Patent Application
20090328132
In general, embodiments of the invention relate to systems, methods, and computer program products for monitoring and/or controlling access to resources within an organization. More particularly, embodiments of the invention relate to automatically monitoring and/or controlling access to applications, datasets, and other entitlements in an organization by dynamically determining self-imposed entitlement equilibriums within each of a plurality of communities within the organization.
Within any organization, whether it be a large financial institution or other national or international business entity, a non-business entity, a governmental entity, or some other entity, it is important to monitor and control which members of the organization have access to which of the organization's information and resources as well as the types of access granted to each member. For example, in a banking institution certain people should have access to customer account information while others should not. Of these people with access to customer account information, some should have both read and write access while others should only have read access.
Other examples of access to resources within an organization that may need to be closely monitored include such things as access to customer and employee confidential information, access to different software applications and profiles, access to areas of a building or other physical or virtual structures, and the like. The different access rights granted to members of an organization are generally referred to herein as “entitlements.”
Traditional techniques for monitoring and controlling the distribution of entitlements generally involve persons within the organization periodically reviewing the entitlements assigned to each individual member of the organization. Such traditional techniques pose significant problems. Perhaps the most significant problem is the fact that it takes a significant amount of an organization's resources to individually monitor and manage the entitlements of each member of the organization.
Specifically, large organizations can have tens or even hundreds of thousands of employees and millions of potential entitlements that need to be managed. Furthermore, each member is typically assigned numerous entitlements and, as such, there may be many millions of different entitlement combinations existing within the organization at any one time. Managing so many combinations of entitlements can be a monumental, if not impossible task, using traditional entitlement management techniques. The distribution of entitlements within an organization, however, is so important for both operation and compliance reasons that it must be monitored and controlled.
Additional confusion results when members transition to new roles within the organization. These transitioning members often require new entitlements to be able to operate effectively in their new roles, but they also may need their old entitlements for some period of time after their transition. If not properly managed, a person that transitions within the organization several times may accumulate a long line of legacy entitlements from previous roles in the organization. Such legacy entitlements may not be useful to the person any longer and can, in fact, create security risks or compliance issues if not properly monitored. For example, certain internal or external rules and regulations may require that one person not have access to entitlement “A” and entitlement “B.” If a person who required access to entitlement A transitions within the organization several times and ends up in a role where he requires access to entitlement B but still has a access to entitlement A from his earlier role, the rules and regulations would be violated.
Confusion regarding the dissemination of entitlements may also arise any time a new system or technology is implemented since the entitlement administrators may not be aware of who needs access to the new system or technology and who can have the old system or technology entitlements removed. Other costs may also arise out of poor management of entitlements. For example, where the entitlements include access to software, improper monitoring and control of entitlements can result in greater licensing fees being paid to the software provider than is necessary. More specifically, the organization may pay a periodic fee to the software provider for each member of the organization that as access to the software. If members of the organization have access to the software but do not use or need the software any longer due to a change in job function or a change in systems, then the organization can save money in licensing fees if it can recognize the existence of such legacy access to the software.
A good entitlement management system should also be able to anticipate which entitlements a new employee or person transitioning into a new role will need to perform their job effectively. Traditional systems cannot anticipate needs effectively since the people managing the entitlements usually do not have intimate knowledge regarding the new employee's job function and which entitlements are needed for that job function. Even the new employee or the person transitioning into the new role will usually not know which entitlements they need because they may not know which entitlements are available. For all these reasons, organizations desire more efficient and accurate systems for managing the distribution of entitlements.
Generally, embodiments of the invention relate to systems, methods, and computer program products for monitoring and/or controlling access to entitlements. For example, in one embodiment a computer program product is configured to periodically examine the members of a particular community in an organization and automatically identify members in the community that have access to software applications, datasets, or other organizational resources that are uncommon in the community, which may indicate that the member should not have access to the such resources. The computer program product of embodiments of the invention is also configured to automatically and periodically determine the resources that members of the same community should all probably have access to. As such, embodiments of the present invention allow an organization to more efficiently monitor and control access to its resources and other entitlements.
More particularly, embodiments of the present invention provide a computer program product for monitoring or controlling access to or distribution of a plurality of entitlements. The computer program product comprises a computer readable medium having computer readable program instructions stored therein. Said computer readable program instructions comprise first instructions configured to determine a community of entitlement-eligible entities in an organization, wherein each of a plurality of entitlement-eligible entities has one or more entitlements assigned thereto. Said computer readable program instructions further comprise second instructions configured to determine, based on a review of the entitlements assigned to the entitlement-eligible entities in the community, if any of the entitlements assigned to the entitlement-eligible entities in the community are taboo within the community. In one embodiment, the entitlement-eligible entities within the same community have similar job functions.
