Dormant Account Identifier

Abstract

A dormant account identifier is disclosed. An inactive account can be determined based on whether user activity of the account is outside a threshold amount. A determination can be made as to whether the inactive account is a dormant account based on account activity of peer accounts to the inactive account.

Description

Background Art

[0001] A computer network that may include a cloud computing environment may be configured to allow users in an enterprise to access enterprise resources via user accounts. In one example, a computer network may implement user accounts via a program or service that includes the features of an account manager, which may include the features of an identity management system. An identity management or identity and access management (or IAM) system may include a framework of applicable services and policies for an enterprise to provide appropriate user access to enterprise resources including applications, files, and data. An identity and access management system may fall under the umbrella of information technology and data management. An IAM system may identify, authenticate, and authorize users and hardware of an enterprise, and allow appropriate access to enterprise resources in a computer network. For example, an IAM system may authenticate a user and a user's computing device, such as by securely logging into a network and applying a policy set to the user to grant access to an application or data, depending on whether the user has permission to access the application or data. An IAM system may also provide user accounts, track the use of accounts, and record events or operations of accounts. An IAM system may store data for each user account, including data that authenticates the identity of the user (such as a username and password), and data that describes the permissions and actions that the user is authorized to access or perform on a resource. Summary of the invention

[0002] This Summary is provided to introduce some concepts in a simplified form that are further described in the following description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0003] The present disclosure is directed to identifiers for dormant user accounts. Dormant user accounts may present security issues to an enterprise. For example, a threat actor such as a hacker or unauthorized user may seek access to sensitive enterprise information through the account of a user who changes positions within the enterprise or leaves the enterprise.

[0004] The dormant account identifier can determine whether an inactive account is a dormant account. It can be determined that the dormant account is canceled. The inactive account can be determined based on whether the user activity of the account is outside the threshold amount. For example, the inactive account can include an account with a last use date exceeding the determined threshold amount. Based on the account activity of the peer account (including multiple peer accounts of the inactive account) for the inactive account, it can be determined whether the inactive account is a dormant account, such as an account that should be canceled. For example, it can be determined whether the inactive account is a dormant account based on the frequency of use of the peer account for the inactive account. In another example, it can be determined whether the inactive account is a dormant account based on the last use date and the frequency of use of the peer account for the inactive account. The peer account can be determined or selected from a security group peer, an organizational tree peer, a collaborative peer, a behavioral peer, or other peers. By considering the activity of the peer account, the determination of whether the inactive account is indeed a dormant account can reduce the potential false positive determination based only on user inactivity.

[0005] In one example, the dormant account identifier can be implemented as a standalone program running on a processor or computing device, or the dormant account identifier can be part of an infrastructure or platform as a service (such as for cloud tenants) or as software as a service. In one example, the dormant account identifier receives account activity information for a set of enterprise accounts, which includes user accounts and peer accounts. For example, the dormant account identifier can track account activity directly or receive account activity from an account manager or other resource of the enterprise. The dormant account identifier can take security actions on dormant accounts, such as deprovisioning dormant accounts or searching for suspicious activity of dormant accounts. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this disclosure. The accompanying drawings illustrate the embodiments and are used together with the description to explain the principles of the embodiments. Other embodiments and many expected advantages of the embodiments will be readily understood as they become better understood by reference to the following description. The elements of the accompanying drawings are not necessarily to scale with respect to each other. The same reference numerals designate corresponding similar parts.

[0007] Figure 1 is a block diagram illustrating examples of computing devices that may be configured in a computer network to provide, for example, a cloud computing environment.

[0008] Figure 2 is a schematic diagram illustrating an example computer network including a dormant account identifier.

