SYSTEM AND METHOD FOR SECURING AN ENTERPRISE COMPUTING ENVIRONMENT

• US 20180027006A1
• Filed: 02/24/2016
• Published: 01/25/2018
• Est. Priority Date: 02/24/2015
• Status: Abandoned Application

• Current Assignee: Cloudlock Incorporated (Cisco Systems, Inc.)
• Original Assignee: Cloudlock Incorporated (Cisco Systems, Inc.)
• Inventors: Zimmermann, Gil, Zalkind, Ron, Shapsa, Tsahy, Wall, Timothy, Deluca, Sam, Keren, Ori, Spellward, Peter, Sand, Jennifer, Beeri, Yishai, Woodhouse, Howard Snart, Lines, Daniel
• Application Number:
  US15/547,351
• Publication Number:
  US 20180027006A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Methods and systems provided herein include a cyber intelligence system, a unified application firewall, and a cloud security fabric that has enterprise APIs for connecting to the information technology infrastructure of an enterprise, developer APIs 102 for enabling developers to access capabilities of the fabric and connector APIs by which the fabric may discover information about entities relevant to the information security of the enterprise (such as events involving users, applications, and data of the enterprise occurring on a plurality of cloud-enabled platforms, including PaaS/IaaS platforms), with various modules that comprise services deployed in the cloud security fabric, such as a selective encryption module, a policy creation and automation module, a content classification as a service module, and user and entity behavior analytics modules.

Claims

1. A system for providing enhanced security for an enterprise computing environment comprising:

a computing platform for interfacing with one or more cloud services to collect data regarding interactions of entities of said enterprise computing environment with each of said cloud services or interactions involving said entities which occur between cloud services;

one or more databases in which said collected data is stored;

one or more modules, executing on said computing platform, said modules providing services to said computing environment regarding interactions of said entities with said cloud services or interactions involving said entities which occur between cloud services; and

one or more interfaces providing access to said collected data and said services.

2. The system of claim 1 wherein said one or more of said modules include at least one of:

a selective encryption module configured to encrypt at least a selected portion of data when said data is transferred to at least one of said cloud services;

a policy engine module configured to specify and enforce a policy relating to at least one of said entities with respect to at least one of said cloud services;

an application firewall module configured to collect and unify said collected data from a plurality of cloud services;

a user and entity behavior analysis module configured for detecting patterns with respect to said entity interactions; and

a content classification as a service module configured to enable automatic classification of content of the enterprise that is involved in said entity interactions.

3. The system of claim 1 wherein said computing platform performs the functions of:

identifying cloud services involving interactions of said entities;

identifying activities of said entities with said cloud services;

identifying activities involving said entities which occur between said cloud services;

analyzing said activities to determine whether said activities pose a threat to said enterprise computing environment; and

in response to determining that the one or more activities pose a threat to the enterprise computing environment, deploying at least one security module to address the threat.

4. The system of claim 1 wherein said entities comprise at least one of users of the enterprise, applications used by users of the enterprise, data objects of the enterprise and events occurring with respect to the users, the applications and the data objects.

5. The system of claim 1 wherein said one or more interfaces enable connections between said computing platform and a development environment.

6. The system of claim 1 wherein said one or more interfaces enable an exchange of data between at least one of said modules and an enterprise security system.

7. The system of claim 1 wherein said cloud services include at least one of an SaaS application, a cloud platform, an infrastructure as a service environment and a platform as a service environment.

8. The system of claim 6 wherein said one or more interfaces facilitate collection of information about said entities from at least one of said cloud services.

9. The system of claim 1 wherein at least one of said modules is at least one of a content analysis module and a content classification module.

10. The system of claim 1 wherein at least one of said modules is an application firewall module.

11. The system of claim 1 wherein at least one of said modules is at least one of a security analytics module and a threat intelligence module.

12. The system of claim 1 wherein at least one of said modules is an encryption management module.

13. The system of claim 1, wherein at least one of said modules is at least one of an incident management module and a policy engine.

14. The system of claim 1 wherein at least one of said modules is a context analysis module.

15. The system of claim 1 wherein at least one of said modules is an auditing module.

16. The system of claim 1 wherein at least one of said modules is at least one of a user behavior monitoring module and a user behavior analytics module.

17. The system of claim 1 wherein at least one of said modules is at least one of a configuration security module and a configuration management module.

18. The system of claim 1 further comprising a unified application firewall platform for collecting information about cloud entities, enterprise network entities, and security system entities and storing the information in a unified security model.

19. The system of claim 1 wherein said unified security model includes a community trust rating for an application that is derived at least in part from information contributed by users in said computing environment about the application.

20. The system of claim 1 wherein information in said unified security model is used to produce at least one of an application index, an application risk rating, and a user risk rating.

21. The system of claim 1 further comprising a cyber intelligence system for operating on the data in the unified security model, said cyber intelligence system comprising a machine learning system for detecting anomalies in events relating to at least one of a user and an application.

22. A system for providing enhanced security for an enterprise computing environment comprising:

a computing platform performing the functions of;

interfacing with one or more cloud services to collect data regarding interactions between entities in said computing environment and each of said cloud services;

storing said collected data in a database;

providing services to said computing environment regarding interactions of said entities with said cloud services; and

providing access to said collected data and said services via one or more application programming interfaces.