Remote management of hosted services
Remote services, such as security services, are onboarded for a tenant in a multi-tenant environment, such as a cloud-based electronic mail tenant, by configuring the tenant to permit remote access to local resources used at the tenant to facilitate the remote security services. As a significant advantage, this permits use of the remote security services with cloud-based enterprise resources hosted on the tenant, e.g., an enterprise mail server handling inbound and/or outbound electronic mail traffic, without requiring changes to the tenant's network configuration. As an additional advantage, security risks associated with the remote access may be confined to the specific tenant in the multi-tenant environment by creating a unique key for exchanging data between the tenant and the remote security services.
1 . A method for securely processing electronic mail comprising:
receiving a request from a user, at a console of a threat management facility remote from a first cloud computing platform comprising a multi-tenant environment, to securely manage electronic mail communications for an electronic mail tenant hosted on the first cloud computing platform, wherein the electronic mail tenant hosts an electronic mail service for an enterprise associated with the user; and
in response to the request, initiating, with the threat management facility, secure management of the electronic mail tenant by a security tenant hosted at the first cloud computing platform by causing the security tenant to perform the steps of:
causing the electronic mail tenant to create a digital identity associated with the user, the digital identity used by the security tenant to access one or more services of the electronic mail tenant,
obtaining a set of permissions from the electronic mail tenant for the digital identity to modify mail flow rules used by the electronic mail tenant to process electronic mail traffic,
securing communications between the electronic mail tenant and the security tenant with a key stored by the security tenant and uniquely associated with the enterprise and the digital identity, wherein:
the security tenant supports access by the threat management facility to the one or more services of the electronic mail tenant, and
the key is retrieved from a key management system securely accessed by the security tenant or the threat management facility,
causing the security tenant to request access to the electronic mail tenant using the digital identity, the request including an access token obtained by the security tenant with a certificate digitally signed with the key, wherein the key is stored by the security tenant for use in authentication to the electronic mail tenant, and
causing the security tenant, through the digital identity, to modify the mail flow rules for the electronic mail tenant to redirect the electronic mail traffic from the electronic mail tenant to a mail security service hosted on the threat management facility.
2 . The method of claim 1 , wherein the digital identity modifies the mail flow rules to redirect outbound electronic mail traffic from the electronic mail tenant to a remote mail security service for security analysis.
3 . The method of claim 2 , further comprising assessing a security risk of an outbound electronic mail message with the remote mail security service.
4 . The method of claim 3 , further comprising, in response to identifying an elevated security risk associated with the outbound electronic mail message, initiating a remedial action.
5 . The method of claim 3 , further comprising, in response to determining that the outbound electronic mail message does not pose an elevated security risk, returning the outbound electronic mail message to the electronic mail tenant for outbound handling as a safe message.
6 . The method of claim 1 , wherein the digital identity modifies the mail flow rules to redirect inbound electronic mail traffic for the electronic mail tenant to a remote mail security service.
7 . The method of claim 6 , further comprising assessing a security risk of an inbound electronic mail message with the remote mail security service.
8 . The method of claim 7 , further comprising, in response to identifying an elevated security risk associated with the inbound electronic mail message, initiating a remedial action.
9 . The method of claim 7 , further comprising, in response to determining that the inbound electronic mail message does not pose an elevated security risk, returning the inbound electronic mail message to the electronic mail tenant for inbound handling as a safe message.
10 . The method of claim 1 , wherein the access token enables programmatic access by the security tenant to the electronic mail tenant.
11 . The method of claim 1 , wherein the security tenant is a second electronic mail tenant hosted on the first cloud computing platform.
12 . The method of claim 1 , wherein the threat management facility is hosted on a second cloud computing platform remote from the first cloud computing platform.
13 . The method of claim 1 , wherein the set of permissions includes a permission for at least one of managing the electronic mail tenant, reading directory data at the electronic mail tenant, reading activity for the electronic mail tenant, signing into the electronic mail tenant, and reading domain information for the electronic mail tenant.
14 . The method of claim 1 , wherein causing the security tenant to obtain the set of permissions includes obtaining a permission for read and write access to role-based access control settings for the electronic mail tenant.
15 . The method of claim 1 , further comprising verifying a domain used by the electronic mail tenant before creating the digital identity.
16 . A method for remotely managing security from a cloud computing platform, the method comprising:
creating a management service to securely manage operations of a service tenant hosted in a multi-tenant environment, the management service executing on a management tenant in the cloud computing platform;
receiving a request from an enterprise user, at a console of a management facility remote from the cloud computing platform, to manage the service tenant; and
in response to the request, initiating remote management of the service tenant by, from the management tenant, performing the steps of:
causing the service tenant to create a digital identity associated with the enterprise user for the management tenant to access one or more services of the service tenant,
securing, for the digital identity, a set of permissions from the service tenant for the digital identity to modify processing operations of the service tenant,
configuring secure communications between the service tenant and the management tenant based on a cryptographic key stored by the management tenant, wherein:
the cryptographic key is uniquely associated with the enterprise user of the service tenant and the digital identity,
the service tenant hosts the one or more services for the enterprise user and the management tenant,
the management tenant supports access by the enterprise user through the management facility to the one or more services, and
the cryptographic key is retrieved from a key management system securely accessed by the management tenant or the management facility,
causing the management tenant to request access to the digital identity of the service tenant, the request using the cryptographic key for authentication by the service tenant, and
causing the management tenant, through the digital identity, to modify the processing operations of the service tenant according to rules managed by the management facility for remote use of a security service for the service tenant.
17 . A system comprising:
a first cloud computing platform comprising a first one or more processors configured by computer executable code to host a service tenant and a management tenant, wherein the service tenant is hosted in a multi-tenant environment; and
a threat management facility remote from the first cloud computing platform and comprising a second one or more processors configured by computer executable code to provide security services for the service tenant, wherein the management tenant is configured to, in response to a request from an enterprise user at a console of the threat management facility to initiate remote management of the service tenant, perform the steps of:
causing the service tenant to create a digital identity associated with the enterprise user for the management tenant to access one or more services of the service tenant,
securing, for the digital identity, a set of permissions from the service tenant for the digital identity to modify processing operations of the service tenant,
configuring secure communications between the service tenant and the management tenant based on a cryptographic key stored by the management tenant, wherein:
the cryptographic key is uniquely associated with the enterprise user and the digital identity,
the service tenant hosts the one or more services for the enterprise user and the management tenant,
the management tenant supports access by the enterprise user through the threat management facility to the one or more services, and
the cryptographic key is retrieved from a key management system securely accessed by the management tenant or the threat management facility,
causing the management tenant to request access to the digital identity of the service tenant, the request using the cryptographic key for authentication by the service tenant, and
causing the management tenant, through the digital identity, to modify the processing operations of the service tenant according to rules managed by the threat management facility for remote use of a security service for the service tenant.
18 . The system of claim 17 , wherein the service tenant is a first electronic mail tenant hosted on the first cloud computing platform, and the management tenant is a second electronic mail tenant hosted on the first cloud computing platform.
19 . The system of claim 17 , wherein the threat management facility is hosted on a second cloud computing platform remote from the first cloud computing platform.
20 . The system of claim 17 , wherein securing the set of permissions includes securing a permission for read and write access to role-based access control settings for the service tenant.