[0009] Figure 3 is a block diagram illustrating an example method, such as Figure 2 A dormant account identifier method. DETAILED DESCRIPTION

[0010] In the following description, reference is made to the accompanying drawings, which form a part of this document, and in which specific embodiments in which the present invention may be implemented are shown by way of illustration. It should be understood that other embodiments may be utilized and that structural or logical changes may be made without departing from the scope of the present invention. Therefore, the following description should not be understood in a limiting sense. It should be understood that, unless otherwise specifically noted, the features of the various example embodiments described herein may be combined with each other in part or in their entirety.

[0011] Figure 1 An exemplary computer system is illustrated that can be employed in an operating environment and used to host or run a computer application included on one or more computer-readable storage media that stores computer-executable instructions for controlling a computer system such as a computing device to perform a process. The exemplary computer system includes a computing device, such as computing device 100. Computing device 100 can take one or more of a variety of forms. Such forms include tablet computers, personal computers, workstations, servers, handheld devices, consumer electronic devices (such as video game consoles or digital video recorders), etc., and can be a stand-alone device or configured as part of a computer network.

[0012] In a basic hardware configuration, the computing device 100 typically includes a processor system having one or more processing units (i.e., processors 102) and memory 104. As an example, the processing unit may include two or more processing cores on a chip or two or more processor chips. In some examples, the computing device may also have one or more additional processing or special-purpose processors (not shown), such as a graphics processor for general-purpose computing on a graphics processor unit, to perform processing functions offloaded from the processor 102. The memory 104 may be arranged in a hierarchy and may include one or more levels of cache. Depending on the configuration and type of the computing device, the memory 104 may be volatile (such as random access memory (RAM)), non-volatile (such as read-only memory (ROM), flash memory, etc.), or some combination of the two.

[0013] The computing device 100 may also have additional features or functions. For example, the computing device 100 may also include additional storage devices. Such storage devices may be removable and / or non-removable, and may include magnetic or optical disks, solid-state memory, or flash memory devices, such as removable storage 108 and non-removable storage 110. Computer storage media include volatile and non-volatile, removable and non-removable media, which are implemented in any suitable method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Memory 104, removable storage 108, and non-removable storage 110 are all examples of computer storage media. Computer storage media include RAM, ROM, EEPROM, flash memory or other storage technology, CD-ROM, digital versatile disc (DVD) or other optical storage devices, cassettes, magnetic tapes, disk storage devices or other magnetic storage devices, universal serial bus (USB) flash drives, flash cards or other flash memory devices, or any other storage medium that can be used to store the desired information and can be accessed by the computing device 100. Correspondingly, the propagation signal itself does not serve as a storage medium. Any such computer storage media may be part of computing device 100 .

[0014] The computing device 100 typically includes one or more input and / or output connections, such as a USB connection, a display port, a proprietary connection, etc., to connect to various devices to provide input and output to the computing device. Input devices 112 may include devices such as a keyboard, a pointer device (e.g., a mouse, a track pad), a stylus, a voice input device, a touch input device (e.g., a touch screen), etc. Output devices 111 may include devices such as a display, a speaker, a printer, etc.

[0015] The computing device 100 typically includes one or more communication connections 114 that allow the computing device 100 to communicate with other computers / applications 115. Example communication connections may include Ethernet interfaces, wireless interfaces, bus interfaces, storage area network interfaces, and proprietary interfaces. The communication connections may be used to couple the computing device 100 to a computer network, which may be classified according to a variety of characteristics such as topology, connection method, and scale. A network is a collection of computing devices and possibly other devices interconnected by communication channels that facilitate communication and allow sharing of resources and information among the interconnected devices. Examples of computer networks include local area networks, wide area networks, the Internet, or other networks.

[0016] In one example, one or more of the computing devices 100 can be configured as a server in a data center to provide distributed computing services, such as cloud computing services. The data center can provide pooled resources, on which customers or tenants can dynamically provision and scale applications as needed without adding servers or additional networking. The data center can be configured to communicate with local computing devices such as those used by cloud consumers, including personal computers, mobile devices, embedded systems, or other computing devices. Within the data center, the computing device 100 can be configured as a server, as a standalone device or as an individual blade in a rack of one or more other server devices. One or more host processors (such as processor 102) and other components (including memory 104 and storage device 110) on each server run a host operating system, which can support multiple virtual machines. A tenant can initially use one virtual machine on a server to run an application. When demand increases, the data center can activate additional virtual machines on the server or other servers, and the data center can deactivate the virtual machines when demand decreases.

