Multi-Cloud Access Control Recommendations from Historical Usage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Entities often face over-privileging issues due to improper access control management, leading to increased security vulnerabilities in multi-cloud environments, where identities are granted permissions beyond their necessary tasks, complicating the balance between access and security.
Innovation Solution
A multi-state approach for determining reduced privilege access control assignments based on historical activity, recommending whether to assign access control assignments on a permanent or on-demand basis, minimizing over-privileging costs while ensuring identities can perform required tasks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access control assignments are granted to cover all possible tasks and resources, then identities can perform any required task without access denial, but over-privileging increases security vulnerability and risk of unauthorized access
Solution Approach 1:
The system dynamically adjusts access control assignments from static broad permissions to dynamic task-specific permissions. Access control assignments are transformed from covering all possible tasks to only those tasks actually performed by the identity, based on historical activity analysis. This dynamic adaptation resolves the contradiction by providing sufficient access for actual tasks while eliminating excessive permissions that create security vulnerabilities.
Solution Approach 2:
The system changes the parameter of access scope from maximum possible permissions to minimum necessary permissions. By analyzing historical activity data, the system determines the actual task and resource pairs an identity interacts with, then configures access control assignments to match this actual usage pattern. This parameter change reduces over-privileging while maintaining operational effectiveness.
2Object-affected harmful factors
If access control assignments are restricted to minimum necessary permissions, then security risk is reduced, but identities may be denied access when performing required tasks
Solution Approach 1:
The system performs preliminary analysis of historical activity data to identify all task and resource pairs an identity actually performs. This advance knowledge allows the system to configure access control assignments that precisely cover necessary tasks before any access denial can occur. By preparing the correct permission set in advance based on historical patterns, the system ensures both security and task completion efficiency.
Solution Approach 2:
The system uses historical activity data as feedback to continuously optimize access control assignments. By monitoring what tasks identities actually perform and adjusting permissions accordingly, the system ensures that access assignments match actual needs. This feedback mechanism prevents both over-privileging and under-privileging, maintaining security while ensuring task completion capability.
3Device complexity
If broad access control assignments are used across multiple cloud platforms, then management complexity is reduced, but the cost of over-privileging increases due to excessive permissions granted
Solution Approach 1:
The system segments access control management by analyzing individual identity activity patterns across multiple cloud platforms. Instead of applying uniform broad permissions to all identities, the system divides access assignments into identity-specific configurations based on actual task requirements. This segmentation reduces management complexity while eliminating the cumulative over-privileging cost that would result from applying broad permissions universally across all identities and platforms.
Solution Approach 2:
The system changes the parameter of access scope from platform-wide broad permissions to identity-specific minimum necessary permissions. By analyzing historical activity for each identity across multiple cloud platforms, the system configures permissions that match actual usage patterns. This parameter change reduces both management complexity and over-privileging cost by eliminating excessive permissions while maintaining cross-platform operational capability.
Data Source
AI summary
Systems, methods, apparatuses, and computer program products are disclosed for determining a set of recommended access control assignments in single-cloud or multi-cloud environments based on historical usage. Paired activity data, representing task and resource pairs associated with an identity, is determined from historical activity data. Over-privileging costs are determined for a set of candidate access control assignments based on the permitted tasks and resource scopes granted by the candidate access control assignments and the paired activity data. A set of recommended access control assignments is determined as a subset of the candidate access control assignments with a lowest aggregate over-privileging cost whose combined permissions and resource scopes cover at least a predetermined percentage of the paired activity data. A recommendation including on-demand and/or standing privilege access control assignments is generated based on the set of recommended access control assignments. A responsive action may be performed based on the recommendation.