Techniques for discovering and managing security of applications

• US 10,536,478 B2
• Filed: 02/23/2017
• Issued: 01/14/2020
• Est. Priority Date: 02/26/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Kirti, Ganesh, Biswas, Kamalendu, Perera, Sumedha Nalin, Simu, Adina Florina
• Primary Examiner(s): Lewis, Lisa C
• Assistant Examiner(s): Salman, Raied A
• Application Number:
  US15/441,154
• Publication Number:
  US 20170251013A1
• Time in Patent Office: 1,055 Days
• Field of Search: 726 23, 726 25, 726 1
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques for discovery and management of applications in a computing environment of an organization are disclosed. A security management system discovers use of applications within a computing environment to manage access to applications for minimizing security threats and risks in a computing environment of the organization. The security management system can obtain network data about network traffic to identify unique applications. The security management system can perform analysis and correlation, including use of one or more data sources, to determine information about an application. The system can compute a measure of security for an application (“an application risk score”) and a user (“a user risk score”). The score may be analyzed to determine a threat of security posed by the application based on use of the application. The security system can perform one or more instructions to configure access permitted by an application, whether access is denied or restricted.

Claims

1. A computer-implemented method comprising, at a computer system of a security management system:

obtaining a file including data about network activity associated with a client device on a network of an organization, wherein the network activity is generated when the client device is operating as part of the network of the organization;

identifying, using the data about the network activity, an application that has been accessed by the client device while the client device is operating as part of the network of the organization, wherein the application is provided to the client device from a network of a service provider, wherein the network of the organization and the network of the service provider are different networks;

determining, using the data about the network activity, access information associated with the application, wherein the access information includes network activity indicating an access of the application from the client device;

determining, using the access information, domain information about the application, wherein the domain information identifies the service provider;

determining, using the domain information, security information about the application, wherein the security information comprises a first value indicative of a first security threat associated with the application and a second value indicative of a second security threat associated with the application;

computing a first weighted value that is based on multiplying the first value by a first weight value;

computing a second weighted value that is based on multiplying the second value by a second weight value;

computing a first sum that is based on a summation of the first weighted value and the second weighted value;

computing a second sum that is based on a summation of the first weight value and the second weight value;

computing a measure of security based on dividing the first sum by the second sum; and

performing, by applying a security policy based on the measure of security, a remediation action for the application.

2. The computer-implemented method of claim 1, wherein the first value is obtained from a first data source, and wherein the second value is obtained from a second data source.

3. The computer-implemented method of claim 1, wherein the first weight value is different from the second weight value, and wherein the first value is different from the second value.

4. The computer-implemented method of claim 1, wherein obtaining the file that includes the data about the network activity includes obtaining one or more files from one or more network devices on the network of the organization, wherein the network of the organization is protected in a computing environment of the organization, the computing environment being secure from a public network.

5. The computer-implemented method of claim 1, further comprising:

determining organization information for the application; and

generating a graphical interface that displays information about the application, wherein the information about the application is displayed based on the organization information and the measure of security computed for the application, and wherein the graphical interface indicates the remediation action performed for the application.

6. The computer-implemented method of claim 1, wherein the data about the network activity is for communications on the network of the organization, wherein identifying the application includes processing the data to identify a communication corresponding to a request for the application, and wherein the communication indicates application information about the request for the application, the application information being used to identify the application as being accessed by the client device.

7. The computer-implemented method of claim 6, wherein the access information is determined using the communication, and wherein the access information indicates a timestamp of the network activity for the application, an IP address of a system that provides the application, a media access control (MAC) address of a device used to access the application, and user information about a user of the client device.

8. The computer-implemented method of claim 1, wherein the access information indicates an IP address of a system that provides the application, wherein determining the domain information includes performing a query, based on the IP address of the application, for the domain information corresponding to a domain that hosts the application.

9. The computer-implemented method of claim 1, wherein the access information indicates source information of the application, the source information indicating a location of the application provided by a host, and wherein determining the domain information includes sending, to the host, a request for a certificate of the application based on the source information of the application.