[0017] A data center can be an internal private system that provides services to a single enterprise user, or it can be a publicly (or semi-publicly) accessible distributed system that provides services to multiple, possibly unrelated customers and tenants, or it can be a combination of the two. In addition, a data center can be contained within a single geographic location, or it can be distributed to multiple locations across the globe and provide redundancy and disaster recovery capabilities. For example, a data center can designate one virtual machine on a server as the primary location for a tenant application, and can activate another virtual machine on the same or another server as a secondary or backup in case the first virtual machine or server fails.

[0018] Cloud computing environments are typically implemented in one or more identification models to run in one or more network-connected data centers. Private cloud deployment models include infrastructure that is specifically operated for an organization, whether it is managed internally or by a third party, and whether it is hosted within the organization or at some remote external location. Examples of private clouds include self-operated data centers. Public cloud deployment models include infrastructure that is available to the public or a large portion of the public (such as an industry group) and operated by an organization that provides cloud services. Community clouds are shared by multiple organizations and support a specific community of organizations with common concerns (such as jurisdiction, compliance, or security). Deployment models typically include similar cloud architectures, but may include specific features that address specific considerations (such as security in a shared cloud model).

[0019] A hybrid cloud is a deployment model that includes two or more clouds, such as private, public, and community clouds, or a combination of two or more clouds in each deployment model, that remain a unique entity. A hybrid cloud includes technologies for binding two or more clouds together and in some examples allowing data and application portability across clouds, such as cloud bursting for load balancing and service interoperability.

[0020] Cloud computing providers typically provide services for cloud computing environments as a service model, which is provided as one or more of infrastructure as a service, platform as a service, and other services including software as a service. Cloud computing providers can provide services via subscriptions to tenants or consumers. For example, software as a service providers provide software applications as subscription services, which are usually accessible from a web browser or other thin client interface, and consumers do not load the application on local computing devices. Infrastructure as a service providers provide consumers with the ability to supply processing, storage, network and other basic computing resources, where consumers can deploy and run software, which may include operating systems and applications. Consumers generally do not manage the underlying cloud infrastructure, but generally retain control over the computing platform and the applications running on the platform. Platform as a service providers provide consumers with the ability to deploy applications created or acquired by consumers onto cloud infrastructure, which are created using programming languages, libraries, services and tools supported by the provider. In some examples, consumers do not manage or control the underlying cloud infrastructure (including networks, servers, operating systems or storage devices), but have control over the possible configuration settings of the deployed applications and application hosting environment. In other examples, providers may offer a combination of infrastructure and platform services to allow consumers to manage or control deployed applications and the underlying cloud infrastructure. Platform as a Service providers may include infrastructure (such as servers, storage, and networking), and may also include middleware, development tools, business intelligence services, database management services, etc., and may be configured to support application lifecycle features, including one or more of building, testing, deploying, managing, and updating.

[0021] Figure 2An example computer network 200 is illustrated. In one example, the computer network 200 includes a private network for an enterprise, such as a private cloud, in which applications and data are deployed for use by members of the enterprise, such as employees with accounts configured in the network. In another example, the computer network 200 includes a cloud computing environment, such as a public cloud, to deploy applications and data on a platform and infrastructure across selected data centers, wherein the enterprise includes a capability provided to cloud tenants to deploy applications and data as cloud-based assets to the computer network 200 for use by members of the enterprise via an account. The computer network may include resources 202 available from one or more resource providers. The resources 202 may include components of an application to be provided in a platform subscription, and items that provide a platform solution. Examples of resources 202 may include virtual machines, databases, virtual networks, and the like. The resources 202 may be user-managed entities, entities automatically managed by a platform with the computer network 200, or a combination of user-managed entities and automatically managed entities. Resource providers include services that provide resources, such as services that create, configure, and manage operations for working with the resources 202. Examples of resource providers include computing providers that provide virtual machine resources, storage providers that provide storage account resources, web providers that provide resources related to web applications, and other resource providers.

