TECHNICAL FIELD

The present disclosure relates to data security and, in particular, to systems and methods for evaluating security of third-party applications that request to gain access to a protected data resource.

BACKGROUND

Private user data may be stored in a protected data resource, such as a secure database. Typically, an access control system would be implemented to prohibit unauthorized access of user data. An access control system may, for example, perform authentication of users and access approval for a protected data resource.

In some contexts, users may wish to grant permission to third-parties to access their data at a protected data resource. For example, a user may provide, to a third-party application, their login credentials (i.e. username and password) for accessing their account in a protected database, and the third-party application may use those login credentials to authenticate to and retrieve account data from the protected database. The user's input of the login credentials represents, in effect, their indication of consent to the release of data to the third-party application. Upon successful authentication, the access control system allows the requesting third-party application to gain access to the user's account in the protected database.

Third-party access of protected user data may present various privacy and security challenges. For example, if a third-party application (or associated server) is compromised, user login credentials may be appropriated by rogue parties that might use the information to complete fraudulent transactions, perpetrate identity theft, etc. As another example, even when users provide consent for a third-party application to gain access to their private data, it may be difficult for the users to appreciate potential security risks, such as data breach and misuse of data, associated with granting such access.

