International Business Machines Corporation

Gee Ngoo Chia

Brian Robert Matthiesen

Jean Elizabeth Hidden

Stephen James Turcol

David Walsh Palmieri

Viswanath Srikanth

Christopher M Laffoon

John Leslie Harter

Jeffrey Tobias Robke

An identity management system is augmented to provide for automated suspension of all dormant accounts before launching a re-certification campaign (pass). In one implementation, prior to receiving a recertification notice from the system, the affected user's account is already suspended and thus cannot be accessed. Once the recertification succeeds, however, the account is restored. Preferably, the technique is exposed to an IAM system administrator through a simple interface, e.g., a one-click 'suspend and re-certify' button in an administrative menu. When the administrator initiates the re-certification process, he or she may select the button for a particular account or user.

Reducing risks associated with recertification of dormant accounts

An identity and access management IAM system is augmented to provide for supervised, iterative machine learning (ML), preferably with a user-generated training set for classification. The training set may include various types of data, including characteristics or attributes of the account types, the users, or the like. A goal of the initial ML training, which may include one or multiple passes, is to enable the machine to identify specific characteristics or attributes that provide a good classification result, with the resulting classifications then applied within the IAM system. In particular, the output of the ML system may be used by the IAM system for enforcing rights associated with the identified accounts, managing accounts, and so forth.

Using classification data as training set for auto-classification of admin rights

An identity management system is augmented to provide a methodology to generate an objective measure of administrative effectiveness with respect to account certification. In the approach, erroneous account information is intentionally inserted into a recertification campaign. The erroneous account information is tracked through the recertification process and used as a measurement to evaluate whether a particular manager/administrator whose accounts are impacted is successful in recognizing the erroneous account information (e.g., as a percentage of erroneous account records located). The dummy information is tracked and used to generate a quantitative measure of the effectiveness of a particular recertification campaign or a particular manager who is responsible for recertifying accounts. The results can also be used to drive other enterprise metrics and compliance systems.

Quantitatively measuring recertification campaign effectiveness

A method for assessing security risks associated with a cloud application to which one or more connected applications are coupled begins by configuring a security risk assessment application to function as a connected application. The security risk assessment application collects 'first' data associated with one or more accounts, and 'second' data associated with the one or more connected applications coupled to the cloud application. After receiving the first and second data, the security risk assessment application instantiates that data into a generic &#x201c;data object&#x201d; that the system uses to represent each account and each of the connected applications. Each such data object thus is populated either with the first data or the second data, depending on whether the data object represents an account or a connected application. A risk assessment is then applied to the generic data object to assess a security risk associated with the cloud application.

Assessing security risks associated with connected application clients

A method, system or computer usable program product for porting driver preferences between vehicles including initiating a first communication session between a computer in the first vehicle and an external device, receiving a driver profile from the first vehicle in the external device, wherein the driver profile was used to configure warnings and other driver settings in the first vehicle, initiating a second communication session between the external device and a computer in a second vehicle, transferring the driver profile from the external device to a second memory in the second vehicle, and using the driver profile to configure warning and other driver settings in the second vehicle.

Growing community of inventors

Morrisville, NC, United States of America

Gee Ngoo Chia