[0022] The computer network may also include an account manager 204, which provides user accounts, and in some examples, tracks user accounts and records user events or operations via accounts. In some examples, resources 202 may be available to authorized users via account manager 204, which may include various subsets of enterprise members, and for each resource 202 in the computer network 200, each user may have further restrictions via the permission (from the permission level set) to each authorized user. In one example, a username and password are used to obtain access to resource 202, and account manager 204 may implement single sign-on technology so that after the user accesses the account, the user may access multiple resources 202 without having to obtain authorized access from account manager 204. Account manager 204 may implement restrictions or permission levels to accounts, or may work with a system that allocates restrictions or permission levels. In one example, account manager 204 is a program running on computer network 200. For example, account manager may be a stand-alone program or as part of a larger identity and asset manager solution for an enterprise. In one example, account manager 204 may be implemented as a service, such as an identity-as-a-service provided from a service provider. In one configuration, the account manager 204 is an example resource 202 of the computer network 200 .

[0023] Users 206 can access resources 202 via accounts provided by account manager 204. For example, users 206 operating computing devices can access resources 202 via computing devices provided by an enterprise directly coupled to a private enterprise network. In some examples, users 206 can access resources 202 over a computer network (such as the Internet coupled to computing network 200) via computing devices provided by a person (bring your own device or BYOD) or computing devices provided by an enterprise. For example, users 206 can access a computer network from within an enterprise or from a remote location via an account. Users 206 logged into an account can also communicate with each other, such as via resources 202 including email programs and messaging applications, or collaborate with each other via resources 202 such as collaboration software or file sharing programs and services.

[0024] User 206 can log in and access resource 202 with a valid account or an open account. In one example, account manager 204 can be used to close an account. If an account is closed, user 206 can no longer access resources via the account. An account may be closed for a variety of reasons, such as the user is no longer in the enterprise, the user's position in the enterprise has moved to a position that does not have access to resource 202, or another account is opened for the user. In some examples, the user can change the status within the enterprise, and the manager or human resources personnel will usually notify the administrator of the computer network 200 of the change in the status of user 206, and the administrator of the computer network 200 will close the user's account. In some cases, this step can be effectively implemented, and in response to the change in the user's status, the user account is quickly closed. In other cases, communication and action can be delayed or not taken, and the account remains open, regardless of the intention or expectation to close the account. An open account that is considered to be closed or intended to be closed is a common example of a dormant user account or a dormant account. Other less common examples of dormant user accounts include accounts opened by individuals (such as administrators of computer networks) unintentionally or mistakenly. Most security professionals surveyed recently believe that their computer networks have several dormant accounts that have not yet been discovered and shut down.

[0025] Dormant user accounts may present security issues to the computer network 200. For example, a threat actor such as a hacker or unauthorized user may seek access to sensitive enterprise information through the account of a user who changes positions within the enterprise or leaves the enterprise. Dormant accounts are common and can indicate a miscommunication or delay between administrative resources or human resources in an organization and their security administrators. A threat actor may search social media or other data sources for information about individuals who change positions within the enterprise. Real accounts or open accounts that are no longer in use can provide a fruitful vector for attacks and allow a threat actor to quietly probe for a considerable period of time without raising suspicion in the computer network 200. Even if a user account does not have significant access rights, a threat actor may apply techniques to gradually move through the computer network 200 in search of data and assets that may be the target of attack activities.

