Automated least privilege using risk and usage
A set of one or more permissions associated with an identity is determined. One or more risk metrics and corresponding usage associated with the one or more permissions associated with the identity are determined. Access associated with at least one permission from the set of one or more permissions associated with the identity is modified based on the one or more determined risk metrics and corresponding usage associated with the one or more permissions associated with the identity.
1 . A system, comprising:
a processor configured to:
determine a set of one or more permissions associated with an identity;
for each permission of the set of one or more permissions, determine one or more risk metrics that are calculated independently of historical usage, and determine corresponding usage of the one or more permissions associated with the identity; and
modify access associated with at least one permission from the set of one or more permissions associated with the identity based on the one or more determined risk metrics and corresponding usage of the one or more permissions associated with the identity, including maintaining a first permission from the set of one or more permissions as standing access when the risk metrics associated with the permission are below a risk threshold, and converting a second permission from the set of one or more permissions from standing access to just-in-time access when the risk metrics associated with the second permission exceed the risk threshold and the corresponding usage indicates a need for the second permission; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system of claim 1 , wherein the set of one or more permissions associated with the identity is an initial set of permissions.
3 . The system of claim 1 , wherein the set of one or more permissions associated with the identity is a previously determined least privilege set of permissions.
4 . The system of claim 1 , wherein the set of one or more permissions associated with the identity is determined according to a schedule, in response to a user command, or in response to an event.
5 . The system of claim 1 , wherein the set of one or more permissions associated with the identity includes one or more low privilege permissions after access associated with the at least one permission from the set of one or more permissions is modified.
6 . The system of claim 1 , wherein the one or more risk metrics that are calculated independently of historical usage are based in part on an account risk and an identity risk.
7 . The system of claim 6 , wherein the account risk is based on one or more of a permission risk, a policy risk, data sensitivity, and customer criticality.
8 . The system of claim 7 , wherein the permission risk is based in part on an access level associated with a permission.
9 . The system of claim 8 , wherein to determine the access level associated with the permission, the processor is configured to:
provide to a large language model a description of the permission and an instruction to determine the access level associated with the permission based on the permission;
receive a response from the large language model; and
assign the access level associated with the permission to the permission based on the response.
10 . The system of claim 6 , wherein the identity risk is based on a posture risk metric, a behavior risk metric, and/or a privilege risk metric.
11 . The system of claim 1 , wherein the corresponding usage associated with the one or more permissions is based on cloud event log history, identity provider activity, and/or actions performed by the identity within an application after authentication.
12 . The system of claim 1 , wherein the processor is configured to determine an excessive privilege score based on the one or more risk metrics and the corresponding usage associated with the one or more permissions associated with the identity.
13 . The system of claim 12 , wherein the processor is configured to compare a risk score that is based on the excessive privilege score, the one or more risk metrics associated with the permission, and a corresponding usage associated with the permission to a risk threshold.
14 . The system of claim 13 , wherein the processor is configured to remove a permission from the set of one or more permissions in response to determining that the risk is not less than a risk threshold and a second risk threshold.
15 . A method, comprising:
determining a set of one or more permissions associated with an identity;
for each permission of the set of one or more permissions, determining one or more risk metrics that are calculated independently of historical usage, and determining corresponding usage of the one or more permissions associated with the identity; and
modifying access associated with at least one permission from the set of one or more permissions associated with the identity based on the one or more determined risk metrics and corresponding usage of the one or more permissions associated with the identity, including maintaining a first permission from the set of one or more permissions as standing access when the risk metrics associated with the permission are below a risk threshold, and converting a second permission from the set of one or more permissions from standing access to just-in-time access when the risk metrics associated with the second permission exceed the risk threshold and the corresponding usage indicates a need for the second permission.
16 . The method of claim 15 , wherein the set of one or more permissions associated with the identity includes one or more low privilege permissions after access associated with the at least one permission from the set of one or more permissions is modified.
17 . The method of claim 15 , wherein the one or more risk metrics are based in part on an account risk and an identity risk.
18 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
determining a set of one or more permissions associated with an identity;
for each permission of the set of one or more permissions, determining one or more risk metrics that are calculated independently of historical usage, and determining corresponding usage of the one or more permissions associated with the identity; and
modifying access associated with at least one permission from the set of one or more permissions associated with the identity based on the one or more determined risk metrics and corresponding usage of the one or more permissions associated with the identity, including maintaining a first permission from the set of one or more permissions as standing access when the risk metrics associated with the permission are below a risk threshold, and converting a second permission from the set of one or more permissions from standing access to just-in-time access when the risk metrics associated with the second permission exceed the risk threshold and the corresponding usage indicates a need for the second permission.