Granted Patent B1

US 9,760,713 · App. 14/191,648 · Granted Sep 12, 2017

Abstract

Claims (51)

1. A method comprising, by a computer system comprising a processing unit, wherein the processing unit is operable to implement the method:

monitoring, by a file-system auditing component comprising a computer server, file-system events of a file system for risk-assessment events;

responsive to a real-time determination of at least one risk-assessment event:

determining an age of a file-system object associated with the risk-assessment event, wherein the age comprises at least one of a creation date of the file-system object and a time elapsed since the creation date;

counting a number of individual users who have permission to access the file-system object;

measuring a depth of the file-system object in the file system;

determining, by an exposure-assessment module comprising a computer server, a content-independent risk of exposure of the file-system object;

wherein the content-independent risk of exposure is determined as a function of at least the determined age, the counted number of individual users and the measured depth;

wherein the content-independent risk of exposure increases in response to a greater determined age of the file-system object, a greater counted number of individual users who have permission to access the file-system object, and lesser values of the measured depth of the file-system object; and

wherein the determining the content-independent risk of exposure is performed without scanning data within the file system for sensitive information.

2. The method of claim 1 , comprising:

evaluating the determined content-independent risk of exposure against one or more notification rules; and

responsive to a notification determination, notifying one or more users of the determined content-independent risk of exposure.

3. The method of claim 1 , wherein the at least one risk-assessment event is selected from the group consisting of: a permissions change, a read access, and a write access.

4. The method of claim 1 , wherein the file-system object comprises a plurality of files.

5. The method of claim 1 , wherein the file-system object comprises a folder.

6. The method of claim 1 , wherein the determining of the content-independent risk of exposure is based, at least in part, on a user-access count and a group-access count.

7. The method of claim 1 , wherein the determining of the content-independent risk of exposure is based, at least in part, on file-system-object variables selected from the group consisting of: age of permissions, number of write accesses, number of read accesses, number of changes to user permissions over a certain period of time, number of changes to user-group permissions over a certain period of time, number of file-creation events, number of explicit individual-user accesses, and number of group accesses.

8. An information handling system comprising:

a computing device comprising a processor, wherein the processor is operable to implement a method, the method comprising:

monitoring, by a file-system auditing component comprising a computer server, file-system events of a file system for risk-assessment events;

responsive to a real-time determination of at least one risk-assessment event:

determining an age of a file-system object associated with the risk-assessment event, wherein the age comprises at least one of a creation date of the file-system object and a time elapsed since the creation date;

counting a number of individual users who have permission to access the file-system object;

measuring a depth of the file-system object in the file system;

determining, by an exposure-assessment module comprising a computer server, a content-independent risk of exposure of the file-system object;

wherein the content-independent risk of exposure is determined as a function of at least the determined age, the counted number of individual users and the measured depth;

wherein the content-independent risk of exposure increases in response to a greater determined age of the file-system object, a greater counted number of individual users who have permission to access the file-system object, and lesser values of the measured depth of the file-system object; and

wherein the determining the content-independent risk of exposure is performed without scanning data within the file system for sensitive information.

9. The information handling system of claim 8 , the method comprising:

evaluating the determined content-independent risk of exposure against one or more notification rules; and

responsive to a notification determination, notifying one or more users of the determined content-independent risk of exposure.

10. The information handling system of claim 8 , wherein the at least one risk-assessment event is selected from the group consisting of: a permissions change, a read access, and a write access.

11. The information handling system of claim 8 , wherein the file-system object comprises a plurality of files.

12. The information handling system of claim 8 , wherein the file-system object comprises a folder.

13. The information handling system of claim 8 , wherein the determining of the content-independent risk of exposure is based, at least in part, on a user-access count and a group-access count.

14. The information handling system of claim 8 , wherein the determining of the content-independent risk of exposure is based, at least in part, on file-system-object variables selected from the group consisting of: age of permissions, number of write accesses, number of read accesses, number of changes to user permissions over a certain period of time, number of changes to user-group permissions over a certain period of time, number of file-creation events, number of explicit individual-user accesses, and number of group accesses.

15. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a method comprising:

monitoring, by a file-system auditing component comprising a computer server, file-system events of a file system for risk-assessment events;

responsive to a real-time determination of at least one risk-assessment event:

determining an age of a file-system object associated with the risk-assessment event, wherein the age comprises at least one of a creation date of the file-system object and a time elapsed since the creation date;

counting a number of individual users who have permission to access the file-system object;

measuring a depth of the file-system object in the file system;

determining, by an exposure-assessment module comprising a computer server, a content-independent risk of exposure of the file-system object;

wherein the content-independent risk of exposure is determined as a function of at least the determined age, the counted number of individual users and the measured depth;

wherein the content-independent risk of exposure increases in response to a greater determined age of the file-system object, a greater counted number of individual users who have permission to access the file-system object, and lesser values of the measured depth of the file-system object; and

wherein the determining the content-independent risk of exposure is performed without scanning data within the file system for sensitive information.

16. The computer-program product of claim 15 , the method comprising:

evaluating the determined content-independent risk of exposure against one or more notification rules; and

responsive to a notification determination, notifying one or more users of the determined content-independent risk of exposure.

17. The computer-program product of claim 15 , wherein the at least one risk-assessment is selected from the group consisting of: a permissions change, a read access, and a write access.

Assignments (26)