Patent Publication Number: US-10318751-B2

Title: Automatic removal of global user security groups

Description:
REFERENCE TO RELATED APPLICATIONS AND PATENTS 
     Reference is made to U.S. Provisional Patent Application Ser. No. 61/348,806, filed May 27, 2010 and entitled “AUTOMATING ENFORCEMENT OF IT WORKFLOWS”, the disclosure of which is hereby incorporated by reference and priority of which is hereby claimed pursuant to 37 CFR 1.78(a) (4) and (5)(i). 
     Reference is also made to the following patents and patent applications, owned by assignee, the disclosures of which are hereby incorporated by reference: 
     U.S. Pat. Nos. 7,555,482 and 7,606,801; and 
     U.S. Published Patent Application Nos. 2007/0244899, 2008/0271157, 2009/0100058, 2009/0119298 and 2009/0265780. 
    
    
     FIELD OF THE INVENTION 
     The present invention relates to data management systems and methodologies generally and more particularly to data access permission management systems and methodologies. 
     BACKGROUND OF THE INVENTION 
     The following patent publications are believed to represent the current state of the art: 
     U.S. Pat. Nos. 5,465,387; 5,899,991; 6,338,082; 6,393,468; 6,928,439; 7,031,984; 7,068,592; 7,403,925; 7,421,740; 7,555,482 and 7,606,801; and 
     U.S. Published Patent Application Nos. 2003/0051026; 2004/0249847; 2005/0108206; 2005/0203881; 2005/0120054; 2005/0086529; 2006/0064313; 2006/0184530; 2006/0184459 and 2007/0203872. 
     SUMMARY OF THE INVENTION 
     The present invention seeks to provide improved data access permission management systems and methodologies. There is thus provided in accordance with a preferred embodiment of the present invention an enterprise system for automatically replacing a user security group-based computer security policy by a computer security policy based at least partially on actual access, the system including a learned access permissions subsystem operative to learn the current access permissions of users in the enterprise to network objects in an enterprise computer environment and to provide an indication of which users are members of which user security groups having access permissions to which network objects, a learned actual access subsystem operative to learn the actual access history of the users in the enterprise to the network objects and to provide an indication of which users have had actual access to which network objects, and a computer security policy administration subsystem, receiving the indications from the learned access permission subsystem and the learned actual access subsystem and being operative to automatically replace pre-selected user-security group-based access permissions with at least partially actual access based access permissions without disrupting user access to the network objects. 
     In accordance with a preferred embodiment of the present invention, the computer security policy administration subsystem includes replacement initiation functionality which automatically initiates automatic replacement of pre-selected user-security group-based access permissions with at least partially actual access based accessed permissions based on a schedule predetermined by a human administrator. 
     Preferably, the system also includes a pre-replacement notification and authorization subsystem automatically operative prior to execution of the replacement to notify predetermined stakeholders in predetermined ones of the network objects of changes in access permissions expected to take place as the result of the replacement, to request their authorization and in the absence of the authorization to prevent execution of the replacement in respect of at least some of the network objects and at least some of the users for which authorization was not received. Preferably, the user security group is MICROSOFT® EVERYONE GROUP. 
     Additionally, the computer security policy administration subsystem is operative to automatically replace pre-selected user-security group-based access permissions with access permissions partially based on actual access and partially based on pre-existing access permissions which are not the pre-selected user-security group-based access permissions. Alternatively, the computer security policy administration subsystem is operative to automatically replace pre-selected user-security group-based access permissions with access permissions at least partially based on actual access and at least partially based on similarity of actual access profiles of users to users having had actual access. Alternatively, the computer security policy administration subsystem is operative to automatically replace pre-selected user-security group-based access permissions with access permissions based on pre-existing access permissions which are not the pre-selected user-security group-based access permissions. 
     Preferably, the computer security policy administration subsystem includes simulation initiation functionality which automatically initiates simulation of replacement of pre-selected user-security group-based access permissions with at least partially actual access based accessed permissions based on a schedule predetermined by a human administrator. 
