Systems and methods of monitoring and controlling enterprise information stored on a cloud computing service (CCS)
A computer-implemented method is described to monitor and control enterprise information stored on a cloud computing service (CCS). The method includes using a cross-application monitor to detect a cloud computing service (CCS) application programming interface (API) in use and a function or an activity being performed via the CCS API. The method also includes determining the function or the activity being performed via the CCS API by parsing a data stream based on the CCS API and identifying content being transmitted to the CCS. The method further includes applying a content inspection rule to find strings and interrelated strings in the content that are subject to content control and triggering a security action responsive to finding the strings and interrelated strings subject to content control in the parsed stream.
1. A computer-implemented method of monitoring and controlling enterprise information stored on a cloud computing service (CCS), the method including:
detecting, with a cross-application monitor, a data stream between a client of an enterprise and an application programming interface (API) of the CCS;
parsing the data stream to identify an activity;
analyzing the activity to determine the activity comprises content level activity based on the activity comprising manipulation of content;
in response to determining that the activity comprises content level activity, applying a content inspection rule to the parsed data stream, wherein applying the content inspection rule comprises applying a multi-part string search pattern to the parsed data stream to match two or more non-contiguous strings that collectively identify content subject to content control associated with the activity;
selecting a security action based on a type of the content subject to the content control; and
triggering the security action to control the content.
2. The computer-implemented method of claim 1 , further including:
using the cross-application monitor to determine a file type of a file for which the activity is being requested; and
selectively applying a profile comprising a plurality of content inspection rules to content in the file based on at least the determined file type.
3. The computer-implemented method of claim 2 , further including:
using the cross-application monitor to determine whether the file is password protected; and
selectively applying the profile to the content in the file if the file is password protected.
4. The computer-implemented method of claim 1 , wherein the multi-part string search pattern comprises a plurality of multi-part string search patterns and sub-string patterns.
5. The computer-implemented method of claim 1 , wherein the multi-part string search pattern indicates custom data identifiers including custom string patterns and regular expressions.
6. The computer-implemented method of claim 5 , wherein the regular expressions support a plurality of string match pattern operators.
7. The computer-implemented method of claim 5 , wherein the regular expressions support a plurality of string match count operators.
8. The computer-implemented method of claim 5 , wherein the regular expressions support a plurality of metacharacter match pattern operators.
9. A system for monitoring and controlling enterprise information stored on cloud computing services (CCSs), the system comprising:
one or more processors; and
one or more memories having stored thereon instructions that, upon execution by the one or more processors, cause the one or more processors to:
detect, with a cross-application monitor of the system, a data stream between a client of an enterprise and an application programming interface (API) of a cloud computing service (CCS);
parse the data stream to identify an activity;
analyze the activity to determine the activity comprises content level activity based on the activity comprising manipulation of content;
in response to determining that the activity comprises content level activity, applying a content inspection rule to the parsed data stream, wherein applying the content inspection rule comprises applying a multi-part string a search pattern to the parsed data stream to match two or more non-contiguous strings that collectively identify content subject to content control associated with the activity;
selecting a security action based on a type of the content subject to the content control; and
triggering the security action to control the content.
10. The system of claim 9 , wherein the multi-part string search pattern comprises a plurality of multi-part string search patterns and sub-string patterns.
11. The system of claim 9 , wherein the instructions comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
determine, using the cross-application monitor, a file type of a file for which the activity is being requested; and
selectively applying a profile comprising a plurality of content inspection rules to content in the file based on at least the determined file type.
12. The system of claim 11 , wherein the instructions comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
determine, using the cross-application monitor, whether the file is password protected; and
selectively applying the profile to the content in the file if the file is password protected.
13. The system of claim 9 , wherein the multi-part string search pattern indicates custom data identifiers including custom string patterns and regular expressions.
14. The system of claim 13 , wherein the regular expressions support a plurality of string match pattern operators.
15. The system of claim 13 , wherein the regular expressions support a plurality of string match count operators.
16. The system of claim 13 , wherein the regular expressions support a plurality of metacharacter match pattern operators.
17. A non-transitory computer readable storage medium impressed with computer program instructions to monitor and control enterprise information stored on a cloud computing service (CCS), the instructions, when executed on a processor, implement a method comprising:
detecting, with a cross-application monitor, a data stream between a client of an enterprise and an application programming interface (API) of the CCS;
parsing the data stream to identify an activity;
analyzing the activity to determine the activity comprises content level activity based on the activity comprising manipulation of content;
in response to determining that the activity comprises content level activity, applying a content inspection rule to the parsed data stream, wherein applying the content inspection rule comprises applying a multi-part string search pattern to the parsed data stream to match two or more non-contiguous strings that collectively identify content subject to content control associated with the activity;
selecting a security action based on a type of the content subject to the content control; and
triggering the security action to control the content.
18. The non-transitory computer readable storage medium of claim 17 , wherein the instructions, when executed on the processors, implement the method further comprising:
using the cross-application monitor to determine a file type of a file for which the activity is being requested; and
selectively applying a profile comprising a plurality of content inspection rules to content in the file based on at least the determined file type.
19. The non-transitory computer readable storage medium of claim 18 , wherein the instructions, when executed on the processors, implement the method further comprising:
using the cross-application monitor to determine whether the file is password protected; and
selectively applying the profile to the content in the file if the file is password protected.
20. The non-transitory computer readable storage medium of claim 17 , wherein the multi-part string search pattern comprises a plurality of multi-part string search patterns and sub-string patterns.