Security Monitoring

• US 20110282908A1
• Filed: 03/14/2011
• Published: 11/17/2011
• Est. Priority Date: 05/13/2010
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Greene, Collin, Fly, Robert, Dolph, James, Soby, Brian
• Granted Patent: US 8,768,964 B2
• Time in Patent Office: Days
• US Class Current: 707/783
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Disclosed are systems, apparatus, methods, and computer readable media for analyzing computing site information. In one embodiment, an analysis tool for analyzing a first site record stored on a storage medium may be selected. The first site record comprising information may relate to a computing site. The computing site may comprise a unit of computing functionality accessible via a network. When it is determined that first confidentiality level for the computing site exceeds a trust level for the analysis tool, the first site record may be modified to create a second site record, the second site record having a second confidentiality level, the second confidentiality level not exceeding the trust level.

Claims

1. A method of analyzing computing site information, the method comprising:

selecting an analysis tool for analyzing a first site record stored on a storage medium, the first site record comprising information related to a computing site, the computing site comprising a unit of computing functionality accessible via a network;

determining whether a first confidentiality level for the computing site exceeds a trust level for the analysis tool, the first confidentiality level indicating a level of importance of maintaining the confidentiality of the site record, the trust level for the analysis tool indicating a threshold confidentiality level for information that the analysis tool is trusted to receive;

when it is determined that the first confidentiality level exceeds the trust level, modifying the first site record to create a second site record, the second site record having a second confidentiality level, the second confidentiality level not exceeding the trust level; and

transmitting the modified site record to the analysis tool.

2. The method recited in claim 1, wherein modifying the first site record to create the second site record comprises:

identifying a first data value within the first site record, the presence of the first data value being at least partly indicative of the first confidentiality level exceeding the trust level.

3. The method recited in claim 2, wherein modifying the first site record to create the second site record comprises:

eliminating the first data value when creating the second site record.

4. The method recited in claim 2, wherein modifying the first site record to create the second site record comprises:

determining whether the presence of a data value having a form of the first data value is necessary for the analysis tool to analyze the second site record.

5. The method recited in claim 4, wherein modifying the first site record to create the second site record further comprises:

when the presence of a data value having a form of the first data value is necessary for the analysis tool to analyze the second site record, replacing the first data value with a second data value when creating the second site record, the second data value having the form of the first data value, the replacement of the first data value with the second data value being at least partly responsible for the second confidentiality level not exceeding the trust level.

6. The method recited in claim 1, the method further comprising:

identifying a site record source associated with the first site record, the site record source indicating a location at which the first site record was located; and

determining the first confidentiality level based on the site record source.

7. The method recited in claim 6, wherein determining the first confidentiality level comprises:

determining a source-based confidentiality level based on the site record source, the source-based confidentiality level indicating a level of importance of maintaining the confidentiality of information obtained via the site record source.

8. The method recited in claim 7, wherein determining the first confidentiality level further comprises:

determining whether a pre-existing confidentiality level for the first site record is greater than the source-based confidentiality level; and

when the pre-existing confidentiality is greater than the source-based confidentiality level, setting the first confidentiality level equal to the source-based confidentiality level.

9. The method recited in claim 1, wherein the first site record comprises a uniform resource locator.

10. The method recited in claim 1, wherein the computing site further comprises a webpage, and wherein the webpage is publicly accessible via the network.

11. The method recited in claim 1, the method further comprising:

storing the first confidentiality level in a storage location.

12. The method recited in claim 11,

wherein the storage location comprises a multitenant database accessible to a plurality of tenants via an on-demand computing services environment.

13. A computing system comprising one or more computing devices, the computing system configured to:

select an analysis tool for analyzing a first site record stored on a storage medium, the first site record comprising information related to a computing site, the computing site comprising a unit of computing functionality accessible via a network;

determine whether a first confidentiality level for the computing site exceeds a trust level for the analysis tool, the first confidentiality level indicating a level of importance of maintaining the confidentiality of the site record, the trust level for the analysis tool indicating a threshold confidentiality level for information that the analysis tool is trusted to receive;

when it is determined that the first confidentiality level exceeds the trust level, modify the first site record to create a second site record, the second site record having a second confidentiality level, the second confidentiality level not exceeding the trust level; and

transmit the modified site record to the analysis tool.