[0026] Computer network 200 includes dormant account identifier 208. In one example, dormant account identifier 208 can enhance the security posture of computer network 200 and reduce its attack surface. Dormant account identifier 208 can be used to identify dormant accounts on computer network 200, and can include the ability to remove dormant accounts or further search for suspicious activities of dormant users. Dormant account identifier 208 may include a computer-readable storage device to store computer-executable instructions to control a processor, such as a server in a data center. In one example, dormant account identifier 208 can be implemented as part of an infrastructure or as a platform as a service such as for cloud tenants. In another example, dormant account identifier 208 can be implemented as software as a service, such as for subscribers in other clouds, hybrid clouds, or private networks. In one example, dormant account identifier 208 can be implemented as a computer program that runs a processor.

[0027] Dormant account identifier 208 receives or tracks information, such as the last date of use and the frequency of use of the account it monitors. In one example, information about the date of use of an account can be provided from a resource 202, such as an account manager 204. Dormant account identifier 208 or other resource 202 can process the date of use of an account to determine the frequency of use of the account, such as the number of times the account has been accessed or used over a selected time period. If an account appears to be inactive for a given time period, then dormant account identifier 208 determines whether the account is a dormant account. For example, if the last date of use exceeds a threshold amount, such as a threshold amount that can be 180 days, then the dormant account identifier will determine that the account is inactive and continue to determine whether the account is dormant. For inactive accounts, the frequency of use of the user's peers is determined. If the peers are often active, such as the frequency of use of the peer account exceeds a given frequency amount, then the inactive account is marked as dormant. Dormant account identifier 208 can alert an administrator and de-provision a dormant account.

[0028] Dormant account identifier 208 can be a stand-alone program or service used with computer network 200, or can be integrated into a security product suite provided in a program or service, such as a security service. Security services including dormant account identifier 208 can provide various features to protect and defend resources 202 (which can include account manager 204) and users 206 from malicious communications or other threats. Security services can include isolation features to prevent unauthorized or unintentional data transmission between deployments of multi-tenant architectures. In addition, security services can include network and endpoint protection in the form of firewalls and virtual firewalls. Security services can be used for logging and monitoring events, including security-related events of agents on each computing, storage or structural node in the environment. Security services including dormant account identifier 208 can include a computer-readable storage device, such as a computer-readable storage device suite, to store computer-executable instructions to control a processor, such as a server in a data center. For example, security services including dormant account identifier 208 can be implemented as part of an infrastructure, or as a platform as a service such as for computer network 200.

[0029] Figure 3An example method 300 of a dormant account identifier, such as the dormant account identifier 208, is illustrated. The method 300 may be implemented as a combination including one or more hardware devices and a computer program for controlling a system, such as a computing system having a processor and a memory, to perform the method 300. For example, the dormant account identifier 208 and the method 300 may be implemented as a computer-readable medium or a computer-readable storage device having a set of executable instructions for controlling a processor to perform the method 300. At 302, an inactive account may be determined based on whether user activity of the account is outside a threshold amount. For example, an inactive account may include an account with a last use date that exceeds a threshold amount as determined at 302. In another example, an inactive account may include an account with a frequency of use within a threshold amount, such as two uses in the past six months, as determined at 302. At 304, it may be determined whether the inactive account is a dormant account, such as an account that should be deprovisioned, based on account activity for a peer account of the inactive account (including multiple peer accounts of the inactive account). For example, at 304, it can be determined whether the inactive account is a dormant account based on the usage frequency of the peer account for the inactive account. In another example, at 304, it can be determined whether the inactive account is a dormant account based on the last usage date and usage frequency of the peer account for the inactive account.

[0030] As part of 302, information about activities on multiple accounts is received. For example, dormant account identifier 208 can receive information about activities of a user account and information about activities of peers of the user account. In one instance, information about activities of multiple peers is received. Information can be received from various sources (such as resources 202 including account manager 204). In another example, dormant account identifier 208 can track information about account usage. In one example, dormant account identifier 208 continuously monitors account activities on the network and continuously determines whether the last use date exceeds a threshold amount and other information. In another example, dormant account identifier 208 occasionally monitors account activities. In yet another example, dormant account identifier 208 receives information about account activities, such as downloading information from a log, when instructed by an administrator. Information about account activities can include the date and time of a successful login session, the date and time of a logout session, the date and time of use of resource 202 during a session, and the resources used during a session.

