Systems and methods for protecting users
The disclosed computer-implemented method for protecting users may include (i) intercepting, through a cloud-based security proxy service, network traffic originating from a mobile application at a mobile device connected to a local area network protected by the cloud-based security proxy service, (ii) detecting, by the cloud-based security proxy service, a threat indicator indicated by the mobile application, and (iii) modifying the network traffic originating from the mobile application at the mobile device by applying, by the cloud-based security proxy service based on detecting the threat indicator indicated by the mobile application, a security policy to protect the local area network from a candidate threat corresponding to the threat indicator. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for protecting users, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
intercepting, through a cloud-based security proxy service, network traffic originating from a mobile application at a mobile device connected to a local area network protected by the cloud-based security proxy service;
detecting, by the cloud-based security proxy service, a threat indicator indicated by the mobile application; and
modifying the network traffic originating from the mobile application at the mobile device by applying, by the cloud-based security proxy service based on detecting the threat indicator indicated by the mobile application, a security policy to protect the local area network from a candidate threat corresponding to the threat indicator;
wherein:
the mobile application effectively executes within a cloud-network-based sandbox and the mobile application lacks awareness of the cloud-network-based sandbox;
the method further comprises detecting, through the cloud-based security proxy service, that the mobile application is executing on the mobile device and, in response, the cloud-based security proxy service further provides information indicating a risk category for the mobile application back to the mobile device through a security-centric mobile application locally installed on the mobile device; and
the cloud-based security proxy service is implemented through an overlay network within a publicly available on-demand cloud computing platform.
2. The computer-implemented method of claim 1 , further comprising providing to a monitoring computing device real time visibility into the network traffic originating from the mobile application of the mobile device.
3. The computer-implemented method of claim 2 , wherein providing the real time visibility into the network traffic comprises displaying, within a graphical user interface, an indication of activity by the mobile application at the mobile device.
4. The computer-implemented method of claim 1 , wherein intercepting the network traffic originating from the mobile application of the mobile device is performed through the cloud-based security proxy service rather than intercepting the network traffic at the mobile device.
5. The computer-implemented method of claim 1 , wherein the risk category comprises a high risk category, a medium risk category, or a low risk category.
6. The computer-implemented method of claim 1 , wherein detecting the threat indicator indicated by the mobile application comprises performing a behavioral analysis of behavior by the mobile application.
7. The computer-implemented method of claim 1 , wherein modifying the network traffic is performed at least partially randomly.
8. The computer-implemented method of claim 1 , wherein modifying the network traffic comprises replacing at least a portion of the network traffic with decoy network traffic.
9. The computer-implemented method of claim 8 , wherein replacing the portion of the network traffic with decoy network traffic comprises scrambling a location of the mobile device.
10. The computer-implemented method of claim 8 , wherein replacing the portion of the network traffic with decoy network traffic comprises modifying a contact list resulting in a decoy contact list.
11. A system for protecting users, the system comprising:
an interception module, stored in memory, that intercepts, through a cloud-based security proxy service, network traffic originating from a mobile application at a mobile device connected to a local area network protected by the cloud-based security proxy service;
a detection module, stored in memory, that detects, as part of the cloud-based security proxy service, a threat indicator indicated by the mobile application;
a modification module, stored in memory, that modifies the network traffic originating from the mobile application at the mobile device by applying, as part of the cloud-based security proxy service based on detecting the threat indicator indicated by the mobile application, a security policy to protect the local area network from a candidate threat corresponding to the threat indicator; and
at least one physical processor configured to execute the interception module, the detection module, and the modification module;
wherein:
the mobile application is configured to effectively execute within a cloud-network-based sandbox and the mobile application lacks awareness of the cloud-network-based sandbox;
the cloud-based security proxy service is configured to detect that the mobile application is executing on the mobile device and, in response, the cloud-based security proxy service further configured to provide information indicating a risk category for the mobile application back to the mobile device through a security-centric mobile application locally installed on the mobile device; and
the cloud-based security proxy service is implemented through an overlay network within a publicly available on-demand cloud computing platform.
12. The system of claim 11 , wherein the modification module is configured to further provide to a monitoring computing device real time visibility into the network traffic originating from the mobile application of the mobile device.
13. The system of claim 12 , wherein the modification module is configured to provide the real time visibility into the network traffic at least in part by displaying, within a graphical user interface, an indication of activity by the mobile application at the mobile device.
14. The system of claim 11 , wherein the interception module is configured to intercept the network traffic originating from the mobile application of the mobile device at least in part through the cloud-based security proxy service rather than intercepting the network traffic at the mobile device.
15. The system of claim 11 , wherein the risk category comprises a high risk category, a medium risk category, or a low risk category.
16. The system of claim 11 , wherein the detection module is configured to detect the threat indicator indicated by the mobile application at least in part by performing a behavioral analysis of behavior by the mobile application.
17. The system of claim 11 , wherein the modification module is configured to perform the modifying of the network traffic at least partially randomly.
18. The system of claim 11 , wherein the modification module is configured to modify the network traffic at least in part by replacing at least a portion of the network traffic with decoy network traffic.
19. The system of claim 18 , wherein the modification module is configured to replace the portion of the network traffic with decoy network traffic at least in part by scrambling a location of the mobile device.
20. A non-transitory computer-readable medium encoded with computer-executable instructions that, when executed by a physical processor of a computing device, cause the computing device to perform a method comprising:
intercepting, through a cloud-based security proxy service, network traffic originating from a mobile application at a mobile device connected to a local area network protected by the cloud-based security proxy service;
detecting, by the cloud-based security proxy service, a threat indicator indicated by the mobile application; and
modifying the network traffic originating from the mobile application at the mobile device by applying, by the cloud-based security proxy service based on detecting the threat indicator indicated by the mobile application, a security policy to protect the local area network from a candidate threat corresponding to the threat indicator;
wherein:
the mobile application effectively executes within a cloud-network-based sandbox and the mobile application lacks awareness of the cloud-network-based sandbox;
the method further comprises detecting, through the cloud-based security proxy service, that the mobile application is executing on the mobile device and, in response, the cloud-based security proxy service further provides information indicating a risk category for the mobile application back to the mobile device through a security-centric mobile application locally installed on the mobile device; and
the cloud-based security proxy service is implemented through an overlay network within a publicly available on-demand cloud computing platform.