Systems and methods for protecting a cloud computing device from malware

1. A computer-implemented method for protecting a cloud computing device from malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

intercepting, at the computing device and using a file filter driver, a malicious attempt by the malware to:

access sensitive information in an encrypted file stored on the computing device; and

send the sensitive information to the cloud computing device; and

performing, at the computing device and responsive to the attempt to access the encrypted file, a first security action comprising:

performing multifactor authentication responsive to the attempt to access the encrypted file;

performing file integrity monitoring on the encrypted file to identify a change to credentials required to access the encrypted file;

maintaining the encrypted file as encrypted in response to less than two authentication factors being validated;

determining a time at which the attempt to access the encrypted file occurs;

performing user and entity behavior analytics to identify an abnormal file access pattern; and

performing a second security action when at least one of:

the multifactor authentication fails:

the file integrity monitoring identifies an unauthorized change to the credentials required to access the encrypted file;

the attempt to access the encrypted file occurs outside of a predetermined schedule;

or user and entity behavior analytics identifies the abnormal file, access pattern, wherein the second security action comprises: allowing access to the encrypted file based on a respective download rate.

2. The computer-implemented method of claim 1 , wherein the sensitive information comprises a login credential.

3. The computer-implemented method of claim 2 , wherein the login credential comprises at least one of a secure shell key, a password, and a token.

4. The computer-implemented method of claim 1 , wherein the sensitive information comprises a privacy-enhanced mail file.

5. The computer-implemented method of claim 1 , wherein the sensitive information comprises a financial account number.

6. The computer-implemented method of claim 5 , wherein the financial account number comprises at least one of a credit card number and a bank account number.

7. The computer-implemented method of claim 1 , further comprising logging the attempt to access the encrypted file.

8. The computer-implemented method of claim 1 , wherein performing multifactor authentication comprises authenticating at least two of a password, a personal identification number, a smart card, a token, biometric information, and challenge response information.

9. The computer-implemented method of claim 1 , further comprising saving the encrypted file on a storage device of the computing device when the file integrity monitoring indicates the encrypted file is changed relative to a prior version of the encrypted file.

10. The computer-implemented method of claim 1 , wherein the second security action comprises at least one of:

further encrypting the encrypted file;

denying access to the encrypted file;

blocking access to the encrypted file; and

conditionally allowing access to the encrypted file.

11. The computer-implemented method of claim 10 , wherein conditionally allowing access to the encrypted file comprises:

allowing access to the encrypted file based on compliance of the computing device with a policy.

12. The computer-implemented method of claim 1 , wherein the second security action comprises displaying, on a user display, an indication of an act performed as a part of the second security action.

13. A system for protecting a cloud computing device from malware, the system comprising:

at least one physical processor; and

physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:

intercept, at the system and using a file filter driver, a malicious attempt by the malware to:

access sensitive information in an encrypted file stored on the system; and send the sensitive information to the cloud computing device; and

perform, at the system and responsive to the attempt to access the encrypted file, a first security action comprising: performing multifactor authentication responsive to the attempt to access the encrypted file;

performing file integrity monitoring on the encrypted file to identify a change to credentials required to access the encrypted file;

maintaining the encrypted file as encrypted in response to less than two authentication factors being validated;

determining a time at which the attempt to access the encrypted file occurs,

performing user and entity behavior analytics to identify an abnormal file access pattern; and

performing a second security action when at least one of the multifactor authentication fails;

the file integrity monitoring identifies an unauthorized change to the credentials required to access the encrypted file;

the attempt to access the encrypted file occurs outside of a predetermined schedule;

or user and entity behavior analytics identifies the abnormal file access pattern, wherein the second security action comprises: allowing access to the encrypted file based on a respective download rate.

14. The system of claim 13 , wherein the performing multifactor authentication comprises authenticating at least two of a password, a personal identification number, a smart card, a token, biometric information, and challenge response information.

15. The system of claim 13 , wherein the computer-executable instructions further comprise computer-executable instructions that, when executed by the physical processor, cause the physical processor to save the encrypted file on a storage device of the system when the file integrity monitoring indicates the encrypted file is changed relative to a prior version of the encrypted file.

16. The system of claim 13 , wherein the second security action comprises at least one of:

further encrypting the encrypted file;

denying access to the encrypted file;

blocking access to the encrypted file; and

conditionally allowing access to the encrypted file.

17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

intercept, at the computing device and usurp a file filter driver, a malicious attempt by the malware to:

access sensitive information in an encrypted file stored on the computing device; and

send the sensitive information to the cloud computing device; and perform, at the computing device and responsive to the attempt to access the encrypted file, a first security action comprising:

performing multifactor authentication responsive to the attempt to access the encrypted file;

performing file integrity monitoring on the encrypted file to identify a change to credentials required to access the encrypted file;

maintaining the encrypted file as encrypted in response to less than two authentication factors being validated;

determining a time at which the attempt to access the encrypted file occurs;

performing user and entity behavior analytics to identify an abnormal file access pattern; and

performing a second security action when at least one of: the multifactor authentication fails;

the file integrity monitoring identifies an unauthorized change to the credentials required to access the encrypted file;

the attempt to access the encrypted file occurs outside of a predetermined schedule;

or user and

entity behavior analytics identifies the abnormal file access pattern; wherein the second security action comprises: allowing access to the encrypted file based on a respective download rate.

18. The non-transitory computer-readable medium of claim 17 , wherein the performing multifactor authentication comprises authenticating at least two of a password, a personal identification number, a smart card, a token, biometric information, and challenge response information.

19. The non-transitory computer-readable medium of claim 17 , wherein the one or more computer-executable instructions further comprise one or more computer-executable instructions that, when executed by at least one processor of the computing device, cause the computing device to save the encrypted file on a storage device of the computing device when the file integrity monitoring indicates the encrypted file is changed relative to a prior version of the encrypted file.

20. The non-transitory computer-readable medium of claim 17 , wherein the second security action comprises at least one of:

further encrypting the encrypted file;

denying access to the encrypted file;

blocking access to the encrypted file; and

conditionally allowing access to the encrypted file.