Abstract: A computer-implemented method for identifying possible leakage paths of sensitive information may include (i) discovering an original set of users having permission to read the sensitive information at an originating storage device in an originating location via an original set of information transfer paths and (ii) performing a security action. The security action may include (A) determining an additional set of information transfer paths having information transfer paths other than the information transfer paths already discovered, via which the original set of users can write the sensitive information and (B) identifying an additional set of users having permission to read the sensitive information via the additional set of information transfer paths.

Abstract: The disclosed computer-implemented method for normalizing data store classification information may include (1) receiving, at the computing device, classification information from multiple data store content classification sources, (2) training a continuous bag of words (CBOW) classification model with the classification information, (3) receiving a classification tag from a data store for which respectively stored data is classified by one of the data store content classification sources, and (4) classifying, with the trained CBOW classification model, the received classification tag to a corresponding command tag, wherein the command tag represents a meaning of the classification tag. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for prioritizing and detecting file datasets based on metadata may include (i) receive a group of files from a data storage, (ii) train a machine-learning model utilizing a set of properties derived from metadata associated with the files, (iii) identify, utilizing the machine-learning model, a dataset including at least one candidate file that performs an action in a set of predetermined actions, and (iv) prioritize the action based on the dataset. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for producing access control list caches including effective information access permissions across disparate storage devices may include (i) receiving, at a computing device, an instruction to prepare an access control list (ACL) cache and (ii) performing a security action. The security action may include (A) recursively parsing, at the computing device, at least one respective ACL for information stored on at least two disparate storage devices, (B) identifying, at each step of recursion, each direct user and each indirect user having information access permissions in at least one of the respective ACLs, (C) determining, for each unique user in the respective ACLs, per-control point effective permissions, and (D) storing the per-control point effective information access permissions in the ACL cache. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for computing a risk score for stored information may include (1) extracting factor-specific information from metadata describing characteristics of files stored on multiple storage devices, (2) assigning at least one respective factor score to at least one respective factor based at least in part on the factor-specific information, and (3) calculating the risk score from the at least one factor score. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for managing user entitlements of objects from heterogeneous content sources may include (i) obtaining a user identifier from a user profile associated with a user, (ii) determining an entitlement for the user in an access control list (ACL) for an object of a content source, (iii) determining another entitlement for the user in another ACL for another object of another content source, wherein the content source and the other content source are associated with different systems, (iv) generating an effective entitlement of the user by associating the user identifier, the entitlement for the user in the ACL for the object, and the other entitlement for the user in the other ACL for the other object, and (v) storing the effective entitlement of the user. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for file system metadata analytics may include (i) creating a set of training data to train a machine learning model to analyze tokens that describe files within a file system, the set of training data comprising a first set of vectors, wherein each vector represents tokens that describes files that are frequently accessed by a common set of users, and a second set of vectors, wherein each vector represents tokens that describes files with common file path ancestors, (ii) training, using the set of training data, the machine learning model, (iii) determining, by providing at least one input token to the machine learning model, that the input token is related to at least one additional token, and (iv) performing an action responsive to observing the input token and involving the additional token and the file system. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for data management of multiple cloud services may include receiving, via a visibility application, a command for managing data hosted on a plurality of content sources. The commands from the visibility application may be modified and indirectly routed to the plurality of content sources. The method may include accessing, in response to the command, the plurality of content sources, and collecting and aggregating, from the plurality of content sources, metadata associated with the data. The method may also include analyzing the aggregated metadata. The method may further include providing, for presentation by the visibility application, results of the metadata analysis. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for identifying potentially risky data users within organizations may include (1) monitoring computing activity of a member of an organization with respect to the member's access to data related to the organization, (2) generating, based at least in part on the member's computing activity, a baseline representation of the member's access to the data, (3) detecting at least one attempt by the member to access at least a portion of the data, (4) determining that the member's attempt to access the portion of data represents an anomaly that is suspiciously inconsistent with the baseline representation, and then in response to determining that the member's attempt to access the portion of data represents the anomaly, (5) classifying the member as a potential risk to the security of the data. Various other methods, systems, and computer-readable media are also disclosed.