Methods and systems for accurately assessing application access risk

Patent metadata

Field	Value
Publication number	US-11777978-B2
Application number	US-202117162769-A
Country	US
Kind code	B2
Filing date	Jan 29, 2021
Priority date	Jan 29, 2021
Publication date	Oct 3, 2023
Grant date	Oct 3, 2023

Abstract

Systems and methods for assessing an application access risk are provided. An example method commences with collecting data concerning relationships between an application, one or more client devices, and one or more users in a computing environment. The method includes updating a graph database including nodes and edges. The nodes represent the application, the one or more client devices, and the one or more users and the edges represent relationships between the application, the one or more client devices, and the one or more users. The method continues with enriching the graph database by associating the nodes with metadata including information concerning the one or more users accessing the application from the one or more client devices. The method further includes analyzing the graph database to identify a subset of nodes used to access the application and displaying a graphical representation of the subset of nodes.

First claim

What is claimed is:

1. A system for assessing an application access risk, the system comprising:
at least one processor; and
a memory communicatively coupled to the at least one processor, the memory storing instructions executable by the at least one processor to perform a method comprising:
collecting data concerning relationships between an application and one or more client devices in a computing environment;
collecting data concerning relationships between the application and one or more users logged into the one or more client devices in the computing environment;
enriching data related to the one or more client devices with the one or more users logged into the one or more client devices;
updating a graph database including nodes representing the application, the one or more client devices, and the one or more users and edges representing the relationships between the application and the one or more client devices and the relationships between the application and the one or more users;
enriching the graph database by associating the nodes with metadata including information concerning the one or more users accessing the application from the one or more client devices, attributes associated with the one or more users, and permissions associated with the one or more users;
analyzing the graph database to identify a subset of nodes used to access the application;
displaying, via a graphical user interface, a graphical representation of the subset of nodes;
generating allow-list rules identifying at least one user of the one or more users and at least one client device of the one or more client devices permitted to access the application; and

generating an allow-list set of role-based access control permissions to enforce the access.

2. The system of claim 1 , wherein the at least one processor is further configured to:
determine that the subset of nodes includes at least one node representing at least one of a client device, a user, and a group of users not allowed to have access to the application; and
in response to the determination, providing a warning message to a least one authorized person.

3. The system of claim 1 , wherein the at least one processor is further configured to:
determine that the subset of nodes includes one of:
at least one node representing a client device of a user not allowed to have access to the application; and
at least one node representing a user not allowed to have access to the application; and

in response to the determination, generate a security policy disallowing a relationship between the application and the at least one node, wherein the at least one node is associated with one of the client device, the user, or a group of users defined within the metadata by organizational units, roles, and groups.

4. The system of claim 1 , wherein the metadata includes information on roles of the one or more users and an association of the one or more users with one or more organizational units of an enterprise, types and timestamps of transactions performed by the one or more users using the application.

5. The system of claim 4 , wherein the at least one processor is further configured to:
analyze the graph database to identify a further subset of nodes allowed to have access to the application and not used to access the application;
identify, based on the metadata, organizational units corresponding to the nodes of the further subset; and
provide, to at least one authorized person, a report concerning one or more of the organizational units, groups, and the roles corresponding to the nodes of the further subset.

6. The system of claim 5 , wherein the at least one processor is further configured to:
generate a security policy disallowing a relationship between the application and at least one node of the further subset associated with a user of the one or more users.

7. The system of claim 4 , wherein the at least one processor is further configured to:
identify, based on the metadata, organizational units corresponding to the nodes of the subset of nodes used to access the application; and
provide a report concerning the organizational units to at least one authorized person.

8. The system of claim 4 , wherein the at least one processor is further configured to:
determine, based on the metadata, a number and types of transactions performed by users of at least one of the organizational units; and
provide a report concerning the number and the types of transactions to at least one authorized person.

9. The system of claim 1 , wherein the metadata includes network logs and access logs of the one or more users into the application.

10. The system of claim 1 , wherein the metadata includes data concerning a type of operation and an amount of data written to or read from the application.

11. The system of claim 1 , further comprising an allow-list architecture.

12. A method for assessing an application access risk, the method comprising:
collecting data concerning relationships between an application and one or more client devices in a computing environment;
collecting data concerning relationships between the application and one or more users logged into the one or more client devices in the computing environment;
enriching data related to the one or more client devices with the one or more users logged into the one or more client devices;
updating a graph database including nodes representing the application, the one or more client devices, and the one or more users and edges representing the relationships between the application and the one or more client devices and the relationships between the application and the one or more users;
enriching the graph database by associating the nodes with metadata including information concerning the one or more users accessing the application from the one or more client devices, attributes associated with the one or more users, and permissions associated with the one or more users;
analyzing the graph database to identify a subset of nodes used to access the application;
displaying, via a graphical user interface, a graphical representation of the subset of nodes;
generating allow-list rules identifying at least one user of the one or more users and at least one client device of the one or more client devices permitted to access the application; and
generating an allow-list set of role-based access control permissions to enforce the access.

13. The method of claim 12 , further comprising:
determining that the subset of nodes includes at least one node representing at least one of a client device, a user, and a group of users not allowed to have access to the application; and
in response to the determination, providing a warning message to a least one authorized person.

14. The method of claim 12 , further comprising:
determining that the subset of nodes includes one of:
at least one node representing a client device of a user not allowed to have access to the application; and
at least one node representing a user not allowed to have access to the application; and

in response to the determination, generating a security policy disallowing a relationship between the application and the at least one node, wherein the at least one node is associated with one of the client device, the user, or a group of users defined within the metadata by organizational units, roles, and groups.

15. The method of claim 12 , further comprising:
analyzing the graph database to identify a further subset of nodes allowed to have access to the application and not used to access the application;
identifying, bas

Assignees

• Varmour Networks Inc

Inventors

• Bigbee Paul
• Woolward Marc
• Wang Hsisheng
• Stewart Keith
• Parry Jason

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F16/23

  Updating · CPC title

• G06F16/9024 Primary

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/104

  Grouping of entities · CPC title