Management of access to resources by users

A system for securing access for user accounts, comprising:

• at least one processor executing a code for:
• automatically creating and/or updating a graph mapping a plurality of nodes denoting real users to a plurality of user accounts and a plurality of resources hosted by a plurality of service computing environments external to a target computing environment accessed by the user accounts, and defining different permissions for user accounts for accessing the different resources, using data collected by a discovery service comprising a plurality of connectors implementing a generic connector interface, wherein each connector of the plurality of connectors is configured to transform application programming interface (API) responses from the plurality of service computing environments into connector response schemas that map to Identity and Access Management (IAM) messages, wherein a graph worker process automatically generates the graph based on the IAM messages sent over a network connecting the plurality of service computing environments and the target computing environment;
• receiving a query for identifying at least one access path of user accounts for a target user with access privileges to a target resource;
• executing the query on the graph to identify at least one access path;
• providing details regarding at least one access path of user accounts of the target users from the execution of the query on the graph, the details of the at least one access path including at least one of:
• identifiers of the user accounts, resources accessible to the user accounts, access privileges for accessing the resources;
• automatically analyzing the structure of the graph to identify an access graph comprising at least one sub-structure indicating a security risk of at least one access path that leads to a target resource and/or service and/or service computing environment,
• wherein each access path is defined as a series of hops between different systems via intermediate components;
• and
• sending a message to an administrative server and/or to an access control process running on the target service environment to automatically adapt access permissions associated with the at least one access path with the security risk according to an adapted at least one access path with reduced or eliminated security risk.

A non-transitory medium storing program instructions for securing access for user accounts, comprising program instructions which when executed by at least one processor, cause the at least one processor to:

• automatically create and/or update a graph mapping a plurality of nodes denoting real users to a plurality of user accounts and a plurality of resources hosted by a plurality of service computing environments external to a target computing environment accessed by the user accounts, and defining different permissions for user accounts for accessing the different resources, using data collected by a discovery service comprising a plurality of connectors implementing a generic connector interface, wherein each connector of the plurality of connectors is configured to transform application programming interface (API) responses from the plurality of service computing environments into connector response schemas that map to Identity and Access Management (IAM) messages, wherein a graph worker process automatically generates the graph based on the IAM messages sent over a network connecting the plurality of service computing environments and the target computing environment;
• receive a query for identifying at least one access path of user accounts for a target user with access privileges to a target resource;
• execute the query on the graph to identify at least one access path;
• provide details regarding at least one access path of user accounts of the target users from the execution of the query on the graph, the details of the at least one access path including at least one of:
• identifiers of the user accounts, resources accessible to the user accounts, access privileges for accessing the resources;
• automatically analyze the structure of the graph to identify an access graph comprising at least one sub-structure indicating a security risk of at least one access path that leads to a target resource and/or service and/or service computing environment,
• wherein each access path is defined as a series of hops between different systems via intermediate components;
• and
• sending a message to an administrative server and/or to an access control process running on the target service environment to automatically adapt access permissions associated with the at least one access path with the security risk according to an adapted at least one access path with reduced or eliminated security risk.