International Business Machines Corporation

Jeffrey Tobias Robke

David Walsh Palmieri

Ana Claudia Biazetti

John Leslie Harter

David Gerard Kuehr-McLaren

Magesh Rajamani

Oriana Jeannette Love

Luis B Casco-Arias Sanchez

Todd D Jordan

Chrystian L Plachco

Brian Robert Matthiesen

Gee Ngoo Chia

Latha Sivakumar

Virginia D Hill

Radhika Ramakrishnan

Mary E Sturgeon

An identity and access management (IAM) system is associated with a set of data sources from which data is collected. A set of vulnerabilities that the IAM system should attempt to detect is identified. For each vulnerability to be detected, a prioritized list of strategies used to detect that vulnerability is generated. Preferably, each strategy specifies the type(s) of data required to detect that vulnerability. An algorithm to determine a best strategy to be used for detecting each vulnerability, preferably based on the data available from the data sources, is then identified. The IAM system then collects data in an optimized manner. In particular, during the collection process, the IAM system preferably collects only what is necessary based on the configuration, even if the data source is capable of providing additional data. The collected data is then processed to detect security vulnerabilities associated with the IAM accounts.

Dynamic optimizing scanner for identity and access management (IAM) compliance verification

A method for assessing security risks associated with a cloud application to which one or more connected applications are coupled begins by configuring a security risk assessment application to function as a connected application. The security risk assessment application collects 'first' data associated with one or more accounts, and 'second' data associated with the one or more connected applications coupled to the cloud application. After receiving the first and second data, the security risk assessment application instantiates that data into a generic &#x201c;data object&#x201d; that the system uses to represent each account and each of the connected applications. Each such data object thus is populated either with the first data or the second data, depending on whether the data object represents an account or a connected application. A risk assessment is then applied to the generic data object to assess a security risk associated with the cloud application.

Assessing security risks associated with connected application clients

An identity management system is augmented to enable a manager to associate 'risk' metadata with different types of access requests representing computer system accounts that can be requested by authorized users. When an authorized user then requests access to a particular account, any 'risk' associated with that access is shown to the user, typically in the form of a visual &#x201c;badge&#x201d; or other such indicator. The badge includes an appropriate informational display (e.g., &#x201c;High Risk&#x201d; or &#x201c;Regulated&#x201d;) that provides an appropriate risk warning. The risk metadata badge information preferably also is displayed for risk-based access request approval routing; in such context, the risk metadata may also determine the risk approval workflow itself. Thus, for example, if the risk metadata is present when the authorized user requests access, an approval workflow may be modified so that the request approval is routed appropriately.

Visual display of risk-identifying metadata for identity management access requests

A message occurrence can be detected when a software application runs on a computing device. The message occurrence can be an occurrence where a text containing message is presented upon a user interface of the software application or a log associated with the software application is updated with a text containing message. A user context for the message occurrence can be determined. The user context can include a user sequence and an execution path. Message occurrence information can be conveyed to a message context catalog. Within the message context catalog, the message occurrence information can be indexed against unique message identifiers. Message occurrence information from the message context catalog can be presented in a computer's user interface when a message uniquely identified by the message identifier is presented in the user interface. The user interface can permit a user to edit text of messages.

Software development tool for providing user context information to improve message quality at development time

Mechanisms are provided for performing a role engineering project for applying security roles to access operations targeting resources. A plurality of data objects representing one or more user identities, permissions, and resources of an organization computing system are received. One or more filter criteria for filtering the plurality of data objects to generate a subset of data objects for consideration during the role engineering project are received. The one or more filter criteria specify a scope of the role engineering project. The one or more filter criteria are applied to generate the subset of data objects. Role engineering project operations are performed on the subset of data objects to generate one or more security roles. The one or more security roles are deployed to the organization computing system to control access operations targeting resources of the organization computing system.

Role engineering scoping and management

Mechanisms are provided for generating user account policies for generating user accounts to access resources of the data processing system. A determination is made that a user account policy for an identified resource in the data processing system is to be generated. Configuration information associated with the identified resource is retrieved from a configuration information database. A predefined user account policy template is retrieved from a user account policy template database system. A user account policy data structure is generated based on the retrieved configuration information and the retrieved predefined user account policy template.

Growing community of inventors

Apex, NC, United States of America

Jeffrey Tobias Robke