Automatically creating data protection roles using anonymized analytics

A computer-implemented method of selecting data protection policies for a new system, comprising:

• collecting, in a hardware-based asset metadata management component, role, permission, and resource metadata for a plurality of users accessing data in the respective systems under corresponding access rules, wherein the collected metadata is anonymized with respect to personal identifying information of the users;
• storing the collected metadata in an anonymized analytics database, wherein the collected metadata is derived using a cluster analysis process and comprises access permissions of each user of the users that allow restriction by a user to a resource comprising at least one of:
• credential exchange, multi-factor authentication requirements, or use of an identity provider (IdP) service to gain access to the resource;
• first receiving policy and asset metadata for the new system;
• second receiving role, permission and resource metadata for the new system from a specific user;
• first matching, in the component, the received policy and the asset metadata to the collected metadata to identify an optimum protection policy of one or more protection policies based on the assets and protection requirements of the new system;
• second matching, in the component, the received specific policy and the asset metadata to the collected metadata to facilitate selection of an optimum access policy of one or more access policies based on assets and access restrictions of the new system;
• defining a set of metrics characterizing each user in the system;
• extracting metadata of the set of metrics from the specific user to be allowed access to the resource;
• comparing each metric of the user with corresponding metadata of a plurality of clusters each containing one or more other users, wherein a unique access policy is assigned to each cluster of the plurality of clusters to be applied to each user within a respective cluster;
• determining an overall affinity score of the user relative to each cluster;
• and
• automatically grouping the specific user into a cluster with the highest overall affinity score;
• and
• displaying to the specific user, through a graphical user interface (GUI), information regarding the matching to allow confirmation or change of identification of the optimum protection policy.