International Business Machines Corporation

Ted A Habeck

Ian M Molloy

Suresh N Chari

Ashish Kundu

Josyula R Rao

Youngja Park

Wilfried Teiken

Arjun Natarajan

Julian James Stephen

Marco Pistoia

Dimitrios Pendarakis

Marc Philippe Stoecklin

Lawrence H Koved

Jennifer Ceil Lai

Jung-Mu Tang

Paul Bao-Luo Chou

David A Wood

Stella J Mitchell

Cezar Pendus

Steve Moimann

Jeff McAffer

An improved computing tool performs an improved computing tool function to identify sensitive data risks in cloud-based deployments. A knowledge graph is built based on data schema information for a cloud-based computing environment, a set of parsed infrastructure logs, and a set of captured application queries. A set of sensitive flows in the knowledge graph are identified representing paths from a sensitive data element to an endpoint in the knowledge graph. The set of sensitive flows are scored based on a scoring algorithm and an alert is issued to an administrator in response to a score of a sensitive flow within the set of sensitive flows exceeding a threshold.

Identifying sensitive data risks in cloud-based enterprise deployments based on graph analytics

Automatically generating audit logs is provided. Audit log statement insertion points are identified in components of an application based on a static code analysis identifying start and end operations on sensitive data in the components of the application. The application is instrumented with audit log statements at the audit log statement insertion points in the components of the application. Audit logs of monitored sensitive data activity events in the application are generated using the audit log statements at the audit log statement insertion points in the components of the application.

Automatic audit logging of events in software applications performing regulatory workloads

Detecting malicious user activity is provided. A profile for a user that accesses a set of protected assets is generated based on static information representing an organizational view and associated attributes corresponding to the user and based on dynamic information representing observable actions made by the user. A plurality of analytics is applied on the profile corresponding to the user to generate an aggregate risk score for the user accessing the set of protected assets based on applying the plurality of analytics on the profile of the user. A malicious user activity alert is generated in response to the aggregate risk score for the user accessing the set of protected assets being greater than an alert threshold value. The malicious user activity alert is sent to an analyst for feedback.

Detecting malicious user activity

Automatically generating audit logs is provided. Audit log statement insertion points are identified in software components of an application based on a static code analysis identifying start and end operations on sensitive data in the software components of the application. The application is instrumented with audit log statements at the audit log statement insertion points in the software components of the application. Audit logs of monitored sensitive data activity events in the application are generated using the audit log statements at the audit log statement insertion points in the software components of the application. A dynamic code analysis is performed on the application during execution of the application to prevent executing source code of the application from recording in the audit logs the sensitive data processed by the application.

Log(s) of IT events are accessed in a distributed system that includes a distributed application. The distributed system includes multiple data objects. The distributed application uses, processes, or otherwise accesses one or more of data objects. The IT events concern the distributed application and concern accesses by the distributed application to the data object(s). The IT events are correlated with a selected set of the data objects. Risks are estimated to the selected set of data objects based on the information technology events. Estimating risks uses at least ranks of compliance rules as these rules apply to the data objects in the system, and vulnerability scores of systems corresponding to the set of data objects and information technology events. Information is output that allows a user to determine the estimated risks for the selected set of data objects. Techniques for determining ranks of compliance rules are also disclosed.

Data-centric monitoring of compliance of distributed applications

Systems and methods are presented for automatically determining the security requirements of program code during the creation or modification of that program code and for presenting the necessary security permissions to a developer of the program code at the time of the creation or modification of the program code. A cache is established containing program code segments including library calls and application program interfaces that require security permissions at runtime. The cache also includes the security permissions associated with the stored program code segments. Program code editing is monitored in real time during the editing, and instances of edits that add, modify or delete the stored program code segments from the program code being edited are identified. The security permissions associated with the program code segments that are modified by the edits are retrieved from the cache. The retrieved security permissions are immediately presented to the developer in an interactive format that provides the developer with the ability to accept or decline the necessary changes to the security permissions.

Method and apparatus for automatic determination of authorization requirements while editing or generating code

A system and method to facilitate communications among team members or subscribers using a virtual assistant and a derived points of contact (POC) list to initiate contacts. The virtual assistant automates the task of reaching a party to be contacted through trying a variety of POC options until a connection is established or the options are exhausted. The system takes advantage of the POC provided by a person to be contacted, reducing the burden of maintaining a complete personal contact list by each team member or subscriber. The virtual assistant uses the derived POC list to establish a preferred method for contacting a team member or subscriber.

System and method to facilitate team communication

Growing community of inventors

Fishkill, NY, United States of America

Ted A Habeck