Method and system for protecting cloud-based applications executed in a cloud computing platform
A method and system for protecting cloud-based applications executed in a cloud computing platform are presented. The method includes intercepting traffic flows from a plurality of client devices to the cloud computing platform, wherein each of the plurality of client devices is associated with a user attempting to access a cloud-based application; extracting at least one parameter from the intercepted traffic related to at least each client device and a respective user attempting to access the cloud-based application; determining based on, the at least one parameter and at least a set of parameters combining cloud-based application risk factors for a provider of the cloud computing platform, a risk indicator for the user attempting to access the cloud-based application; and performing an action to mitigate a potential risk to the cloud computing platform based on the determined risk indicator.
1. A method for protecting cloud-based applications executed in a cloud computing platform, comprising:
intercepting, by at least one proxy device, traffic flows from a plurality of client devices to the cloud computing platform, wherein each of the plurality of client devices is associated with a user attempting to access a cloud-based application, wherein the at least one proxy device is connected between the plurality of client devices and the cloud computing platform;
extracting at least one parameter from the intercepted traffic related to at least each client device and a respective user attempting to access the cloud-based application;
determining, based on the at least one parameter and at least a set of parameters combining cloud-based application risk factors for a provider of the cloud computing platform, a risk indicator for the user attempting to access the cloud-based application, wherein the risk factors define at least security measures implemented by the provider and the cloud-based application; and
performing a mitigation action to mitigate a potential risk to the cloud computing platform based on the determined risk indicator, wherein the mitigation action includes at least regulating the access to the cloud-based application, and wherein the risk indicator is further determined using a profiling engine characterizing, based on passive traffic recordings of the set of parameters, user characteristics of each user, wherein the user characteristics include at least one of: user usage patterns, roles, locations, distribution of user activities over time, and daily user routines.
2. The method of claim 1 , further comprising:
auditing activities of users accessing the cloud-based application.
3. The method of claim 1 , wherein the cloud computing platform is a software as a service (SaaS) platform.
4. The method of claim 1 wherein the at least one parameter includes at least one of: a type of the client device, a location of the client device, an identity of the user device, an action taken by the user, a response by the cloud-based application, a time of a requested action, and bandwidth consumed by the client device.
5. The method of claim 1 , wherein extracting at least one parameter from the intercepted traffic further comprises:
identifying any client device used by the user to access the cloud-based application;
storing at least one device unique parameter associated with each identified client device; and
tracking, using the at least one device unique parameter, the user attempting to access the cloud-based application across multiple sessions.
6. The method of claim 5 , wherein the at least one device unique parameter associated with each identified client device comprises any one of: an International Mobile Equipment Identity (IMEI), a phone number, a media access control (MAC) address, an Internet Protocol (IP) address.
7. The method of claim 1 , wherein the risk indicator is further determined using at least one of: an anomaly engine and a cloud service index, wherein the cloud service index provides the set of parameters combining the cloud-based application risk factors for the provider of the cloud computing platform, wherein each of the security measures defined by the risk factors includes any one of: an authentication protocol, an encryption type, a security certification, and a security control.
8. The method of claim 7 , further comprising:
detecting, by the anomaly engine, at least one specific anomalous operation performed by each user, a series of anomalous operations by each user, and a pattern of anomalous operations performed by each user.
9. The method of claim 8 , wherein the detection is based in part on information provided by the profiling engine.
10. The method of claim 7 , wherein the anomaly engine is any one of: a distance-based anomaly engine and a statistical-based anomaly engine.
11. The method of claim 7 , wherein the set of parameters provided by the cloud service index includes at least one of: a security policy of the cloud-computing platform, a list of history of vulnerabilities of the cloud-computing platform, and attacks performed against the cloud-computing platform.
12. The method of claim 1 , wherein determining the risk indicator further comprises:
measuring a risk level for each risk vector of a plurality of risk vectors; and
computing the risk indicator as a weighted function of the measured risk levels.
13. The method of claim 12 , wherein each risk vector of the plurality of risk vectors includes any one of: a data risk vector related to data maintained or accessed by the cloud-based application; a user risk vector related to a type of users or devices that can access the cloud-based application, a service risk vector related to services provided by a provider of the cloud-computing platform, and a business risk vector related to a control provided to the user of the cloud-computing platform.
14. The method of claim 1 , wherein regulating the access to the cloud-based application further comprises at least one of:
generating an alert indicating on an unauthorized access; blocking an access to the cloud-based application; encrypting traffic to and from the cloud computing platform; suspending a user from accessing the cloud-based application, eliminating permissions granted to a user; and restricting access to some functions of the cloud-based application.
15. The method of claim 1 , further comprising:
capturing responses sent by the cloud-based application; and
processing the captured responses to enable processing of subsequent requests by the at least one proxy device.
16. The method of claim 1 , wherein each of the plurality of client devices is any one of: a managed device and an unmanaged device.
17. The method of claim 1 , further comprising:
preventing a user from retrieving files from the cloud computing platform by enabling integration with cloud-based storage systems.