     There is also provided in accordance with another preferred embodiment of the present invention an enterprise system for simulating replacement of a user security group-based computer security policy by a computer security policy, the system including a learned access permission subsystem operative to learn the current access permissions of users in the enterprise to network objects in an enterprise computer environment and to provide an indication of which users are members of which user security groups having access permissions to which network objects, a learned actual access subsystem operative to learn the actual access history of the users in the enterprise to the network objects and to provide an indication of which users have had actual access to which network objects, and a computer security policy simulation subsystem, receiving the indications from the learned access permission subsystem and the learned actual access subsystems and being operative to automatically simulate replacement of pre-selected user-security group-based access permissions with at least partially actual access based accessed permissions without disrupting user access to the network objects. 
     In accordance with a preferred embodiment of the present invention, the system also includes a pre-replacement notification and authorization subsystem automatically operative to notify predetermined stakeholders in predetermined ones of the network objects of changes in access permissions expected to take place as the result of the replacement, to request their authorization. Preferably, the user security group is the MICROSOFT® EVERYONE GROUP. 
     There is further provided in accordance with yet another preferred embodiment of the present invention a method for automatically replacing a user security group-based computer security policy by a computer security policy based at least partially on actual access, the method including learning the current access permissions of users in the enterprise to network objects in an enterprise computer environment and to provide an indication of which users are members of which user security groups having access permissions to which network objects, learning the actual access history of the users in the enterprise to the network objects and to provide an indication of which users have had actual access to which network objects, and receiving the indications and automatically replacing pre-selected user-security group-based access permissions with at least partially actual access based access permissions without disrupting user access to the network objects. 
     In accordance with a preferred embodiment of the present invention, the method includes automatically initiating automatic replacement of pre-selected user-security group-based access permissions with at least partially actual access based accessed permissions based on a schedule predetermined by a human administrator. 
     Preferably, the method also includes prior to execution of the replacement to notify predetermined stakeholders in predetermined ones of the network objects of changes in access permissions expected to take place as the result of the replacement, to request their authorization and in the absence of the authorization to prevent execution of the replacement in respect of at least some of the network objects and at least some of the users for which authorization was not received. Preferably, the user security group is MICROSOFT® EVERYONE GROUP. 
     Additionally, the method includes automatically replacing pre-selected user-security group-based access permissions with access permissions partially based on actual access and partially based on pre-existing access permissions which are not the pre-selected user-security group-based access permissions. Alternatively, the method includes automatically replacing pre-selected user-security group-based access permissions with access permissions at least partially based on actual access and at least partially based on similarity of actual access profiles of users to users having had actual access. Alternatively, the method includes automatically replacing pre-selected user-security group-based access permissions with access permissions based on pre-existing access permissions which are not the pre-selected user-security group-based access permissions. 
     Preferably, the method includes automatically initiating simulation of replacement of pre-selected user-security group-based access permissions with at least partially actual access based accessed permissions based on a schedule predetermined by a human administrator. 
     There is yet further provided in accordance with still another preferred embodiment of the present invention a method for simulating replacement of a user security group-based computer security policy by a computer security policy, the method including learning the current access permissions of users in the enterprise to network objects in an enterprise computer environment and to provide an indication of which users are members of which user security groups having access permissions to which network objects, learning the actual access history of the users in the enterprise to the network objects and to provide an indication of which users have had actual access to which network objects, and receiving the indications and automatically simulating replacement of pre-selected user-security group-based access permissions with at least partially actual access based accessed permissions without disrupting user access to the network objects. 
     In accordance with a preferred embodiment of the present invention, the method also includes notifying predetermined stakeholders in predetermined ones of the network objects of changes in access permissions expected to take place as the result of the replacement, to request their authorization. Preferably, the user security group is the MICROSOFT® EVERYONE GROUP. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The present invention will be understood and appreciated more fully from the following detailed description, taken in conjunction with the drawings in which: 
         FIGS. 1A, 1B, 1C, 1D, and 1E  are simplified pictorial illustrations of operation of an enterprise system for automatically replacing a user security group-based computer security policy by a computer security policy based at least partially on actual access, constructed and operative in accordance with a preferred embodiment of the present invention; and 
         FIG. 2  is a simplified flowchart indicating steps in the operation of the system of  FIG. 1 . 
