Protection from malicious and/or harmful content in cloud-based service scenarios

1. A method, comprising:

configuring a direct service integration entity with a trigger for a security threat scan task based on data objects comprising content identification of at least one of a content or a class of a file;

based on the configuring, performing at the direct service integration entity in a file service cloud entity of a multi-tenant cloud platform:

detecting a transmission attempt of a file between said file service cloud entity and a remote accessing entity associated with the multi-tenant cloud platform;

intercepting said file using an application programming interface provided to the direct service integration entity by a cloud service of the multi-tenant cloud platform;

in response to said intercepting, identifying with said data objects a content of said file, wherein the identifying comprises determining a hash value given by the content identification to identify the file;

based on the identifying, determining whether a scanning result was performed for the file;

based on determining a scanning result was not performed for the file, executing the trigger for the security threat scan task at the direct service integration entity in the file service cloud entity of a multi-tenant cloud platform;

detecting with the security threat scan task in a scan result memory a presence of a security threat scan result for said file assessing said file is malicious; and

transmitting, based on said assessing said file as malicious, an indication of the detected security threat scan result for said file to a security cloud entity connected to said file service cloud entity, wherein the indication of said detected security threat scan result causes the security cloud entity to prohibit downloading of the file to the remote accessing entity associated with the multi-tenant cloud platform.

2. The method according to claim 1 , further comprising

receiving, from said security cloud entity, said security threat scan result for said file as a result of said security threat scan task for said file, and

storing said security threat scan result for said file in said scan result memory.

3. The method according to claim 2 , wherein

said security threat scan result is provided with a time to live, and

the method further comprising

removing said security threat scan result from said scan result memory, if said time to live is expired.

4. The method according to claim 1 , wherein based on determining a scanning result was performed for the file, the method comprising:

retrieving from scan result cache records the scan result for the file that was stored after scanning based on a time to live or a configurable time interval.

5. The method according to claim 1 , wherein the trigger is associated with at least one of said data objects, a feed item, or a ContentVersion, and wherein the application programming interface comprises an API.

6. The method according to claim 1 , wherein

in relation to said detecting, said method further comprises

receiving with the trigger an indication that said file is uploaded from said remote accessing entity to said file service cloud entity.

7. The method according to claim 6 , said method further comprises

based on said file being assessed as malicious, at least one of initiating an alert, removing said file from said file service cloud entity, and moving said file into a quarantine section of said file service cloud entity.

8. The method according to claim 5 , wherein

in relation to said detecting, said method further comprises

receiving with the trigger an indication that said file is requested to be downloaded from said file service cloud entity to said remote accessing entity, and

setting a download allowance state for said file such that download of said file is prohibited.

9. The method according to claim 1 , wherein-said method comprises

based on said file being assessed as not malicious, setting said download allowance state for said file such that said download of said file is permitted.

10. An apparatus comprising

a memory configured to store computer program code, and

a processor configured to read and execute computer program code stored in the memory,

wherein the processor is configured to cause the apparatus to perform:

configuring at a direct service integration entity in a file service cloud entity of a multi-tenant cloud platform with a trigger for a security threat scan task based on data objects comprising at least one of a content or a class of a file to perform at the direct service integration entity:

detecting a transmission attempt of a file between said file service cloud entity and a remote accessing entity associated with the multi-tenant cloud platform,

intercepting said file using an application programming interface provided to the direct service integration entity by a cloud service of the multi-tenant cloud platform,

in response to said intercepting, identifying with said data objects a content of said file, wherein the identifying comprises determining a hash value given by the content identification to identify the file;

based on the identifying, determining whether a scanning result was performed for the file;

based on determining a scanning result was not performed for the file, executing the trigger for the security threat scan task at the direct service integration entity in the file service cloud entity of a multi-tenant cloud platform;

detecting with the security threat scan task in a scan result memory a presence of a security threat scan result for said file; and

transmitting, based on said detecting, an indication of the detected security threat scan task result for said file to a security cloud entity connected to said file service cloud entity, wherein the indication of said detected security threat scan result causes the security cloud entity to prohibit downloading of the file to the remote accessing entity associated with the multi-tenant cloud platform.

11. The apparatus according to claim 10 , wherein

the processor is further configured to cause the apparatus to perform:

receiving, from said security cloud entity, said security threat scan result for said file as a result of said security threat scan task for said file, and

storing said security threat scan result for said file in said scan result memory.

12. The apparatus according to claim 11 , wherein

said security threat scan result is provided with a time to live, and

the processor is further configured to cause the apparatus to perform:

removing said security threat scan result from said scan result memory, if said time to live is expired.

13. The apparatus according to claim 10 , wherein

based on determining a scanning result was performed for the file, the method comprising:

retrieving from scan result cache records the scan result for the file that was stored after scanning based on a time to live or a configurable time interval.

14. The apparatus according to claim 10 , wherein

the trigger is associated with at least one of said data objects, a feed item, or a ContentVersion, and wherein the application programming interface comprises an API.

15. The apparatus according to claim 14 , wherein

in relation to said detecting, the processor is further configured to cause the apparatus to perform:

receiving-with the trigger an indication that said file is uploaded from said remote accessing entity to said file service cloud entity.

16. The apparatus according to claim 15 , wherein the processor is further configured to cause the apparatus to perform:

based on said file being assessed as malicious, at least one of initiating an alert, removing said file from said file service cloud entity, and moving said file into a quarantine section of said file service cloud entity.

17. The apparatus according to claim 14 , wherein

in relation to said detecting, the processor is further configured to cause the apparatus to perform:

receiving with the trigger an indication that said file is requested to be downloaded from said file service cloud entity to said remote accessing entity, and

setting a download allowance state for said file such that download of said file is prohibited.

18. The apparatus according to claim 10 , wherein the processor is further configured to cause the apparatus to perform:

in case said file is assessed as not malicious, setting said download allowance state for said file such that said download of said file is permitted.

19. A non-transitory computer storage medium having stored thereon computer program code for implementing the method of claim 1 .

20. The method according to claim 1 , wherein the intercepting said file is using a link provided by the cloud service to utilize the application programming interface.