Endpoint security screening
View Patent ↗In order to prevent unauthorized access to information, a system may analyze and may selectively store the information provided based on requests from users that are not unauthorized to access the information. In particular, the system may receive a request for information associated with a document (such as a web page) from an authorized user, either in real-time (i.e., during live or online operation of the system) or offline (in which case the system may operate as a proxy for a live feed of requests). In response, the system may provide or replay the request, but may include the credentials of an unauthorized user. Then, the system may analyze the response to the request to determine if the response is substantive (i.e., includes information). If yes, the system may store the response for use in subsequent analysis and to guide remedial action.
1. A computer-implemented method for performing a security screen to identify website requests requiring remedial action, the method comprising:
receiving, at a computer, a first request for information associated with a website, wherein the first request is associated with an authorized user authorized to access the information associated with the website;
receiving, at the computer, a first response to the first request;
in response to determining that the first response comprises non-empty data, generating, at the computer, a second request for the information associated with the website, wherein the second request includes credentials for an unauthorized user who lacks authorization to access the information associated with the website;
receiving a second response to the second request; and
in response to determining that the second response includes non-empty data:
identifying the second request as requiring remedial action; and
storing the second response.
2. The method of claim 1 , wherein the operations in the method are performed by a proxy that is other than a computer system that provides access to the information associated with the website to users.
3. The method of claim 1 , wherein the first request is received from a computer system that provides access to the information associated with the website to users.
4. The method of claim 1 , wherein the method further comprises selectively storing, when the determination indicates the second response includes information, additional information specifying the website, the authorized user and the first response to the first request.
5. The method of claim 1 , wherein the method further comprises:
analyzing the second response based on a target pattern; and
performing remedial action based on the analysis.
6. The method of claim 5 , wherein the target pattern is associated with a security issue.
7. The method of claim 5 , wherein the analysis includes applying one or more logical tests.
8. The method of claim 1 , wherein the website includes a web page located at a Uniform Resource Locator.
9. The method of claim 1 , wherein the unauthorized user has partial authorization to access the information associated with the website.
10. The method of claim 1 , wherein the unauthorized user is predetermined.
11. The method of claim 1 , wherein the unauthorized user includes a fictitious user specified by a random number.
12. An apparatus, comprising:
one or more processors;
memory; and
a program module, wherein the program module is stored in the memory and, during operation of the apparatus, is executed by the one or more processors for performing a security screen to identify website requests requiring remedial action, the program module including:
instructions for receiving a first request for information associated with a website, wherein the first request is associated with an authorized user authorized to access the information associated with the website;
instructions for receiving a first response to the first request;
instructions for generating, in response to determining that the first response comprises non-empty data, a second request for the information associated with the website, wherein the second request includes credentials for an unauthorized user who lacks authorization to access the information associated with the website;
instructions for receiving a second response to the second request; and
instructions for, in response to determining that the second response includes non-empty data:
identifying the second request as requiring remedial action; and
storing the second response.
13. The apparatus of claim 12 , wherein the program module further comprises instructions for selectively storing, when the determination indicates the second response includes information, additional information specifying the website, the authorized user and the first response to the first request.
14. The apparatus of claim 12 , wherein the program module further comprises:
instructions for analyzing the second response based on a target pattern; and
instructions for performing remedial action based on the analysis.
15. The apparatus of claim 14 , wherein the target pattern is associated with a security issue.
16. The apparatus of claim 12 , wherein the website includes a web page located at a Uniform Resource Locator.
17. The apparatus of claim 12 , wherein the unauthorized user has partial authorization to access the information associated with the website.
18. The apparatus of claim 12 , wherein the unauthorized user is predetermined.
19. The apparatus of claim 12 , wherein the unauthorized user includes a fictitious user specified by a random number.
20. A system for performing security screening to identify website requests requiring remedial action, comprising:
a processing module comprising a non-transitory computer-readable medium storing instructions that, when executed, cause the system to:
receive a first request for information associated with a website, wherein the first request is associated with an authorized user authorized to access the information associated with the website;
receive a first response to the first request;
in response to determining that the first response comprises non-empty data, generate a second request for the information associated with the website, wherein the second request includes credentials for an unauthorized user who lacks authorization to access the information associated with the website;
receive a second response to the second request; and
in response to determining that the second response includes non-empty data:
identify the second request as requiring remedial action; and
store the second response.