Data Platform Role-Based Permission Reduction Through Usage Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack effective methods for monitoring and managing permissions and anomalies within complex compute environments, such as cloud environments, leading to potential security breaches and compliance issues.
Innovation Solution
A data platform with agents deployed on compute assets that monitor and report activities, generating polygraphs to detect anomalies and manage permissions, using data ingestion, processing, and user interface resources to provide real-time insights and remediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If agents are deployed on compute assets to monitor and report activities, then security monitoring capability is improved, but device complexity increases
Solution Approach 1:
The system segments monitoring functionality by deploying agents on individual compute assets. Each agent independently collects and reports activities from its host, distributing the monitoring burden across multiple simple nodes rather than requiring a single complex centralized system. This segmentation enables comprehensive security monitoring while keeping individual agent complexity low.
Solution Approach 2:
The data platform acts as an intermediary between compute assets and security analysis. Agents simply collect and report activities to the data platform, which then processes this information to generate polygraphs and identify anomalies. This intermediary approach simplifies agent functionality while maintaining sophisticated security analysis capabilities at the centralized platform level.
2Reliability
If polygraphs are generated to detect anomalies in real-time, then anomaly detection capability is improved, but processing time increases
Solution Approach 1:
The system performs preliminary data collection and polygraph generation in near-real-time as activities occur. By continuously maintaining polygraphs that represent current system states, the system prepares anomaly detection data in advance rather than waiting for post-event analysis. This preliminary action enables rapid anomaly identification while minimizing processing delays.
Solution Approach 2:
The data platform continuously processes activities and updates polygraphs in real-time rather than performing periodic batch processing. This continuous useful action ensures that anomaly detection is always based on current system state, reducing detection time while maintaining comprehensive monitoring coverage.
3Reliability
If comprehensive monitoring of compute assets is implemented, then security coverage is improved, but data volume increases
Solution Approach 1:
The system extracts only the essential activity information needed for security monitoring from compute assets. Agents collect and report only relevant activities rather than all possible data, reducing data volume while maintaining comprehensive security coverage. This extraction approach filters out unnecessary information while preserving critical security intelligence.
Solution Approach 2:
The polygraph structure serves multiple functions simultaneously: it represents system state, enables anomaly detection, supports compliance auditing, and facilitates incident response. By making the data structure multi-functional, the system reduces the need for separate data collections, thereby reducing overall data volume while maintaining comprehensive security coverage.
Data Source
AI summary
An illustrative method includes accessing data representative of a first role associated with a set of permissions with respect to resources within the compute environment and specifying a group of identities assigned to the first role, determining that a first subgroup of one or more identities included the group of identities only uses a first subset of permissions included in the set of permissions to access the resources within the compute environment without using a second subset of permissions, and performing, based on the determining that the first subgroup of one or more identities only uses the first subset of permissions, an operation to reduce permissions usable by the first subgroup of one or more identities.