In one embodiment, the computer program product further comprises third instructions configured to determine, based on a review of the entitlements assigned to the entitlement-eligible entities in the community, the entitlements that are normal to the community. In such an embodiment, the third instructions configured to determine the entitlements that are normal to the community may comprise instructions configured to determine normal entitlements based on a normal entitlement threshold where an entitlement is determined to be normal if the number of entitlement-eligible entities within the community that currently have said entitlement is greater than or equal to the normal entitlement threshold. The computer program product may further comprise instructions for receiving user input regarding the normal entitlement threshold.
In one embodiment, the second instructions that are configured to determine if any of the entitlements assigned to the entitlement-eligible entities in the community are taboo within the community comprise instructions configured to determine taboo entitlements based on a taboo entitlement threshold where an entitlement is determined to be taboo if the number of entitlement-eligible entities within the community that currently have said entitlement is less than the taboo entitlement threshold. In this regard, the computer program product may further comprise instructions for receiving user input regarding the taboo entitlement threshold.
In one embodiment, the computer program product further comprises instructions for identifying the entitlement-eligible entities within the community that have entitlements determined by the second instructions to be taboo in the community.
In one embodiment, the entitlements comprise access to particular software applications, access to particular datasets, write access to particular datasets, access to certain organizational resources, or access to particular locations within a physical or virtual environment. In one embodiment, the entitlement-eligible entities comprises persons in the organization.
Embodiments of the present invention further provide a computer program product for monitoring or controlling access to or distribution of a plurality of entitlements. The computer program product comprises a computer readable medium having computer readable program instructions stored therein. Said computer readable program instructions comprise first instructions configured to determine a community of entitlement-eligible entities in an organization, wherein each of a plurality of entitlement-eligible entities has one or more entitlements assigned thereto. Said computer readable program instructions further comprise second instructions configured to determine, based on a review of the entitlements assigned to the entitlement-eligible entities in the community, the entitlements that are normal to the community.
Embodiments of the present invention further provide a system for managing entitlements. The system includes a memory device having stored therein information regarding a plurality of entitlement-eligible entities and information regarding one or more entitlements currently associated with each entitlement-eligible entity. The memory device further comprises community information stored therein regarding a plurality of communities and regarding which entitlement-eligible entities are in which communities. The system further includes a processing device communicatively coupled to the memory device. The processing device is configured to select a community of entitlement-eligible entities based at least partially on the community information stored in the memory device. The processing device is further configured to determine, based on a review of the one or more entitlements currently associated with each entitlement-eligible entity within the selected community, one or more taboo entitlements whose number in the community is below a taboo entitlement threshold or one or more normal entitlements whose number in the community is above a normal entitlement threshold.
Embodiments of the present invention further provide a method for managing the distribution of entitlements within an organization. For example, in one embodiment the method includes the steps of: (1) providing information regarding a plurality of members in the organization and the entitlements that are currently associated with each member; (2) grouping members from the plurality of members into one or more communities based on one or more similar job functions; (3) selecting a community from the one or more communities; (4) analyzing the entitlements that are currently associated with the members of the selected community to determine, for each entitlement in the selected community, the number of members in the selected community that are currently associated with each entitlement; (5) determining whether the number of members in the selected community that are currently associated with each entitlement is below a certain threshold; (6) identifying the members in the selected community associated with entitlements below the threshold; and (7) determining whether the identified members should be associated with the entitlements below the threshold.
In one embodiment, the method also includes: determining whether the number of members in the selected community that are currently associated with each entitlement is above a certain threshold; identifying the members in the selected community not associated with entitlements above the threshold; and determining whether the identified members should be associated with the entitlements above the threshold.
In one embodiment, the method further includes: determining an infection rate that provides an indication of the extent that the selected community is infected with entitlements below the threshold; comparing the infection rate of the selected community with an infection rate of at least one other community; and directing further resources to examining the entitlements of a community with a higher relative infection rate before directing further resources to examining the entitlements of a community with a lower relative infection rate.
Having thus described embodiments of the invention in general terms, reference will now be made to the accompanying drawings, which are not necessarily drawn to scale, and wherein:
a-c illustrate graphical user interfaces providing exemplary user output showing the results of the entitlement analysis performed in accordance with an embodiment of the present invention.
Embodiments of the present invention now will be described more fully hereinafter with reference to the accompanying drawings, in which some, but not all, embodiments of the invention are shown. Indeed, the invention may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will satisfy applicable legal requirements. Like numbers refer to like elements throughout.
As will be appreciated by one of skill in the art, the present invention may be embodied as a method (including a business process), system, computer program product, or a combination of the foregoing. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.), or an embodiment combining software and hardware aspects that may generally be referred to herein as a “system.” Furthermore, the present invention may take the form of a computer program product on a computer-readable medium having computer-usable program code embodied in the medium.
