International Business Machines Corporation

David Walsh Palmieri

Jeffrey Tobias Robke

John Leslie Harter

David Gerard Kuehr-McLaren

Magesh Rajamani

Oriana Jeannette Love

Gee Ngoo Chia

Chrystian L Plachco

Luis B Casco-Arias Sanchez

Todd D Jordan

David B Emmes

Jeffrey David Aman

Brian Robert Matthiesen

An identity and access management IAM system is augmented to provide for supervised, iterative machine learning (ML), preferably with a user-generated training set for classification. The training set may include various types of data, including characteristics or attributes of the account types, the users, or the like. A goal of the initial ML training, which may include one or multiple passes, is to enable the machine to identify specific characteristics or attributes that provide a good classification result, with the resulting classifications then applied within the IAM system. In particular, the output of the ML system may be used by the IAM system for enforcing rights associated with the identified accounts, managing accounts, and so forth.

Using classification data as training set for auto-classification of admin rights

An identity and access management (IAM) system is associated with a set of data sources from which data is collected. A set of vulnerabilities that the IAM system should attempt to detect is identified. For each vulnerability to be detected, a prioritized list of strategies used to detect that vulnerability is generated. Preferably, each strategy specifies the type(s) of data required to detect that vulnerability. An algorithm to determine a best strategy to be used for detecting each vulnerability, preferably based on the data available from the data sources, is then identified. The IAM system then collects data in an optimized manner. In particular, during the collection process, the IAM system preferably collects only what is necessary based on the configuration, even if the data source is capable of providing additional data. The collected data is then processed to detect security vulnerabilities associated with the IAM accounts.

Dynamic optimizing scanner for identity and access management (IAM) compliance verification

A method for assessing security risks associated with a cloud application to which one or more connected applications are coupled begins by configuring a security risk assessment application to function as a connected application. The security risk assessment application collects 'first' data associated with one or more accounts, and 'second' data associated with the one or more connected applications coupled to the cloud application. After receiving the first and second data, the security risk assessment application instantiates that data into a generic &#x201c;data object&#x201d; that the system uses to represent each account and each of the connected applications. Each such data object thus is populated either with the first data or the second data, depending on whether the data object represents an account or a connected application. A risk assessment is then applied to the generic data object to assess a security risk associated with the cloud application.

Assessing security risks associated with connected application clients

Mechanisms are provided for performing a role engineering project for applying security roles to access operations targeting resources. A plurality of data objects representing one or more user identities, permissions, and resources of an organization computing system are received. One or more filter criteria for filtering the plurality of data objects to generate a subset of data objects for consideration during the role engineering project are received. The one or more filter criteria specify a scope of the role engineering project. The one or more filter criteria are applied to generate the subset of data objects. Role engineering project operations are performed on the subset of data objects to generate one or more security roles. The one or more security roles are deployed to the organization computing system to control access operations targeting resources of the organization computing system.

Role engineering scoping and management

A Web page of a Web application can be identified. The identified Web page can include an applet. A navigation action from the identified Web page to another Web page of the multi-page Web application can be detected. A state of the applet can be automatically saved before the applet terminates and the next Web page is navigated to. A navigation action to return to the identified Web page can be detected. This navigation can cause the previously saved applet state to be automatically retrieved and applied to the identified Web page so that the Web page is presented in a state that it was in when last navigated away from.

Integrating an applet into a multi-page or multi-tasking web application to enable applet state to be automatically saved and restored

A bidirectional frame processing system, method and apparatus. In accordance with the inventive arrangements, a preferred directional orientation can be determined for distributed content. Upon receiving a request for content from the content viewing client, the requested content can be distributed in a directional format consistent with the specified preference of the content viewing client. Specifically, where the preferred directional orientation differs from the native orientation of the requested content, the requested content can be transcoded to rearrange not only the textual portions of the requested content, but also positioning of frames within the content. In this way, one need not store separate versions of the same content to accommodate different preferred directional orientations.

Frame rearrangement to support bidirectional languages in a Web application

Apparatus and accompanying methods for use preferably in a multi-system shared data (sysplex) environment (,), wherein each system (,) provides one or more servers (,), for dynamically and adaptively assigning and balancing new work and for new session requests, among the servers in the sysplex, in view of attendant user-defined business importance of these requests and available sysplex resource capacity so as to meet overall business goals. Specifically, systems and servers are categorized into two classes: eligible, i.e., goal-oriented servers running under a policy and for which capacity information is currently available, and candidate, i.e., servers which lack capacity information. Work requests for a client application are assigned first to various eligible systems and eligible servers thereon based on their current capacity to accept new work and in a manner that meets business goals inherent in a sysplex policy; followed, if additional servers are requested by that application, to candidate systems and candidate servers thereon. As to session placement, first those system(s) are selected that have lowest utilization, at a target importance level, but with sufficient available capacity at that level. Competing servers on the selected system(s) are then evaluated based on their corresponding session count data to yield a single resulting server. Thereafter, identification of multiple servers and their corresponding weights are returned to, e.g., a client application, for eventual routing of work requests to those servers, or the identification of a single server is returned to that application for establishing a new session therewith.

Growing community of inventors

Cary, NC, United States of America

David Walsh Palmieri