Implementing a multi-dimensional unified security and privacy policy with summarized access graphs

Abstract

A computerized method for implementing risk discovery with a set of unified security and privacy policies, includes the step of discovering a set of data and a set of data accesses within an enterprise computing system. The method includes the step of classifying the set of discovered data and the set of data accesses with an identification that shows which of the data assets are important or critical for the enterprise. The method includes the step of determining which of the set of discovered data and the set of data accesses have or are associated with sensitive information. The method includes the step of placing the set of discovered data and the set of data accesses that are associated with sensitive information into a set of discovered information about the infrastructure. The method includes the step of determining which of the set of discovered data and the set of data accesses are relevant in the context of a specified governmental data privacy regulation. The method includes the step of placing the set of discovered data and the set of data accesses that are relevant in the context of a specified governmental data privacy regulation into a set of discovered information about the infrastructure. The method includes the step of, with the set of discovered information about the infrastructure, mapping the set of discovered information about the infrastructure to a set of deterministic dimensions.

What is claimed by United States patent: 
     
         1 . A computerized method for implementing risk discovery with a set of unified security and privacy policies, comprising:
 discovering a set of data and a set of data accesses within an enterprise computing system;   classifying the set of discovered data and the set of data accesses with an identification that shows which of the data assets are important or critical for the enterprise by:
 determining which of the set of discovered data and the set of data accesses have or are associated with sensitive information, 
 placing the set of discovered data and the set of data accesses that are associated with sensitive information into a set of discovered information about the infrastructure, 
 determining which of the set of discovered data and the set of data accesses are relevant in the context of a specified governmental data privacy regulation, 
 placing the set of discovered data and the set of data accesses that are relevant in the context of a specified governmental data privacy regulation into a set of discovered information about the infrastructure; and 
   with the set of discovered information about the infrastructure, mapping the set of discovered information about the infrastructure to a set of deterministic dimensions.   
     
     
         2 . The computerized method of  claim 1 , further comprising:
 enabling the enterprise to select a subset of deterministic dimensions from the set deterministic dimensions to represent a policy or intent.   
     
     
         3 . The computerized method of  claim 2 , further comprising:
 providing an Open Policy Agent (OPA) as a general-purpose policy engine that implements a set of authorization and admission control to data filtering operations based on the selected subset of deterministic dimensions.   
     
     
         4 . The computerized method of  claim 2 , further comprising:
 generating a unified privacy and security OPA policy, wherein the unified privacy and security OPA policy assists enterprises to maintain a desired posture with respect to the specified governmental regulations.   
     
     
         5 . The computerized method of  claim 4 , wherein there are thirty-two (32) deterministic dimensions. 
     
     
         6 . The computerized method of  claim 5 , further comprising:
 generating a Risk criticality (RC) graph based on the subset of deterministic dimensions.   
     
     
         7 . The computerized method of  claim 6 , wherein the governmental regulation comprises the General Data Protection Regulation (GDPR). 
     
     
         8 . The computerized method of  claim 6 , wherein the governmental regulation comprises the California Consumer Privacy Act (CCPA). 
     
     
         9 . The computerized method of  claim 10 , wherein the RC graph quantifies a risk of a service or a data being subject to a cyber attack. 
     
     
         10 . The computerized method of  claim 1 , wherein a deterministic dimension has a cardinality of fixed attributes. 
     
     
         11 . The computerized method of  claim 10 , wherein an intent expressed by a specified set of deterministic dimensions is pre-defined.