Patent AU-2019200530-A1 (AU)
Title: Identifying network security risks
Inventor: DIVALENTIN LOUIS WILLIAM
IPC: G06F21/50
Filed: 2019-01-25
Abstract: A computer-implemented method for identifying computer network security risks, the method including retrieving, using a data extraction processor, organization data that represents a plurality of individuals in an organizational hierarchy of an organization, wherein the organization data includes data that indicates, for each individual of the plurality of individuals, one or more groups to which the individual belongs, for at least one of the groups, determining a group score that represents a criticality of the group within the organization, retrieving, using the data extraction processor, access privilege data that indicates, for each individual of the plurality of individuals, one or more access privileges that have been assigned to the individual for computer network resources, for at least one of the access privileges, determining an access privilege score that represents an access privilege risk associated with potential misuse of the access privilege, generating a data structure using a matrix processor, wherein the data structure is an adjacency matrix that represents connections between the plurality of individuals and the one or more groups, and that represents connections between the plurality of individuals and the one or more access privileges, wherein a connection between an individual and the at least one of the groups is associated with the determined group score, and a connection between the individual and the at least one of the access privileges is associated with the determined access privilege score, storing the adjacency matrix in a computer-readable medium, modifying, using the matrix processor, the stored adjacency matrix by replacing values that indicate connections between the plurality of individuals and the one or more access privileges with one or more determined access privilege scores, reducing data storage demands by collapsing the modified adjacency matrix stored in the computer-readable medium, wherein the modified adjacency matrix is collapsed, using the matrix processor, by linking individuals, from the plurality of individuals, in the modified adjacency matrix using the one or more determined access privilege scores, selecting, using an analytic processor, an analytic technique for analyzing the collapsed adjacency matrix, based on applying the selected analytic technique, for each individual of the plurality of individuals, using the analytic processor to determine an individual score that represents a security risk associated with a network account of the individual, using a security control processor to determine, for a particular individual, that the individual score meets a predetermined threshold, and in response to the determining that the individual score meets a predetermined threshold, using the security control processor to automatically apply one or more security controls to the computer network account of the particular individual, wherein applying the one or more security controls includes triggering an endpoint device to log activity associated with the computer network account of the particular individual. 12587-0594001 (n2 co> *0- o C/C~o) 0 C/ C/)- U) oo co Nt z cu 0 -/ o x C/ Cl) U)