Dynamic entitlement manager

摘要

Embodiments of the invention relate to systems, methods, and computer program products for monitoring and/or controlling access to entitlements. For example, in one embodiment a computer program product is configured to periodically examine the members of a particular community in an organization and automatically identify members in the community that have access to software applications, datasets, or other organizational resources that are uncommon in the community, which may indicate that the member should not have access to the such resources. The computer program product of embodiments of the invention is also configured to automatically and periodically determine the resources that members of the same community should all probably have access to. As such, embodiments of the present invention allow an organization to more efficiently monitor and control access to its resources and other entitlements.

主权项

1. A computer program product for monitoring or controlling access to or distribution of a plurality of entitlements, the computer program product comprising a non-transitory computer readable medium having computer readable program instructions stored therein, wherein said computer readable program instructions comprise:
instructions configured to select a community of entitlement-eligible entities from a plurality of predefined communities of entitlement-eligible entities in an organization, wherein each of a plurality of entitlement-eligible entities in the selected community has one or more entitlements assigned thereto; instructions configured to determine, for each of the one or more entitlements, the total number of the plurality of entitlement-eligible entities in the selected community that are assigned each entitlement; instructions configured to receive an uncommon entitlement threshold for the selected community, wherein the received uncommon entitlement threshold is a predetermined value specific to the selected community of entitlement-eligible entities; instructions configured to compare the total number for each of the one or more entitlements assigned to the plurality of entitlement eligible-entities in the selected community to the uncommon entitlement threshold; instructions configured to determine which entitlements of the one or more entitlements that are uncommon, based at least partially on the comparison of the total number for each of the one or more entitlements to the uncommon entitlement threshold, and wherein an entitlement is uncommon if the total number for each of the one or more entitlements assigned to entitlement-eligible entities in the community is less than the uncommon entitlement threshold; instructions configured to determine whether each of the uncommon entitlements requires validation or not prior to removing or withholding the uncommon entitlement from the entitlement-eligible entity in the selected community; instructions configured to determine an infection rate that provides an indication of the extent that the selected community is infected with entitlements below the uncommon entitlement threshold, wherein the infection rate is the number or percentage of uncommon entitlements existing in a community; instructions configured to compare the infection rate of the selected community with an infection rate of at least one other community; and instructions configured to direct resources to examining the entitlements of a community with a higher relative infection rate before directing resources to examining the entitlements of a community with a lower relative infection rate.