Quantifying Risk Based on Relationships and Applying Protections Based on Business Rules

An access control device for controlling access to a system, said access control device comprising:

• an interface, said interface receives a request to access the system from a user and metadata of the request to access the system, the request to access the system including a user identification, the metadata including at least one of:
• information obtained from a history of prior accesses to an application access system,
• information obtained from a history of prior accesses to a wireless authentication system, and
• confirmation of the user identification by an entity physically proximate the user;
• a database connected to said interface, said database including relationship data indicating a relationship between an individual assigned the user identification and the system;
• a processor connected to said database, said processor queries said database with the user identification and the metadata to identify identified relationship data;
• and
• a rules engine connected to said processor, said rules engine receives the identified relationship data from said processor and selects at least one security measure based on the identified relationship data.

An access control device for controlling access to a system, said access control device comprising:

• an interface, said interface receives a request to access the system from a user and metadata of the request to access the system, the request to access the system including a user identification, the metadata including:
• information obtained from a history of prior accesses to an application access system,
• information obtained from a history of prior accesses to a wireless authentication system, and
• confirmation of the user identification by an entity physically proximate the user;
• a database connected to said interface, said database including relationship data indicating a relationship between the individual assigned the user identification and at least one of an entity owning the system, an entity leasing the system, and an entity operating the system;
• a processor connected to said database, said processor queries said database with the user identification and the metadata to identify identified relationship data;
• and
• a rules engine connected to said processor, said rules engine receives the identified relationship data from said processor and selects at least one security measure based on the identified relationship data.

A computer program product for controlling access to a system, said computer program product comprising:

• a non-transitory computer readable storage medium;
• first program instructions to receive a request to access the system from a user, the request including a user identification;
• second program instructions to receive metadata of the request to access the system;
• third program instructions to query a database with the user identification and the metadata to identify relationship data, the relationship data indicating a relationship between an individual assigned the user identification and the system;
• fourth program instructions to input the relationship data into a rules engine;
• and
• fifth program instructions to select at least one security measure with the rules engine based on the relationship data,
• wherein said first program instructions, said second program instructions, said third program instructions, said fourth program instructions, and said fifth program instructions are stored on said computer readable storage medium.