[0031] At 302, based on the received account information, it is determined whether the last use date of the account has exceeded a threshold amount. The threshold amount can be selected or adjusted based on an appropriate threshold for the enterprise. In one example, multiple threshold amounts can be used to monitor the account. For example, a first user account can correspond to a first threshold amount, and a second user account can correspond to a second threshold amount. The first user may tend to be more active than the second user, so the first threshold amount can be less than the second threshold amount. In one example, the threshold amount applied to the account is the same as the threshold amount applied to the user account peer. The threshold amount can be set in days, such as 180 days or other time amounts. In this example, if the user account has no activity within 180 days (such as the user account has no login session or access to resource 202), the user account is marked as inactive at 302. In one example, at 302, an account whose last use date does not exceed the threshold amount can be determined as an active account.

[0032] Information about account activity can also be used to determine frequency of use. For example, frequency of use can be solved from the amount of activity over a selected time period. Frequency of use can be related to the amount of successful login sessions over a period of time. In one example, the time period can be measured to the current time, and in another example, the time period can be measured to the last successful login session of the user of interest.

[0033] At 304, peer accounts or user peers of the user account are determined. In one example, at 304, a dormant account identifier determines multiple user peers or peers of an inactive account. The determination of user peers may include the determination of one or more peer groups. In one example, a first peer group is determined based on a first criterion. If the insight provided by the first peer group is insufficient, a second peer group may be determined based on a second criterion. Additional peer groups may be determined based on additional criteria. For example, a peer group may include multiple accounts in a security group with a user account. Another example of a peer group may include multiple accounts based on the organizational structure of an enterprise, such as an account group where all users report to the same manager or work in the same department of an enterprise. Another example of a peer group may include multiple accounts, where all users collaborate on a selected project, such as all users may collaborate via collaborative resources 202 or via users who often send messages (including emails) to each other. In another example of a peer group, multiple users may be included, and these users include similar behaviors on the computer network 200, such as accounts that typically use the same resource 202. Machine learning can be implemented to determine user peers for each inactive account or for each account user. User peers can be predetermined before an account is designated as an inactive account, or can be determined after an account is designated as an inactive account.

[0034] Information about user peers is collected to determine corresponding account activity, such as last use date and frequency of use. The criteria for determining account activity may be the same as the criteria applied to user accounts to determine whether an account is inactive. Information about account activity (such as frequency of use) may be considered, or compared with information about account activity of an inactive account, to determine whether an inactive account is dormant. For example, if a user peer of an inactive account is active at a high frequency and is completely within a threshold amount, the inactive account may be determined to be a dormant account. In one example, the frequency of use of the user peer is first considered, and if uncertain, the last use date of the user peer is considered to determine whether the inactive account is a dormant account. In another example, both the last use date of the user peer and the frequency of use of the user peer are considered to determine whether the inactive account is a dormant account.

[0035] In one example of method 300, dormant account identifier 208 tracks account activity for multiple accounts. If an account has been inactive for at least a threshold amount of time (such as six months), the account is marked as inactive at 302. Dormant account identifier 208 may receive account activity information for peer accounts of inactive accounts. In one example, peer accounts are a subset of multiple accounts monitored or tracked by dormant account identifier 208. In one example, peer accounts may include users who work in the same department as the user of the inactive account. In another example, peer accounts may include users who often collaborate together on word processing or spreadsheet resources 202 of the enterprise. Dormant account identifier 208 may consider account activity of peer accounts. For example, if the peer account has been recently active or frequently active, the inactive account may be designated as a dormant account. However, if the peer account is also not frequently active, the inactive account may be designated as a non-dormant account, or remain an inactive account. In one example, user peers may be determined based on another criterion for determining peers (such as users in a security group), and the activity of the peer account may be reconsidered. For example, if the second peer account group is also not frequently active, then the inactive account may be designated as such.

