Using message context to evaluate security of requested data

1. A method, comprising:

receiving information of an electronic message to be delivered to an intended recipient;

determining for an original resource identifier included in the electronic message, a corresponding alternative resource identifier, wherein the corresponding alternative resource identifier can be at least in part used to obtain the original resource identifier and obtain context information associated with the electronic message after allowing the intended recipient to access the corresponding alternative resource identifier;

replacing the original resource identifier included in the electronic message with the alternative resource identifier to generate a modified electronic message; and

allowing the modified electronic message with the alternative resource identifier to be delivered to the intended recipient instead of the electronic message with the original resource identifier, wherein a request made using the alternative resource identifier in the modified message triggers a security action based at least in part on the context information obtained using the alternative resource identifier and associated with the electronic message, and wherein in response to the request made using the alternative resource identifier in the modified message, a security risk associated with the original resource identifier is determined using the context information associated with the electronic message and content referenced by the original resource identifier.

2. The method of claim 1 , wherein the electronic message is an email received at one of the following devices: a mail transfer agent device, a mail relay device, a gateway device, a cloud security device, or a local security appliance.

3. The method of claim 1 , wherein the original resource identifier is an URL hyperlink included in a body content of the electronic message.

4. The method of claim 1 , wherein the corresponding alternative resource identifier includes a domain name associated with a security service, wherein the domain name associated with the security service is not included in the original resource identifier.

5. The method of claim 1 , wherein determining the corresponding alternative resource identifier includes determining a handle value corresponding to at least the original resource identifier and including the handle value in the corresponding alternative resource identifier.

6. The method of claim 5 , wherein determining the corresponding alternative resource identifier includes storing at least a portion of the context information associated with the electronic message in a database entry that corresponds to the handle value.

7. The method of claim 1 , wherein determining the corresponding alternative resource identifier includes encrypting at least the original resource identifier to generate an encrypted value and including the encrypted value in the corresponding alternative resource identifier.

8. The method of claim 7 , wherein the encrypted value is generated by encrypting the original resource identifier and at least a portion of the context information associated with the electronic message.

9. The method of claim 1 , wherein determining the corresponding alternative resource identifier includes determining a security classification associated with the electronic message and generating the corresponding alternative resource identifier based on the security classification associated with the electronic message.

10. The method of claim 1 , wherein the context information associated with the electronic message includes one or more of the following: an identifier of a sender of the electronic message, an identifier of the intended recipient of the electronic message, a classification or security risk analysis result associated with the sender of the electronic message, a classification or security risk analysis result associated with the intended recipient of the electronic message, a classification or security risk analysis result associated with message content of the electronic message, a classification or security risk analysis result associated with the original resource identifier, at least a portion of a metadata of the electronic message, or at least a portion of message content of the electronic message.

11. The method of claim 1 , wherein each resource identifier of a plurality of resource identifiers included in the electronic message has been replaced with a corresponding alternative resource identifier to generate the modified electronic message.

12. The method of claim 1 , wherein the modified electronic message includes an unmodified resource identifier.

13. The method of claim 1 , wherein in response to the request made using the alternative resource identifier in the modified message, the original resource identifier and the context information associated with the electronic message are obtained using at least a portion of the alternative resource identifier.

14. The method of claim 1 , wherein the security action includes determining that the security risk is below a threshold criterion, obtaining content referenced by the original resource identifier and providing the obtained content in response to the request made using the alternative resource identifier.

15. The method of claim 1 , wherein the security action includes determining that the security risk is below a threshold criterion and in response to the request made using the alternative resource identifier, providing a redirection response specifying the original resource identifier.

16. The method of claim 1 , wherein the security action includes determining that the security risk meets a threshold criteria and performing one or more of the following: blocking access to content referenced by the original resource identifier, providing a security warning in response to the request made using the alternative resource identifier, providing a modified version of the content referenced by the original resource identifier with modified functionality, or logging an event of the request made using the alternative resource identifier.

17. The method of claim 1 , wherein the security action is performed in response to determining that the security risk does not meets a first threshold criterion but meets a second threshold criterion.

18. A system, comprising:

a communication interface configured to receive information of an electronic message to be delivered to an intended recipient;

a processor coupled with the communication interface and configured to:

determine for an original resource identifier included in the electronic message, a corresponding alternative resource identifier, wherein the corresponding alternative resource identifier can be at least in part used to obtain the original resource identifier and obtain context information associated with the electronic message after allowing the intended recipient to access the corresponding alternative resource identifier;

replace the original resource identifier included in the electronic message with the alternative resource identifier to generate a modified electronic message; and

allow the modified electronic message with the alternative resource identifier to be delivered to the intended recipient instead of the electronic message with the original resource identifier, wherein a request made using the alternative resource identifier in the modified message triggers a security action based at least in part on the context information obtained using the alternative resource identifier and associated with the electronic message, and wherein in response to the request made using the alternative resource identifier in the modified message, a security risk associated with the original resource identifier is determined using the context information associated with the electronic message and content referenced by the original resource identifier.

19. The system of claim 18 , wherein the security action includes determining that the security risk is below a threshold criterion, obtaining content referenced by the original resource identifier and providing the obtained content in response to the request made using the alternative resource identifier.

20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving information of an electronic message to be delivered to an intended recipient;

determining for an original resource identifier included in the electronic message, a corresponding alternative resource identifier, wherein the corresponding alternative resource identifier can be at least in part used to obtain the original resource identifier and obtain context information associated with the electronic message after allowing the intended recipient to access the corresponding alternative resource identifier;

replacing the original resource identifier included in the electronic message with the alternative resource identifier to generate a modified electronic message; and

allowing the modified electronic message with the alternative resource identifier to be delivered to the intended recipient instead of the electronic message with the original resource identifier, wherein a request made using the alternative resource identifier in the modified message triggers a security action based at least in part on the context information obtained using the alternative resource identifier and associated with the electronic message, and wherein in response to the request made using the alternative resource identifier in the modified message, a security risk associated with the original resource identifier is determined using the context information associated with the electronic message and content referenced by the original resource identifier.