     
    
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
     Reference is now made to  FIGS. 1A, 1B, 1C, 1D and 1E , which are simplified pictorial illustrations of operation of an enterprise system for automatically replacing a user security group-based computer security policy by a computer security policy based at least partially on actual access, constructed and operative in accordance with a preferred embodiment of the present invention. 
     As seen generally in  FIGS. 1A-1E , the network object access permission management system is useful with a computer network  100  including at least one server  102  and a multiplicity of clients  104 . One or more storage devices  106  are also preferably provided. The system preferably resides on at least one server  102  and preferably includes: 
     a learned access permissions subsystem  110  operative to learn the current access permissions of users in the enterprise to network objects residing in the enterprise computer environment and to provide an indication of which users are members of which user security groups having access permissions to which network objects; 
     a learned actual access subsystem  112  operative to learn the actual access history of the users in the enterprise to the network objects and to provide an indication of which users have had actual access to which network objects; and 
     a computer security policy administration subsystem  114 , receiving the indications from the learned access permission subsystem  110  and the learned actual access subsystem  112  and being operative to automatically replace pre-selected user-security group-based access permissions with at least partially actual access based access permissions without disrupting user access to the network objects. 
     The term “network object” for the purposes of this application is defined to include user generated enterprise computer network resources on any commercially available computer operating system. Examples of network objects include structured and unstructured computer data resources such as files and folders, and user groups. 
     Turning now to  FIG. 1A , it is seen that an IT manager realizes, to his dismay, that some or all of the network objects in his network can be accessed by all or nearly all of the users in the enterprise, all of whom are members of the MICROSOFT® Everyone Group. It is appreciated that the MICROSOFT® Everyone Group does not contain an explicit or searchable list of all of the members thereof. 
     As shown in  FIG. 1B , the IT manager installs the network object access permission management system of the present invention which, in addition to the elements described hereinabove, also preferably includes an access permissions database  116  and an actual access database  118 . It is appreciated that subsystems  110  and  112  as well as databases  116  and  118  are commercially available as part of the DATADVANTAGE product of Varonis Inc. of New York, N.Y. 
       FIG. 1C  shows automatic population of databases  116  and  118  through operation of subsystems  110  and  112  during a learning period, typically extending over a few weeks. This process is described in Applicant/Assignees U.S. Pat. No. 7,606,801.  FIG. 1C  also shows automatic operation of the computer security policy administration subsystem  114 , receiving the indications from the learned access permission subsystem  110  and the learned actual access subsystem  112  and automatically generating recommendations for replacing pre-selected user-security group-based access permissions with at least partially actual access based access permissions, subject to operator confirmation. 
     As seen in  FIG. 1D , the IT manager, alone or possible in consultation with an HR manager or other executive decides whether or not to approve the automatically generated recommendations. If the automatically generated recommendations are approved, they are implemented automatically without disrupting needed user access to the network objects residing in the enterprise computer environment. 
     Alternatively, as seen in  FIG. 1E , subsystem  114  can instead automatically replace pre-selected user-security group-based access permissions with at least partially actual access-based access permissions, also without disrupting needed user access to the network objects residing in the enterprise computer environment. 
     Reference is now made to  FIG. 2 , which is a simplified flowchart indicating steps in the operation of the system of  FIG. 1 . As shown in  FIG. 2 , the learned access permissions subsystem continuously automatically populates the access permissions database with the current access permissions of users in the enterprise to network objects residing in the enterprise computer environment. In parallel, the learned actual access subsystem continuously automatically populates the actual access database with the actual access history of the users in the enterprise to the network objects. 
     As shown in  FIG. 2 , the security policy administration subsystem automatically generates access permissions recommendations based on information provided by the access permissions subsystem and from the actual access subsystem. The IT manager reviews the recommendations and decides whether to approve them for automatic implementation by the security policy administration subsystem. Alternatively, the security policy administration subsystem may automatically implement the recommendations. 
     It will be appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the present invention includes both combinations and subcombinations of the various features described hereinabove as well as modifications thereof which would occur to persons skilled in the art upon reading the foregoing description and which are not in the prior art.