14. The computing system recited in claim 13, wherein modifying the first site record to create the second site record comprises:

identifying a first data value within the first site record, the presence of the first data value being at least partly indicative of the first confidentiality level exceeding the trust level.

15. The computing system recited in claim 14, wherein modifying the first site record to create the second site record comprises:

eliminating the first data value when creating the second site record.

16. The computing system recited in claim 14, wherein modifying the first site record to create the second site record comprises:

determining whether the presence of a data value having a form of the first data value is necessary for the analysis tool to analyze the second site record.

17. The computing system recited in claim 16, wherein modifying the first site record to create the second site record further comprises:

when the presence of a data value having a form of the first data value is necessary for the analysis tool to analyze the second site record, replacing the first data value with a second data value when creating the second site record, the second data value having the form of the first data value, the replacement of the first data value with the second data value being at least partly responsible for the second confidentiality level not exceeding the trust level.

18. The computing system recited in claim 13, wherein the computing system is further configured to:

identify a site record source associated with the first site record, the site record source indicating a location at which the first site record was located; and

determine the first confidentiality level based on the site record source.

19. The computing system recited in claim 18, wherein determining the first confidentiality level comprises:

determining a source-based confidentiality level based on the site record source, the source-based confidentiality level indicating a level of importance of maintaining the confidentiality of information obtained via the site record source.

20. The computing system recited in claim 19, wherein determining the first confidentiality level further comprises:

determining whether a pre-existing confidentiality level for the first site record is greater than the source-based confidentiality level; and

when the pre-existing confidentiality is greater than the source-based confidentiality level, setting the first confidentiality level equal to the source-based confidentiality level.

21. The computing system recited in claim 13, wherein the first site record comprises a uniform resource locator.

22. One or more computer readable media having instructions stored thereon for performing a method of analyzing computing site information, the method comprising:

selecting an analysis tool for analyzing a first site record stored on a storage medium, the first site record comprising information related to a computing site, the computing site comprising a unit of computing functionality accessible via a network;

determining whether a first confidentiality level for the computing site exceeds a trust level for the analysis tool, the first confidentiality level indicating a level of importance of maintaining the confidentiality of the site record, the trust level for the analysis tool indicating a threshold confidentiality level for information that the analysis tool is trusted to receive;

when it is determined that the first confidentiality level exceeds the trust level, modifying the first site record to create a second site record, the second site record having a second confidentiality level, the second confidentiality level not exceeding the trust level; and

transmitting the modified site record to the analysis tool.

23. The one or more computer readable media recited in claim 22, wherein modifying the first site record to create the second site record comprises:

identifying a first data value within the first site record, the presence of the first data value being at least partly indicative of the first confidentiality level exceeding the trust level.

24. The one or more computer readable media recited in claim 23, wherein modifying the first site record to create the second site record comprises:

eliminating the first data value when creating the second site record.

25. The one or more computer readable media recited in claim 23, wherein modifying the first site record to create the second site record comprises:

determining whether the presence of a data value having a form of the first data value is necessary for the analysis tool to analyze the second site record.

26. The one or more computer readable media recited in claim 25, wherein modifying the first site record to create the second site record further comprises:

when the presence of a data value having a form of the first data value is necessary for the analysis tool to analyze the second site record, replacing the first data value with a second data value when creating the second site record, the second data value having the form of the first data value, the replacement of the first data value with the second data value being at least partly responsible for the second confidentiality level not exceeding the trust level.

27. The one or more computer readable media recited in claim 22, the method further comprising:

identifying a site record source associated with the first site record, the site record source indicating a location at which the first site record was located; and

determining the first confidentiality level based on the site record source.

28. The one or more computer readable media recited in claim 27, wherein determining the first confidentiality level comprises:

determining a source-based confidentiality level based on the site record source, the source-based confidentiality level indicating a level of importance of maintaining the confidentiality of information obtained via the site record source.