10. The computer-implemented method of claim 1, wherein applying the security policy includes determining whether the measure of security satisfies a risk threshold for the application, and wherein the remediation action is to configure the network of the organization to prevent the application from being accessed on the network of the organization.

11. The computer-implemented method of claim 1, wherein the data about the network activity includes network activity associated with a plurality of users, wherein the plurality of users are a tenant on the network of the organization, and wherein the remediation action is to prevent access to the application by the plurality of users.

12. The computer-implemented method of claim 1, wherein the remediation action for the application includes:

generating a graphical interface; and

causing the graphical interface to display a prompt requesting adjustment of a configuration operation of the application, wherein the adjustment is based on the security policy applied to the measure of security.

13. A security management system comprising:

one or more processors; and

a memory accessible to the one or more processors, wherein the memory stores one or more instructions which, upon execution by the one or more processors, causes the one or more processors to perform operations comprising;

obtaining a file including data about network activity associated with a client device on a network of an organization, wherein the network activity is generated when the client device is operating as part of the network of the organization;

identifying, using the data about the network activity, an application that has been accessed by the client device while the client device is operating as part of the network of the organization, wherein the application is provided to the client device from a network of a service provider, wherein the network of the organization and the network of the service provider are different networks;

determining, using the data about the network activity, access information associated with the application, wherein the access information includes network activity indicating an access of the application from the client device;

performing, using the access information, one or more queries for domain information associated with the application;

determining security information about the application, the security information comprising a first value indicative of a first security threat associated with the application and a second value indicative of a second security threat associated with the application;

computing a first weighted value that is based on multiplying the first value by a first weight value;

computing a second weighted value that is based on multiplying the second value by a second weight value;

computing a first sum that is based on a summation of the first weighted value and the second weighted value;

computing a second sum that is based on a summation of the first weight value and the second weight value;

computing a measure of security based on dividing the first sum by the second sum; and

performing, by applying a security policy based on the measure of security, a remediation action for the application.

14. A computer-implemented method comprising, at a computer system of a security management system:

obtaining, from a first service provider system, first data about a first application, wherein the first application is accessed from the first service provider system, and wherein access of the first application is associated with a user;

obtaining, from a second service provider system, second data about a second application, wherein the second application is accessed from the second service provider system, and wherein access of the second application is associated with the user;

determining, using the first data and the second data, access information for a third application that has been accessed by the user;

searching, using the access information, for domain information about a provider system that provides the third application;

determining security information about the third application, the security information comprising a first value indicative of a first security threat associated with the third application and a second value indicative of a second security threat associated with the third application;

computing a first weighted value that is based on multiplying the first value by a first weight value;

computing a second weighted value that is based on multiplying the second value by a second weight value;

computing a first sum that is based on a summation of the first weighted value and the second weighted value;

computing a second sum that is based on a summation of the first weight value and the second weight value;

computing a measure of security based on dividing the first sum by the second sum; and

performing, by applying a security policy based on the measure of security, a remediation action for the third application.

15. The computer-implemented method of claim 14, wherein first service provider system is different from second service provider system, wherein the first service provider system provides access to the first application as a first cloud service, and wherein the second service provider system provides access to the second application as a second cloud service.

16. The computer-implemented method of claim 14, further comprising:

determining organization information for the third application; and

generating a graphical interface that displays information about the third application, wherein the information about the third application is displayed based on the organization information and the measure of security computed for the third application, and wherein the graphical interface indicates the remediation action performed for the third application.

17. The computer-implemented method of claim 14, wherein the first data indicates that the first application has been accessed by the user through the third application, wherein the second data indicates that the second application has been accessed by the user through the third application, and wherein determining the access information includes determining that the third application has been accessed to provide access to the first application and the second application.

18. The computer-implemented method of claim 14, wherein the first value is obtained from a first source, wherein the first value is different from the second value, and wherein the second value is obtained from a second source.