Weekly Seminar - Kevin Roundy

About this event

Abstract According to various industry reports, 70-80% of data breaches involve the abuse of privileged accounts. IT administrators face the daunting task of granting the right amount of access to employees and programs that run on major cloud providers and hundreds of applications. There are 68,584 unique permissions just between AWS, GCP, Microsoft Azure, and Salesforce alone, and there is no standardization between systems. In theory, admins can use these permissioning systems to assign just the right amount of access to every employee and program, but for ease of administration they group permissions into roles, each of which contains many permissions. Our measurements indicate that the median user accessed only 8% of the roles assigned to them and used less than 1% of the permissions in a median role in the past 90 days. This means that the typical user has vastly more privilege than required and can cause significant harm if their password is stolen. In this talk we will discuss industry solutions for this problem, and three ways in which Dr. Roundy's research has helped to address this problem: (1) An Al and optimization-driven framework for modeling permission risk, (2) Use of recommendation systems to predict which permissions a user will need in the future based on past usage, (3) An optimization problem designed to simultaneously minimize over-privilege and reduce the number of roles, permissions, and user groups used by the company. Biography Dr. Kevin Alejandro Roundy graduated from BYU's Computer Science Department with a bachelor's degree, where he worked in Dr. Michael Goodrich's research lab. For his Ph.D. dissertation from the University of Wisconsin, he built tools to study defensive computer viruses through static and dynamic analysis and studied their obfuscation techniques. He subsequently worked for the Symantec/Norton Research Lab for 11 years, and joined Andromeda Security in 2023 as a Security and Al Researcher. He is a co-author on more than 20 research papers and 100 patents, covering many aspects of computer security. He lives in Los Angeles County and is the father of four daughters, two of whom are BYU students.