Microsoft Technology Licensing, LLC

Parag Bajaria

Venkata Adusumilli

Maya Neelakandhan

Naveen Teja Jangalapalli

Carl Alan Waldspurger

Balaji Parimi

Nicholas James Barretta

Guruprasad Ramprakash

Shaun Applegate-Swanson

Shaun Robert Applegate-swanson

Naga Venkata Naveen Teja Jangalapalli

Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to automatically detect inadvertent, unauthorized account access. For example, a user account may be analyzed to identify roles thereof that permit identities of other accounts to assume the roles of the user account. The analysis is performed for each identified account, including any accounts having roles that permit identities of further accounts to assume the roles of the identified accounts. Accordingly, a chain of roles may be determined that indicates how one account may have access to another account via one or more intervening role assignments. This circuitous path of account access may be represented and displayed to a user, e.g., via a tree structure. Upon identifying an unauthorized account, an appropriate action may be performed to adjust permissions.

Methods and systems for detecting inadvertent unauthorized account access

Methods, systems, apparatuses, and computer-readable storage mediums are described for assigning a security risk score to a resource. In one example, resource access data is collected for a resource. Based at least on the resource access data, a data risk index (DRI) score is generated for the resource. The DRI score comprises a value that is indicative of a level of risk that the resource will be compromised. At least one of the DRI score, an alert based at least on the DRI score, or a policy change for the resource based at least on the generated DRI score is reported to an administrator.

Determining data risk and managing permissions in computing environments

Access privileges of at least one identity to resources are adjusted within an authorization system of a computing environment. Over a detection period, accesses by the identity to the resources are detected and a usage score is computed as a usage function of a measure of use by the identity of access privilege(s) it has been granted to at least one of the resources relative to a measure of a set of possible grantable privileges. In accordance with a least privilege security policy, and according to the usage score, the set of access privileges granted to the identity may then be adjusted.

Method and system for quantifying and improving conformance to least privilege security policies

Growing community of inventors

Cupertino, CA, United States of America

Parag Bajaria