Map-based techniques for visualizing user access data and for configuring and enforcing location-based access policies

A computer program product, comprising a non-transitory machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:

• obtaining a plurality of risk-based policies specified by one or more administrators using a map-based interface for a plurality of geographic regions, wherein the map-based interface comprises one or more zoom levels within each geographic region of the plurality of geographic regions and an indication of an associated aggregated risk score for each of the plurality of geographic regions indicating a level of risk for a plurality of user access events that occurred within the respective geographic region, wherein each of the plurality of user access events comprises a given user attempting to gain access to one or more computer-related resources and is associated with a geohash-encoded string corresponding to the respective geographic region;
• and
• in response to a further user access event:
• determining a geolocation of the further user access event;
• converting the geolocation of the user access event to a geohash-encoded string;
• identifying a particular geographic region associated with the determined geolocation by matching the geohash-encoded string of the further user access event to geohash-encoded strings of the plurality of geographic regions;
• identifying one or more of the plurality of risk-based policies associated with the particular geographic region;
• and
• processing the user access event based on the identified one or more risk-based policies associated with the particular geographic region.

An apparatus, comprising:

• a memory;
• and
• at least one processing device, coupled to the memory, operative to implement the following steps:
• obtaining a plurality of risk-based policies specified by one or more administrators using a map-based interface for a plurality of geographic regions, wherein the map-based interface comprises one or more zoom levels within each geographic region of the plurality of geographic regions and an indication of an associated aggregated risk score for each of the plurality of geographic regions indicating a level of risk for a plurality of user access events that occurred within the respective geographic region, wherein each of the plurality of user access events comprises a given user attempting to gain access to one or more computer-related resources is associated with a geohash-encoded string corresponding to the respective geographic region;
• and
• in response to a further user access event:
• determining a geolocation of the further user access event;
• converting the geolocation of the user access event to a geohash-encoded string;
• identifying a particular geographic region associated with the determined geolocation by matching the geohash-encoded string of the further user access event to geohash-encoded strings of the plurality of geographic regions;
• identifying one or more of the plurality of risk-based policies associated with the particular geographic region;
• and
• processing the user access event based on the identified one or more risk-based policies associated with the particular geographic region.