Dynamic injection or modification of headers to provide intelligence
A method, system, and computer-usable medium are disclosed for receiving a response, by a security management system, from a site external to an internal network comprising the security management system to an endpoint device of the internal network, and injecting a header into the response by the security management system, the header including security rules, such that when the response is communicated to the endpoint device, the endpoint device responds to the security management system with information regarding subsequent requests made by the endpoint device in connection with the response.
1. A computer-implemented method for dynamic injection of security headers comprising:
a security management system receiving a response from a site external to an internal network that comprises the security management system, wherein the response was sent to an endpoint device of the internal network; and
the security management system injecting header information into the response, the injected header information including security rules that comprise non-blocking, report-only security rules, such that the injected header is configured not to block connections violating the security rules but to send violation reports to a uniform resource locator (URL) of the security management system upon subsequent requests made by the endpoint device in connection with the response.
2. The method of claim 1 , wherein the header information comprises a Content Security Policy header.
3. The method of claim 1 , further comprising, responsive to receipt of the information regarding subsequent requests made by the endpoint device in connection with the response:
determining which of the connections are potentially malicious; and
taking remedial action with respect to the connections which are potentially malicious.
4. The method of claim 3 , wherein determining which of the connections are potentially malicious comprises determining which of the connections are to a host on the internal network.
5. The method of claim 1 , further comprising, responsive to receipt of the information regarding subsequent requests made by the endpoint device in connection with the response, performing a session-based recording of an association of activities of a website associated with the response.
6. The method of claim 1 , further comprising, responsive to receipt of the information regarding subsequent requests made by the endpoint device in connection with the response, performing one or more of:
correlating actions associated with the response and corresponding consequences associated with the response;
distinguishing between normal activity and abnormal activity of a website associated with the response; and
differentiating activity initiated by bots and malware from activity initiated by a human user.
7. A system for dynamic injection of security headers comprising:
a hardware processor; and
a non-transitory, computer-readable storage medium comprising instructions executable by the hardware processor and configured for:
receiving a response, by a security management system, from a site external to an internal network that comprises the security management system, wherein the response was sent to an endpoint device of the internal network; and
injecting header information into the response by the security management system, the injected header information including security rules that comprise non-blocking, report-only security rules, such that the injected header is configured not to block connections violating the security rules but to send violation reports to a uniform resource locator (URL) of the security management system upon subsequent requests made by the endpoint device in connection with the response.
8. The system of claim 7 , wherein the header information comprises a Content Security Policy header.
9. The system of claim 7 , the instructions further configured for, responsive to receipt of the information regarding subsequent requests made by the endpoint device in connection with the response:
determining which of the connections are potentially malicious; and
taking remedial action with respect to the connections which are potentially malicious.
10. The system of claim 9 , wherein determining which of the connections are potentially malicious comprises determining which of the connections are to a host on the internal network.
11. The system of claim 7 , the instructions further configured for, responsive to receipt of the information regarding subsequent requests made by the endpoint device in connection with the response, performing a session-based recording of an association of activities of a website associated with the response.
12. The system of claim 7 , the instructions further configured for, responsive to receipt of the information regarding subsequent requests made by the endpoint device in connection with the response, performing one or more of:
correlating actions associated with the response and corresponding consequences associated with the response;
distinguishing between normal activity and abnormal activity of a website associated with the response; and
differentiating activity initiated by bots and malware from activity initiated by a human user.
13. An article of manufacture for dynamic injection of security headers comprising a non-transitory, computer-readable medium embodying computer-executable instructions configured for:
receiving a response, by a security management system, from a site external to an internal network that comprises the security management system, wherein the response was sent to an endpoint device of the internal network; and
injecting header information into the response by the security management system, the injected header information including security rules that comprise non-blocking, report-only security rules, such that the injected header is configured not to block connections violating the security rules but to send violation reports to a uniform resource locator (URL) of the security management system upon subsequent requests made by the endpoint device in connection with the response.
14. The article of claim 13 , wherein the header information comprises a Content Security Policy header.
15. The article of claim 13 , the instructions further configured for, responsive to receipt of the information regarding subsequent requests made by the endpoint device in connection with the response:
determining which of the connections are potentially malicious; and
taking remedial action with respect to the connections which are potentially malicious.
16. The article of claim 15 , wherein determining which of the connections are potentially malicious comprises determining which of the connections are to a host on the internal network.
17. The article of claim 13 , the instructions further configured for, responsive to receipt of the information regarding subsequent requests made by the endpoint device in connection with the response, performing a session-based recording of an association of activities of a website associated with the response.
18. The article of claim 13 , the instructions further configured for, responsive to receipt of the information regarding subsequent requests made by the endpoint device in connection with the response, performing one or more of:
correlating actions associated with the response and corresponding consequences associated with the response;
distinguishing between normal activity and abnormal activity of a website associated with the response; and
differentiating activity initiated by bots and malware from activity initiated by a human user.