Network-aware endpoint data loss prevention for web transactions
Methods for network aware endpoint data loss prevention (DLP) in web transactions are performed by systems and devices, which includes implementing DLP on endpoint devices and focuses on web traffic events from web browsers, while also associating the events to the network source entity. File download and upload events are intercepted from the operating system by a file system filter that determines the process creating events is a web browser based on process identifiers and comparing process names and process executable signatures. A uniform resource locator (URL) from a current tab or session is retrieved for the web browser. Policies for events are evaluated via a policy server or via cache, and additional data from the file is provided for policy decisions when necessary. DLP actions taken via the file system filter to block or allow events, including encrypting file data, are based on the policy decisions.
1. A method performed by a file system filter of a computing device, the method comprising:
intercepting, by the file system filter, a request to read from or write to a file, the request comprising a process identifier identifying a process executing on the computing device;
determining, based on the process identifier, that the process is an instance of a web browser application;
retrieving a uniform resource locator (URL) corresponding to the request; and
performing a data loss prevention (DLP) action against the request based at least on the URL and an identifier of the file.
2. The method of claim 1 , wherein said determining, based on the process identifier, that the process is an instance of a web browser application comprises:
determining, based on the process identifier, an executable path for the process;
identifying, based at least on the executable path, a hash value and a certificate associated with the process; and
comparing the hash value and the certificate associated with the process to a browser certificate and hash value associated with the web browser application.
3. The method of claim 1 , wherein said retrieving the URL comprises at least one of:
reading a current session file of the web browser application and retrieving the URL therefrom;
querying the web browser application for one or more open instances thereof via an application programming interface; or
reading the URL from an operating system-level metadata file that comprises origin information of download files.
4. The method of claim 1 , further comprising:
providing the URL and the file identifier to a policy server configured to evaluate DLP policies; and
receiving, from the policy server, an indication of the DLP action to be performed.
5. The method of claim 4 , further comprising:
receiving, from the policy server, a request for additional information; and
providing at least a portion of the file associated with the request to the policy server.
6. The method of claim 5 , wherein the request is a request to write to the file; and
wherein said providing the at least a portion of the file comprises:
enabling the instance of the web browser application to initiate a download of the file; and
buffering the at least a portion of the file during the download for providing to the policy server, while preventing the at least a portion of the file from being saved to a persistent storage at the computing device.
7. The method of claim 1 , wherein the DLP action comprises at least one of:
allowing the request to complete;
blocking the request from completion;
encrypting data of the file associated with the request; or
releasing a buffer that stores at least a portion of the file associated with the request.
8. The method of claim 2 , wherein said determining, based on the process identifier, an executable path for the process comprises:
querying, based on the process identifier, a process list for the execution path.
9. A computing system, comprising:
a processor; and
a memory that stores program code structured to cause the processor to:
intercept a request to read from or write to a file, the request comprising a process identifier identifying a process executing on the computing device;
determine, based on the process identifier, that the process is an instance of a web browser application;
retrieve a uniform resource locator (URL) corresponding to the request; and
perform a data loss prevention (DLP) action against the request based at least on the URL and an identifier of the file.
10. The computing system of claim 9 , wherein, to determine, based on the process identifier, that the process is an instance of a web browser application, the program code causes the processor to:
determine, based on the process identifier, an executable path for the process;
identify, based at least on the executable path, a hash value and a certificate associated with the process; and
compare the hash value and the certificate associated with the process to a browser certificate and a hash value associated with the web browser application.
11. The computing system of claim 9 , wherein, to retrieve the URL corresponding to the request, the program code is structured to cause the processor to perform at least one of:
read a current session file of the web browser application and retrieving the URL therefrom;
query the web browser application for one or more open instances thereof via an application programming interface; or
read the URL from an operating system-level metadata file that comprises origin information of download files.
12. The computing system of claim 9 , wherein the program code is structured to further cause the processor to:
provide the URL and the file identifier to a policy server that is configured to evaluate DLP policies; and
receive, from the policy server, an indication of the DLP action to be performed.
13. The computing system of claim 12 , wherein the program code is structured to further cause the processor to:
receive, from the policy server, a request for additional information; and
provide at least a portion of the file associated with the request to the policy server.
14. The computing system of claim 13 , wherein the request is a request to write to the file; and
wherein, to provide the at least a portion of the file, the program code is structured to cause the processor to:
enable the instance of the web browser application to initiate a download of the file; and
buffer the at least a portion of the file during the download for providing to the policy server, while preventing the at least a portion of the file from being saved to a persistent storage at the computing device.
15. The computing system of claim 9 , wherein, to perform the DLP action, the program code is structured to cause the processor to perform at least one of to:
allow the request to complete;
block the request from completion;
encrypt data of the file associated with the request; or
release a buffer that stores at least a portion of the file associated with the request.
16. A computer-readable storage medium comprising program instructions recorded thereon that, when executed by a processor, cause the processor to:
intercept a request to read from or write to a file, the request comprising a process identifier identifying a process executing on the computing device;
determine a process, based on the process identifier, that the process is an instance of a web browser application;
retrieve a uniform resource locator (URL) corresponding to the request; and
perform a data loss prevention (DLP) action against the request based at least on the URL and an identifier of the file.
17. The computer-readable storage medium of claim 16 , wherein, to determine, based on the process identifier, that the process is an instance of a web browser application, the program instructions, when executed by the processor, cause the processor to:
determine, based on the process identifier, an executable path for the process;
identify, based at least on the executable path, a hash value and a certificate associated with the process; and
compare the hash value and the certificate associated with the process to a browser certificate and a hash value associated with the web browser application.
18. The computer-readable storage medium of claim 16 , wherein, to perform the DLP action, the program instructions, when executed by the processor, cause the processor to perform at least one of:
allow the request to complete;
block the request from completion;
encrypt data of the file associated with the request; or
release a buffer that stores at least a portion of the file associated with the request.
19. The computer-readable storage medium of claim 16 , wherein, to retrieve the URL, the program instructions, when executed by the processor, cause the processor to perform at least one of:
read a current session file of the web browser application and retrieving the URL therefrom;
query the web browser application for one or more open instances thereof via an application programming interface; or
read the URL from an operating system-level metadata file that comprises origin information of download files.
20. The computer-readable storage medium of claim 16 , wherein the request is a request to write to the file; and
wherein, to perform the DLP action, the program instructions, when executed by the processor, cause the processor to:
provide the URL and the file identifier to a policy server configured to evaluate DLP policies;
receive, from the policy server, a request for additional information;
provide at least a portion of the file associated with the event to the policy server by:
enabling the instance of the web browser application to initiate a download of the file, and
buffering the at least a portion of the file during the download for providing to the policy server, while preventing the at least a portion of the file from being saved to a persistent storage at the computing device; and
receive, from the policy server, an indication of the DLP action to be performed.