18. A non-transitory computer readable medium having stored thereon instructions for causing one or more processors to perform a process for protecting cloud-based applications executed in a cloud computing platform, the process comprising:
intercepting, by at least one proxy device, traffic flows from a plurality of client devices to the cloud computing platform, wherein each of the plurality of client devices is associated with a user attempting to access a cloud-based application, wherein the at least one proxy device is connected between the plurality of client devices and the cloud computing platform;
extracting at least one parameter from the intercepted traffic related to at least each client device and a respective user attempting to access the cloud-based application;
determining, based on the at least one parameter and at least a set of parameters combining cloud-based application risk factors for a provider of the cloud computing platform, a risk indicator for the user attempting to access the cloud-based application, wherein the risk factors define at least security measures implemented by the provider and the cloud-based application; and
performing a mitigation action to mitigate a potential risk to the cloud computing platform based on the determined risk indicator, wherein the mitigation action includes at least regulating the access to the cloud-based application, and wherein the risk indicator is further determined using a profiling engine characterizing, based on passive traffic recordings of the set of parameters, user characteristics of each user, wherein the user characteristics include at least one of: user usage patterns, roles, locations, distribution of user activities over time, and daily user routines.
19. A system for protecting cloud-based applications executed in a cloud computing platform, comprising:
a processor; and
a memory, the memory containing instructions that, when executed by the processor, configure the system to:
intercept traffic flows from a plurality of client devices to the cloud computing platform, wherein each of the plurality of client devices is associated with a user attempting to access a cloud-based application, wherein the system is connected between the plurality of client devices and the cloud computing platform;
extract at least one parameter from the intercepted traffic related to at least each client device and a respective user attempting to access the cloud-based application;
determine, based on the at least one parameter and at least a set of parameters combining cloud-based application risk factors for a provider of the cloud computing platform, a risk indicator for the user attempting to access the cloud-based application, wherein the risk factors define at least security measures implemented by the provider and the cloud-based application; and
perform a mitigation action to mitigate a potential risk to the cloud computing platform based on the determined risk indicator, wherein the mitigation action includes at least regulating the access to the cloud-based application, and wherein the risk indicator is further determined using a profiling engine configured to characterize, based on passive traffic recordings of the set of parameters, user characteristics of each user, wherein the user characteristics include at least one of: user usage patterns, roles, locations, distribution of user activities over time, and daily user routines.
20. The system of claim 19 , the system is further configured to:
audit activities of users accessing the cloud-based application.
21. The system of claim 19 , wherein the cloud computing platform is a software as a service (SaaS) platform.
22. The system of claim 19 , wherein the at least one parameter includes at least one of: a type of the client device, a location of the client device, an identity of the user device, an action taken by the user, a response by the cloud-based application, a time of a requested action, and bandwidth consumed by the client device.
23. The system of claim 19 , the system is further configured to:
identify any client device used by the user to access the cloud-based application;
store at least one device unique parameter associated with each identified client device; and
track, using the at least one device unique parameter, the user attempting to access the cloud-based application across multiple sessions.
24. The system of claim 23 , wherein the at least one device unique parameter associated with each identified client device comprises any one of: an International Mobile Equipment Identity (IMEI), a phone number, a media access control (MAC) address, an Internet Protocol (IP) address.
25. The system of claim 19 , wherein the system is further configured to determine the risk indicator using at least one of: a profiling cnginc, an anomaly engine, and a cloud service index, wherein the cloud service index provides the set of parameters combining the cloud-based application risk factors for the provider of the cloud computing platform, wherein each of the security measures defined by the risk factors includes any one of: an authentication protocol, an encryption type, a security certification, and a security control.
26. The system of claim 25 , the system is further configured to:
detect, by the anomaly engine, at least one specific anomalous operation performed by each user, a series of anomalous operations by each user, and a pattern of anomalous operations performed by each user.
27. The system of claim 26 , wherein the detection is based in part on information provided by the profiling engine.
28. The system of claim 25 , wherein the anomaly engine is any one of: a distance-based anomaly engine and a statistical-based anomaly engine.
29. The system of claim 25 , wherein the set of parameters provided by the cloud service index includes at least one of: a security policy of the cloud-computing platform, a list of history of vulnerabilities of the cloud-computing platform, and attacks performed against the cloud-computing platform.
30. The system of claim 19 , the system is further configured to:
measure a risk level for each risk vector of a plurality of risk vectors; and
compute the risk indicator as a weighted function of the measured risk levels.
31. The system of claim 30 , wherein each risk vector of the plurality of risk vectors includes any one of: a data risk vector related to data maintained or accessed by the cloud-based application; a user risk vector related to a type of users or devices that can access the cloud-based application, a service risk vector related to services provided by a provider of the cloud-computing platform, and a business risk vector related to a control provided to the user of the cloud-computing platform.
32. The system of claim 22 , wherein regulating the access to the cloud-based application further comprises at least one of:
generating an alert indicating on an unauthorized access; blocking an access to the cloud-based application; encrypting traffic to and from the cloud computing platform; suspending a user from accessing the cloud-based application, eliminating permissions granted to a user; and restricting access to some functions of the cloud-based application.
33. The system of claim 19 , wherein the system is realized as a proxy device.
34. The system of claim 33 , the system is further configured to:
capture responses sent by the cloud-based application; and
process the captured responses to enable processing of subsequent requests.
35. The system of claim 19 , wherein each of the plurality of client devices is any one of: a managed device and an unmanaged device.
36. The system of claim 19 , the system is further configured to:
prevent a user from retrieving files from the cloud computing platform by enabling integration with cloud-based storage systems.