Synthetic request injection to improve object security posture for cloud security enforcement

1. A system for improving object security posture in cloud security environment, comprising:

one or more processor devices:

receive by a network security system from a client an incoming request to upload an object to a cloud application over an application session, wherein the uploaded object is subject to security policy enforcement by the network security system interposed between the client and the cloud application; and

generate from the network security system a synthetic request, upload the object to the cloud application, and inject the generated synthetic request into the application session, after uploading the object to the cloud application, to transmit the synthetic request to the cloud application, wherein the synthetic request is configured to modify an access posture of security setting on the uploaded object such that the synthetic request generated by the interposed network security system can change sharing setting on the uploaded object in dependence upon the policy enforcement.

2. The system of claim 1 , wherein the access posture includes sharing configurations of the uploaded object, wherein the synthetic request is further configured to modify the sharing configurations to prevent sharing of the uploaded object in dependence upon the policy enforcement.

3. The system of claim 1 , wherein the access posture includes sensitivity configurations of the uploaded object, wherein the synthetic request is further configured to modify the sensitivity configurations to set sensitivity status of the uploaded object as sensitive.

4. The system of claim 1 , further configured to:

receive from the client an incoming request to edit the object on the cloud application over the application session; and

generate the synthetic request, edit the object on the cloud application, and inject the synthetic request into the application session to transmit the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the edited object in dependence upon the policy enforcement.

5. The system of claim 1 , further configured to:

receive from the client an incoming request to download the object from the cloud application over the application session; and

generate the synthetic request, download the object from the cloud application, and inject the synthetic request into the application session to transmit the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the downloaded object in dependence upon the policy enforcement.

6. The system of claim 1 , further configured to:

receive from the client an incoming request to create the object on the cloud application over the application session; and

generate the synthetic request, create the object on the cloud application, and inject the synthetic request into the application session to transmit the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the created object in dependence upon the policy enforcement.

7. The system of claim 1 , further configured to:

receive from the client an incoming request to share the object on the cloud application over the application session; and

generate the synthetic request, share the object on the cloud application, and inject the synthetic request into the application session to transmit the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the shared object in dependence upon the policy enforcement.

8. The system of claim 1 , further configured to:

receive from the client an incoming request to move the object inside or outside the cloud application over the application session; and

generate the synthetic request, move the object inside or outside the cloud application, and inject the synthetic request into the application session to transmit the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the moved object in dependence upon the policy enforcement.

9. A computer-implemented method for improving object security posture in cloud security environment, including:

receiving from a client an incoming request by a network security system to upload an object to a cloud application over an application session, wherein the uploaded object is subject to security policy enforcement by the network security system interposed between clients and cloud applications; and

generating a synthetic request from the network security system, uploading the object to the cloud application, and injecting the generated synthetic request into the application session, after uploading the object to the cloud application, and transmitting the synthetic request to the cloud application, wherein the synthetic request is configured to modify an access posture of security setting on the uploaded object such that the synthetic request generated by the interposed network security system can change sharing setting on the uploaded object in dependence upon the policy enforcement.

10. The computer-implemented method of claim 9 , wherein the access posture includes sharing configurations of the uploaded object, wherein the synthetic request is further configured to modify the sharing configurations to prevent sharing of the uploaded object in dependence upon the policy enforcement.

11. The computer-implemented method of claim 9 , wherein the access posture includes sensitivity configurations of the uploaded object, wherein the synthetic request is further configured to modify the sensitivity configurations to set sensitivity status of the uploaded object as sensitive.

12. The computer-implemented method of claim 9 , further including:

receiving from the client an incoming request to edit the object on the cloud application over the application session; and

generating the synthetic request, editing the object on the cloud application, and injecting the synthetic request into the application session and transmitting the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the edited object in dependence upon the policy enforcement.

13. The computer-implemented method of claim 9 , further including:

receiving from the client an incoming request to download the object from the cloud application over the application session; and

generating the synthetic request, downloading the object from the cloud application, and injecting the synthetic request into the application session and transmitting the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the downloaded object in dependence upon the policy enforcement.

14. The computer-implemented method of claim 9 , further including:

receiving from the client an incoming request to create the object on the cloud application over the application session; and

generating the synthetic request, creating the object on the cloud application, and injecting the synthetic request into the application session and transmitting the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the created object in dependence upon the policy enforcement.

15. The computer-implemented method of claim 9 , further including:

receiving from the client an incoming request to share the object on the cloud application over the application session; and

generating the synthetic request, sharing the object on the cloud application, and injecting the synthetic request into the application session and transmitting the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the shared object in dependence upon the policy enforcement.

16. The computer-implemented method of claim 9 , further including:

receiving from the client an incoming request to move the object inside or outside the cloud application over the application session; and

generating the synthetic request, moving the object inside or outside the cloud application, and injecting the synthetic request into the application session and transmitting the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the moved object in dependence upon the policy enforcement.

17. A non-transitory computer readable storage medium having stored computer program instructions to enforce security policies, the instructions, when executed on a processor, implement a method for improving object security posture in cloud security environment, comprising:

receiving by a network security system from a client an incoming request to upload an object to a cloud application over an application session, wherein the uploaded object is subject to policy enforcement by the network security system interposed between clients and cloud applications; and

generating a synthetic request from the network security system, uploading the object to the cloud application, and injecting the generated synthetic request into the application session, after uploading the object to the cloud application, and transmitting the synthetic request to the cloud application, wherein the synthetic request is configured to modify an access posture of security setting on the uploaded object such that the synthetic request generated by the interposed network security system can change sharing setting on the uploaded object in dependence upon the policy enforcement.

18. The non-transitory computer readable storage medium of claim 17 , implementing the method further comprising:

receiving from the client an incoming request to edit the object on the cloud application over the application session; and

generating the synthetic request, editing the object on the cloud application, and injecting the synthetic request into the application session and transmitting the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the edited object in dependence upon the policy enforcement.

19. The non-transitory computer readable storage medium of claim 17 , implementing the method further comprising:

receiving from the client an incoming request to download the object from the cloud application over the application session; and

generating the synthetic request, downloading the object from the cloud application, and injecting the synthetic request into the application session and transmitting the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the downloaded object in dependence upon the policy enforcement.

20. The non-transitory computer readable storage medium of claim 17 , implementing the method further comprising:

receiving from the client an incoming request to create the object on the cloud application over the application session; and

generating the synthetic request, creating the object on the cloud application, and injecting the synthetic request into the application session and transmitting the synthetic request to the cloud application, wherein the synthetic request is configured to modify the access posture of the created object in dependence upon the policy enforcement.