Security tool for preventing internal data breaches

A method comprising:

• storing, by a memory, a plurality of clusters, each cluster of the plurality of clusters corresponding to an access pattern for a database;
• decomposing, by a hardware processor communicatively coupled to the memory, a plurality of queries issued against the database by a plurality of users to determine a first set of queries issued by a first user of the plurality of users and a second set of queries issued by a second user of the plurality of users;
• determining, by the processor, from the first set of queries, a first set of columns in the database accessed by the first user as a result of issuing the first set of queries;
• determining, by the processor, from the second set of queries, a second set of columns in the database accessed by the second user as a result of issuing the second set of queries;
• assigning, by the processor, based at least in part on the first set of columns, the first user to a cluster of the plurality of clusters;
• assigning, by the processor, based at least in part on the second set of columns, the second user to the cluster of the plurality of clusters;
• determining, by the processor, based at least in part on the assignment of the first and second users to the cluster, that a first security risk corresponding to the first user accessing the first set of columns is below a threshold;
• determining, by the processor, based at least in part on the assignment of the first and second users to the cluster, that a second security risk corresponding to the second user accessing the second set of columns is below the threshold;
• determining, by the processor, based at least in part on the assignment of the first and second users to the cluster, that a third security risk corresponding to the first user accessing the first set of columns and the second user accessing the second set of columns exceeds the threshold;
• and
• in response to determining that the third risk exceeds the threshold, preventing, by the processor, the first user from accessing the first set of columns and the second user from accessing the second set of columns.

A system comprising:

• a database configured to store a plurality of columns that form a plurality of tables;
• and
• a security tool configured to:
• store a plurality of clusters, each cluster of the plurality of clusters corresponding to an access pattern for the database;
• decompose a plurality of queries issued against the database by a plurality of users to determine a first set of queries issued by a first user of the plurality of users and a second set of queries issued by a second user of the plurality of users;
• determine, from the first set of queries, a first set of columns of the plurality of columns in the database accessed by the first user as a result of issuing the first set of queries;
• determine, from the second set of queries, a second set of columns of the plurality of columns in the database accessed by the second user as a result of issuing the second set of queries;
• assign, based at least in part on the first set of columns, the first user to a cluster of the plurality of clusters;
• assign, based at least in part on the second set of columns, the second user to the cluster of the plurality of clusters;
• determine, based at least in part on the assignment of the first and second users to the cluster, that a first security risk corresponding to the first user accessing the first set of columns is below a threshold;
• determine, based at least in part on the assignment of the first and second users to the cluster, that a second security risk corresponding to the second user accessing the second set of columns is below the threshold;
• determine, based at least in part on the assignment of the first and second users to the cluster, that a third security risk corresponding to the first user accessing the first set of columns and the second user accessing the second set of columns exceeds the threshold;
• and
• in response to determining that the third risk exceeds the threshold, prevent the first user from accessing the first set of columns and the second user from accessing the second set of columns.