Detecting misconfiguration of guest account security permissions
Systems, devices, and techniques are disclosed for detecting misconfiguration of guest account security permissions. User personas may be generated from user activity data generated by access using guest accounts to controllers of a cloud computing server system. Clusters of user personas may be generated from the user personas. Anomalous user personas may be identified based on the clusters of user personas. A database query that was made to a database of the cloud computing server system, is associated with an identified user persona, and requested sensitive data may be identified from database query logs. A size of a response from the database to the identified database query may be identified from the database query logs. The size of the response may indicate that the response included the sensitive data. The cloud computing server system may prevent use of the guest account associated with the user persona.
1 . A computer-implemented method comprising:
generating user personas from user activity data generated by access using guest accounts to controllers of a cloud computing server system, wherein guest accounts provide access to respective applications hosted on the cloud computing server system, and wherein the user personas are associated with the guest accounts;
generating clusters of user personas from the user personas;
identifying anomalous user personas based on the clusters of user personas;
identifying from database query logs at least one database query that was made to a database of the cloud computing server system, is associated with at least one of the identified user personas, and requested sensitive data;
identifying from the database query logs a size of a response from the database to the identified at least one database query wherein the size of the response indicates that the response included the sensitive data that was requested in the at least one database query; and
preventing, by the cloud computing server system, use of the one of the guest accounts associated with the user persona that was identified as anomalous and is associated with identified at least one database query that received at least one identified response.
2 . The computer-implemented method of claim 1 , wherein generating user personas from user activity data generated by access using guest accounts to controllers of a cloud computing server system further comprises generating a user persona associated with one of the guest accounts by aggregating from controller logs of the controllers of the cloud computing server system IP addresses, user-agent headers, tenant identifiers, user identifiers, and dates of detection of access to the controllers.
3 . The computer-implemented method of claim 1 , wherein identifying anomalous user personas based on the clusters of user personas further comprises determining which of the user personas are in clusters that includes less than a threshold percentage of all of the user personas and determining which of the user personas are a more than threshold distance from the center of cluster which the user personas are part of.
4 . The computer-implemented method of claim 1 , wherein identifying from database query logs at least one database query to a database of the cloud computing server system that is associated with at least one of the identified user personas and requested sensitive data further comprises determining a sensitivity score for the at least one database query using a large language model and field and table names of the at least one database query.
5 . The computer-implemented method of claim 1 , wherein identifying from application logs a response from the database to the identified at least one database query wherein a size of the response indicates that the response included the sensitive data that was requested in the at least one database query further comprises comparing the size of the response to a baseline size of a response indicating that no record was found in the database.
6 . The computer-implemented method of claim 1 , further comprising changing, by the cloud computing server system, the security permissions of the one of the guest accounts associated with the user persona that was identified as anomalous and is associated with identified at least one database query.
7 . The computer-implemented method of claim 1 , wherein the sensitive data comprises customer data or payment data.
8 . A computer-implemented system comprising:
a storage; and
a processor that generates user personas from user activity data generated by access using guest accounts to controllers of a cloud computing server system, wherein guest accounts provide access to respective applications hosted on the cloud computing server system, and wherein the user personas are associated with the guest accounts,
generates clusters of user personas from the user personas,
identifies anomalous user personas based on the clusters of user personas,
identifies from database query logs at least one database query that was made to a database of the cloud computing server system, is associated with at least one of the identified user personas, and requested sensitive data,
identifies from the database query logs a size of a response from the database to the identified at least one database query wherein the size of the response indicates that the response included the sensitive data that was requested in the at least one database query, and
prevents, by the cloud computing server system, use of the one of the guest accounts associated with the user persona that was identified as anomalous and is associated with identified at least one database query that received at least one identified response.
9 . The computer-implemented system of claim 8 , wherein the processor generates user personas from user activity data generated by access using guest accounts to controllers of a cloud computing server system by generating a user persona associated with one of the guest accounts by aggregating from controller logs of the controllers of the cloud computing server system IP addresses, user-agent headers, tenant identifiers, user identifiers, and dates of detection of access to the controllers.
10 . The computer-implemented system of claim 8 , wherein the processor identifies anomalous user personas based on the clusters of user personas by determining which of the user personas are in clusters that includes less than a threshold percentage of all of the user personas and determining which of the user personas are a more than threshold distance from the center of cluster which the user personas are part of.
11 . The computer-implemented system of claim 8 , wherein the processor identifies from application logs a response from the database to the identified at least one database query wherein a size of the response indicates that the response included the sensitive data that was requested in the at least one database query by comparing the size of the response to a baseline size of a response indicating that no record was found in the database.
12 . The computer-implemented system of claim 8 , wherein the processor further changes, by the cloud computing server system, the security permissions of the one of the guest accounts associated with the user persona that was identified as anomalous and is associated with identified at least one database query.
13 . The computer-implemented system of claim 8 , wherein the one or more processors generate the second hash tree by using the batch identifiers and the ordinal identifiers from the records.
14 . The computer-implemented system of claim 8 , wherein the sensitive data comprises customer data or payment data.
15 . A system comprising: one or more computers and one or more non-transitory storage devices storing instructions which are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
generating user personas from user activity data generated by access using guest accounts to controllers of a cloud computing server system, wherein guest accounts provide access to respective applications hosted on the cloud computing server system, and wherein the user personas are associated with the guest accounts;
generating clusters of user personas from the user personas;
identifying anomalous user personas based on the clusters of user personas;
identifying from database query logs at least one database query that was made to a database of the cloud computing server system, is associated with at least one of the identified user personas, and requested sensitive data;
identifying from the database query logs a size of a response from the database to the identified at least one database query wherein the size of the response indicates that the response included the sensitive data that was requested in the at least one database query; and
preventing, by the cloud computing server system, use of the one of the guest accounts associated with the user persona that was identified as anomalous and is associated with identified at least one database query that received at least one identified response.
16 . The system of claim 15 , wherein the instructions which are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising generating user personas from user activity data generated by access using guest accounts to controllers of a cloud computing server system further cause the one or more computers to perform operations comprising generating a user persona associated with one of the guest accounts by aggregating from controller logs of the controllers of the cloud computing server system IP addresses, user-agent headers, tenant identifiers, user identifiers, and dates of detection of access to the controllers.
17 . The system of claim 15 , wherein the instructions which are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising identifying anomalous user personas based on the clusters of user personas further cause the one or more computers to perform operations comprising determining which of the user personas are in clusters that includes less than a threshold percentage of all of the user personas and determining which of the user personas are a more than threshold distance from the center of cluster which the user personas are part of.
18 . The system of claim 15 , wherein the instructions which are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising identifying from database query logs at least one database query to a database of the cloud computing server system that is associated with at least one of the identified user personas and requested sensitive data further cause the one or more computers to perform operations comprising determining a sensitivity score for the at least one database query using a large language model and field and table names of the at least one database query.
19 . The system of claim 15 , wherein the instructions which are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising identifying from application logs a response from the database to the identified at least one database query wherein a size of the response indicates that the response included the sensitive data that was requested in the at least one database query further cause the one or more computers to perform operations comprising comparing the size of the response to a baseline size of a response indicating that no record was found in the database.
20 . The system of claim 15 , wherein the instructions which are operable, when executed by the one or more computers, to cause the one or more computers to perform operations further cause the one or more computers to perform operations comprising changing, by the cloud computing server system, the security permissions of the one of the guest accounts associated with the user persona that was identified as anomalous and is associated with identified at least one database query.