Any suitable computer usable or computer readable medium may be utilized. The computer usable or computer readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples of the computer readable medium include, but are not limited to, the following: an electrical connection having one or more wires; a tangible storage medium such as a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a compact disc read-only memory (CD-ROM), or other optical or magnetic storage device; or transmission media such as those supporting the Internet or an intranet. Note that the computer usable or computer readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.
In the context of this document, a computer usable or computer readable medium may be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer usable medium may include a propagated data signal with the computer-usable program code embodied therewith, either in baseband or as part of a carrier wave. The computer usable program code may be transmitted using any appropriate medium, including but not limited to the Internet, wireline, optical fiber cable, radio frequency (RF) signals, or other mediums.
Computer program code for carrying out operations of embodiments of the present invention may be written in an object oriented, scripted or unscripted programming language such as Java, Perl, Smalltalk, C++, or the like. However, the computer program code for carrying out operations of embodiments of the present invention may also be written in conventional procedural programming languages, such as the “C” programming language or similar programming languages.
Embodiments of the present invention are described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products. It will be understood that each block of the flowchart illustrations and/or block diagrams, and/or combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instruction means which implement the function/act specified in the flowchart and/or block diagram block(s).
The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions/acts specified in the flowchart and/or block diagram block(s). Alternatively, computer program implemented steps or acts may be combined with operator or human implemented steps or acts in order to carry out an embodiment of the invention.
As described above, it is important for an organization to efficiently and accurately monitor and control access to information and resources held and/or maintained by the organization. As illustrated in
The identity management system 20 is involved with such measures as conducting background checks and/or verifying the identity of those that have or may receive access to the organization's resources. The system 30 is involved with monitoring who currently has access to which of the organization's resources and controlling the granting and withholding of access to the resources. The system 40 is directed to actually monitoring how those with access rights are actually using their access rights by, for example, asking such questions as: are they using the access, how are they using the access, what information or resources are they using and/or modifying, etc. Embodiments of the present invention are primarily directed to systems, methods, and computer program products for performing the role of the second sub-system, i.e., the system 30 for monitoring and controlling who has access to what information and resources.
In this regard, embodiments of the present invention are generally directed to systems, methods, and computer program products for monitoring and/or controlling the distribution of “entitlements,” where the term “entitlement” generally refers to a distributed resource or the right to access a certain resource in a particular way. For example, in some embodiments entitlements include the right to access one or more datasets. For example, in one embodiment a particular entitlement may grant the entitlement-holder access to customer information. Other entitlements may grant the entitlement-holder access to other information, such as, for example, access to employee information, access to various levels of confidential or secret information, access to information of various levels of importance, access to financial accounts, access to accounting records, access to pay scales, access to system information, etc. Furthermore, where an entitlement provides access to one or more datasets, the entitlement may grant only read access, only write access, or both read and write access.
In some embodiments, entitlements include access to one or more areas of a physical or virtual environment, such as access to a physical room or building or access to a virtual data room. In some embodiments, entitlements include computer software or access to computer software. For example, in one embodiment an entitlement may provide a person in the organization with access to particular software available on the organization's network. However, it should be appreciated that, in some embodiments, multiple different entitlements can provide access to the same software where, for example, one entitlement grants the entitlement holder greater or lesser capabilities when using the software than another entitlement. It should also be appreciated that, unless specifically stated in the claims, the term entitlement is not intended to be limited to the examples described herein and may comprise other resources or access rights to such resources.
As used herein, the term “organization” generally refers to any business or non-business entity or enterprise comprised of a plurality of discrete units that require access to information and/or resources held and/or maintained by the organization. These discrete units are generally referred to herein as “entitlement-eligible entities” or “members” of the organization. As used herein, the terms “entitlement-eligible entity” and “member” are generally interchangeable.
In one embodiment, the entitlement-eligible entities or members of an organization include persons, which are typically employees of the organization but may also be clients, customers, other organizations, and the like. In some embodiments, the entitlement-eligible entities include computing devices. For example, where entitlements provide software or access to software, then, in one embodiment, the entitlement-eligible entity may be a computer or workstation that will be provided with the software or access to the software instead of a particular person. However, in other embodiments where entitlements provide software or access to software, the software or access thereto may be distributed to specific persons in the organization (or such persons' unique computer profiles) rather than to specific computers or work stations.
Referring again to the figures,
As illustrated by block 210, the entitlement-eligible entities of the organization are then grouped into “communities” based on factors that suggest the members of the same community should have similar entitlement combinations. For example, in one embodiment the communities are determined based on hierarchy within the organization. In this regard, the community groupings may be based on such factors as job function, department or division, rank, level, authority, security clearance, and/or the like.
