor, members of the plurality of members who used the one or more privilege levels that are lower than the assigned privilege level to a second sub-group of the plurality of sub-groups a second sub-group of the plurality of subgroups; and
modifying, by the processor, the assigned privilege level stored in a data store for a second subset of members in the second sub-group to a lower privilege level than the assigned privilege level, thereby restricting access to the first resource by the second subset of members in the second sub-group to the lower privilege level.
7 . The method of claim 6 , further comprising:
based on a determination that the count does not exceed the predefined threshold value, determining that the assigned privilege level of the plurality of members is not to be modified;
identifying a member of the plurality of members that used a privilege level that is lower than the assigned privilege level of the plurality of members;
assigning the privilege level that is lower than the assigned privilege level of the plurality of members to the identified member for accessing the first resource;
and applying the privilege level that is lower than the assigned privilege level of the plurality of members to the identified member for accessing the first resource.
8 . The method of claim 6 , further comprising:
identifying any of the members of the plurality of members who used a privilege level that exceeds the assigned privilege level of the plurality of members for accessing the first resource; and
assigning and apply the privilege level that exceeds the assigned privilege level of the plurality of members to the identified members of the plurality of members for accessing the first resource.
9 . The method of claim 6 , further comprising:
determining whether partitioning the plurality of members exceeds a complexity threshold; and
partitioning the plurality of members into the first sub-group and the second sub-group based on a determination that the partitioning does not exceed the complexity threshold.
10 . The method of claim 6 , further comprising:
determining a privilege level assigned to each of the members in the plurality of members for usage of a second resource;
determining, based on the privilege level assigned to each of the members in the plurality of members for usage of the second resource, a second privilege level to be assigned to the plurality of members for usage of the second resource;
assigning the second privilege level to the plurality of members for usage of the second resource; and
applying the second privilege level to the plurality of members for usage of the second resource.
11 . A non-transitory computer readable storage medium storing instructions that, when executed by a processor, cause the processor to:
query an access log stored in a distributed access store to identify a plurality of members that perform a common duty or function;
determine historical usage of a plurality of resources that one or more members of the plurality of members has accessed;
determine a plurality of privilege levels associated with the plurality of members for accessing one or more of the plurality of resources;
determine a plurality of lowest privilege levels of the plurality of privilege levels that a first subset of members of the plurality of members have used to access data on a first resource of the plurality of resources to perform the common duty or function based on historical usage of the first resource;
determine that a majority of the first subset of members comprise a lowest privilege level from the plurality of the lowest privilege levels;
assign the lowest privilege level as an assigned privilege level to the plurality of members, wherein for the assigned privilege level comprises a highest access level that each member in the plurality of members is assigned to access the data on the first resource;
determine a count of members in the plurality of members who used one or more privilege levels that are lower than the assigned privilege level over a predefined time period;
iteratively partition the plurality of members into a plurality of sub-groups based on a determination that the count exceeds a predefined threshold value,;
assign members of the plurality of members who did not use the one or more privilege levels that are lower than the assigned privilege level to a first sub-group of the plurality of sub-groups;
assign members of the plurality of members who used the one or more privilege levels that are lower than the assigned privilege level to a second sub-group of the plurality of sub-groups; and
modify the assigned privilege level stored in a data store for a second subset of members in the second sub-group to a lower privilege level than the assigned privilege level, thereby restricting access to the first resource by the second subset of members in the second sub-group to the lower privilege level.
12 . The non-transitory computer readable storage medium of claim 11 , wherein the instructions cause the processor to:
based on a determination that the count does not exceed the predefined threshold value, determine that the assigned privilege level of the plurality of members is not to be modified;
identify a member of the plurality of members that used a privilege level that is lower than the assigned privilege level of the plurality of members;
assign the privilege level that is lower than the assigned privilege level of the plurality of members to the identified member for accessing the first resource; and
apply the privilege level that is lower than the assigned privilege level of the plurality of members to the identified member for accessing the first resource.
13 . The non-transitory computer readable storage medium of claim 11 , wherein the instructions cause the processor to:
identify any of the members of the plurality of members who used a privilege level that exceeds the assigned privilege level of the plurality of members for accessing the first resource; and
assign and apply the privilege level that exceeds the assigned privilege level of the plurality of members to the identified members of the plurality of members for accessing the first resource.
14 . The non-transitory computer readable storage medium of claim 11 , wherein the instructions cause the processor to:
determine whether partitioning the plurality of members exceeds a complexity threshold; and
partition the plurality of members into the first sub-group and the second sub-group based on a determination that the partitioning does not exceed the complexity threshold.
15 . The non-transitory computer readable storage medium of claim 11 , wherein the instructions cause the processor to:
determine a privilege level assigned to each of the members in the plurality of members for usage of a second resource;
determine, based on the privilege level assigned to each of the members in the plurality of members for usage of the second resource, a second privilege level to be assigned to the plurality of members for usage of the second resource;
assign the second privilege level to the plurality of members for usage of the second resource; and
apply the second privilege level to the plurality of members for usage of the second resource.