[0036] By considering the activity of the peer account at 304, the determination of whether an inactive account is indeed a dormant account can reduce potential false positive determinations based solely on user inactivity.

[0037] Although specific embodiments have been illustrated and described herein, it will be appreciated by those skilled in the art that various alternative and / or equivalent implementations may replace the specific embodiments shown and described without departing from the scope of the invention. This application is intended to cover any adjustments or changes to the specific embodiments discussed herein.

Claims

1. A method for identifying a dormant account, comprising: determining that an account of a user of the enterprise is an inactive account based on user account activity of the account being outside a threshold amount; Determining the peers of the user based on at least one of: The user and the peer of the user work in the same department of the enterprise; the user collaborating with the peer of the user in web application resources of the enterprise via the user account and the peer account of the peer of the user; as well as Based on peer account activity of the peer accounts of the peers of the user, it is determined whether the inactive account of the user is a dormant account. 2 . The method of claim 1 , wherein determining the inactive account comprises receiving account activity information from a plurality of accounts. The method of claim 1 , wherein determining the inactive account comprises tracking account activity for a plurality of accounts. 4 . The method of claim 1 , wherein the account activity outside a threshold amount includes a last use date exceeding the threshold amount. The method of claim 4 , wherein the last use date comprises a date of a last successful login session. The method of claim 1 , wherein accounts having a last use date that does not exceed the threshold amount are active accounts. The method of claim 1 , wherein the account activity of the peer account comprises a frequency of use of the peer account.

8. The method of claim 1, wherein the account activity of the peer account comprises a last use date of the peer account.

9. The method according to claim 1, comprising: Deprovisioning of said dormant account.

10. The method of claim 1, wherein determining whether the inactive account is a dormant account is based on peer account activity of a plurality of peer accounts of a plurality of peers of the user in the enterprise with the inactive account of the user.

11. A computer readable storage device for storing computer executable instructions for controlling a processor to: determining that an account of a user of the enterprise is an inactive account based on user account activity of the account being outside a threshold amount; Determining the peers of the user based on at least one of: The user and the peer of the user work in the same department of the enterprise; the user collaborating with the peer of the user in a web application resource of the enterprise via the user account and the peer account of the peer of the user; as well as Based on peer account activity of the peer accounts of the peers of the user, it is determined whether the inactive account of the user is a dormant account.

12. The computer-readable storage device of claim 11, wherein the user account activity is based on a last use date of the user account.

13. The computer-readable storage device of claim 12, wherein the user account activity is based on whether the last use date of the user account exceeds the threshold amount.

14. The computer-readable storage device of claim 11, wherein the computer-executable instructions are configured to control the processor to: The user account activity and the account activity of the peer account are received.

15. The computer-readable storage device of claim 11, wherein the computer-executable instructions are configured to control the processor to: A plurality of peer accounts for the inactive account are determined.

16. The computer readable storage device of claim 15, wherein the plurality of peer accounts is based on an organizational structure of an enterprise.

17. A system for identifying dormant accounts, comprising: a memory device for storing an instruction set; as well as A processor for executing the set of instructions to: determining that an account of a user of the enterprise is an inactive account based on user account activity of the account being outside a threshold amount; Determining the peers of the user based on at least one of: The user and the peer of the user work in the same department of the enterprise; the user collaborating with the peer of the user in a web application resource of the enterprise via the user account and the peer account of the peer of the user; as well as Based on peer account activity of the peer accounts of the peers of the user, it is determined whether the inactive account of the user is a dormant account.

18. The system of claim 17, wherein the set of instructions is implemented through a security service of a cloud environment.

19. The system of claim 17, wherein the threshold amount comprises one of a selected amount of time or a frequency of use.

20. The system of claim 17, wherein the set of instructions is executable to de-provision the dormant account.

Images