International Business Machines Corporation

Harold B Moss, Iii

Mary Ellen Zurko

Mustansir Banatwala

Robert Leslie Yates

Simon N Foley

Corville O Allen

Eric Woods

Scott Robert Carrier

Steven A Bade

An enterprise risk management (ERM) system performs real-time self-diagnosis of functional code of the ERM system that controls the policy enforcement actions within the ERM system. Real-time execution effectiveness of at least one control instance of the ERM system at operationally mitigating real-time authentication services security risk(s) and user access compliance risk(s) is determined. At least one code modification to a control class definition is identified that adjusts one or more real-time operational control aspects of the at least one control instance and that improves real-time execution effectiveness and operational capabilities of a new control instance instantiated from an updated control class definition at operationally mitigating the respective real-time authentication services security risk(s) and user access compliance risk(s) within the ERM system.

Risk profiling for enterprise risk management

A risk profile element is created and associated with a control element within a risk hierarchy associated with an organization. A risk attribute is updated automatically within the risk profile element in response to an event associated with the control element. The updated risk attribute is processed to evaluate risk associated with the control element.

An information sharing paradigm for a cloud computing solution enables flexible organizational boundaries with respect to cloud resources. Cloud service customers manage their own organization boundary but can extend that boundary selectively by associating cloud resources they own with sets of domain names that may be associated with requests for cloud resources that the organization may be willing to share with other organizations that are using the cloud environment, and by ensuring that any such requests for resources that are shared in this manner are associated with one or more message handling policies that have been defined by (or otherwise associated with) the resource-owning organization. Cloud resources owned by an organization (even those marked as 'internal only') may be selectively shared with one or more other organizations using the cloud environment depending on the domain names associated with the requests. Message handling policies are enforced with respect to shared resources.

Extending organizational boundaries throughout a cloud architecture

Mechanisms are provided for relational context sensitive anonymization of data. A request for data is received that specifies a relational context corresponding to a selected group of selected persons selected from a global group of persons based on the relational context. The relational context specifies one or more attributes of selected persons in the selected group that establishes a relationship between the selected persons and distinguishes the selected persons from non-selected persons in the global group that are not in the selected group. For the relational context, based on a corpus of personal information data corresponding to the selected persons, key attributes in the personal information data are determined and a rarity value for each key attribute is determined. Selected key attributes are then anonymized based on the determined rarity value for each of the key attributes within the relational context of the selected group.

Anonymizing sensitive identifying information based on relational context across a group

A technique for addressing geographical location issues in a computing environment includes receiving, at a data processing system, location information indicating a permissible geographical location in which a virtual machine image for a consumer may be deployed. A request for an exception to deploy the virtual machine image outside of the permissible geographical location is issued, from the data processing system. An exception grant or an exception denial is received, at the data processing system, from the consumer in response to the request. The virtual machine image is deployed, using the data processing system, to one or more servers in the computing environment that are outside of the permissible geographical location in response to receipt of the exception grant. The virtual machine image is deployed, using the data processing system, to one or more servers in the computing environment that are within the permissible geographical location in response to receipt of the exception denial.

Growing community of inventors

Danvers, MA, United States of America

Harold B Moss, Iii