In some embodiments of the invention, communities are permitted to overlap. As such, in some embodiments a single entitlement-eligible entity may belong to a plurality of communities. For example,
In some embodiments where communities overlap, a user of the entitlement managing system 110 may be able to create additional communities that are combinations of two or more communities. For example, referring to
As illustrated in
As illustrated by blocks 220 and 230 of
As illustrated by block 300 in
As illustrated by block 305 in
As illustrated by block 310 in
In still other embodiments, the taboo entitlement threshold is automatically computed by the processing system 120 based on a statistical analysis of the distribution of entitlements within the community and/or other communities. For example, the taboo entitlement threshold may be computed as being the number of entitlement-eligible entities having an entitlement in common that is some “x” number of standard deviations below the mean number of entitlement-eligible entities having an entitlement in common for the community or the organization.
As illustrated by block 320 in
For example, referring again to the exemplary organization 250 illustrated in
Supposing that the user of the entitlement managing system 110 selected community 254 in
Returning to
As illustrated by block 405 in
As illustrated by block 410 in
In still other embodiments, the normal entitlement threshold is automatically computed by the processing system 120 based on a statistical analysis of the distribution of entitlements within the community and/or other communities. For example, the normal entitlement threshold may be computed as being the number of entitlement-eligible entities having an entitlement in common that is some “x” number of standard deviations above or below the mean number of entitlement-eligible entities having an entitlement in common for the community or the organization. In another embodiment, an entitlement may be considered “normal” if it is shared by a majority of the community members.
In some embodiments, the normal entitlement threshold and the taboo entitlement threshold are the same; however, in most embodiments the normal and taboo thresholds will be different with some entitlements falling in a third category of entitlements that are not uncommon enough to be considered taboo, but are also not common enough to be the “normal” cornerstone type entitlements in the community either.
As illustrated by block 420 in
For example, referring again to the exemplary organization 250 illustrated in
Returning again to
As illustrated by block 200b of
In some embodiments, the entitlement managing system 110 automatically notifies certain persons in the organization regarding the discovery of taboo entitlements. In other embodiments, however, the entitlement managing system 110 also handles the withholding or taking away of entitlements automatically. For example, in one embodiment the entitlement managing system 110 automatically withholds, withdraws, or suspends entitlements determined to be taboo. However, in some embodiments, where communities within the organization overlap, an entitlement-eligible entity that is a member of two or more communities may have an entitlement that was determined to be taboo in one community but normal, or at least acceptable, in the other community. In such a situation, the entitlement managing system 110 may be configured to recognize that the entitlement-eligible entity should have the taboo entitlement based on his membership in the second community. As such, the entitlement managing system 110 will not flag the entitlement as taboo, provided that, as described below, the possession of the taboo entitlement does not create compliance issues regarding any known rules or regulations.
For example, referring again to
As illustrated by block 700 of
The “Community Membership Requirement” parameter in the user interface is, in this example, equivalent to the taboo entitlement threshold described above. In some embodiments, this parameter can either be an integer or a percentage value. In this example, with a value of “2,” this parameter translates to mean that if less than two members of the community share a common entitlement the entitlement will be determined to be taboo for the community.
The “Friend” parameter in
a and 10b illustrate graphical user interfaces providing exemplary output showing the results of the entitlement analysis performed in accordance with an embodiment of the present invention. As illustrated in
b illustrates an example where the Hier Level is increased to “4.” As such, six communities are defined and the efficiency gain drops to 73.87%. This figure also illustrates how infection rates can be used to judge the portfolio of communities. The infection rates in
c illustrates a second component of the user output of the analysis which illustrates information at the micro level, in accordance with an embodiment of the invention.
Embodiments of the present invention can be implemented as a computer-aided method, as a system, as computer instruction codes, as an apparatus and/or combinations of any of the above. Some of the claims of the application have been drafted in means-plus-function format. While the means recited in these claims can be implemented by any number of systems, devices, computer program code, etc., provided below are examples of structural systems that may meet the functions outlined by the recited means.
For example, the processing means for selecting a group of members in the organization that have similar job functions and for determining whether any members of the group have access to information or resources that some predetermined amount of the members in the group do not have access to, etc., can be implemented as a processor or general computing element that uses software code instructions to perform these functions. The processor could, as an alternative, be an application specific IC chip that it hard-wired to perform the stated functions. The various means could also be met by a distributed network of processing elements that perform various portions of the recited functions.
While certain exemplary embodiments have been described and shown in the accompanying drawings, it is to be understood that such embodiments are merely illustrative of and not restrictive on the broad invention, and that this invention not be limited to the specific constructions and arrangements shown and described, since various other changes, combinations, omissions, modifications and substitutions, in addition to those set forth in the above paragraphs, are possible. Those skilled in the art will appreciate that various adaptations and modifications of the just described embodiments can be configured without departing from the scope and spirit of the invention. Therefore, it is to be understood that, within the scope of the appended claims, the invention may be practiced other than as specifically described herein.
