Cloud security policy enforcement for custom web applications
A cloud security method implement web security at the application level by monitoring network traffic and detecting cloud activities related to web applications, and then classifying the detected cloud activities to map certain security-related cloud activities into activity categories to enable security policy to be applied. The application-level cloud security method enables policy enforcement rules to be established for cloud activity categories. The security policies are then applied based on activity categories.
1 . A method of implementing cloud security policy enforcement for web applications being used by an enterprise, the method comprising:
classifying, using at least one hardware processor, security-related application activities relating to a web application into at least a first group of application activities, wherein a first portion of the security-related application activities are classified into the first group of application activities, wherein the first portion of the security-related application activities being classified into the first group of application activities indicates that the corresponding first portion of the security-related application activities cannot be mapped to any of a plurality of activity categories and that the corresponding first portion of the security-related application activities does not involve only viewing static resources of the web application; and
generating an alert in response to an application activity being classified into the first group, wherein the alert indicates that the application activity should be reviewed by a human and that the plurality of activity categories may need to be updated to include the application activity,
wherein the plurality of activity categories include at least two of administration, data access, data download, data updates, external data sharing, login success, report execution, service usage, user account creation, and user account deletion.
2 . The method of claim 1 , further comprising:
classifying, using at least one hardware processor, the security-related application activities relating to the web application into at least a second group of application activities, wherein a second portion of the security-related application activities is classified into the second group of application activities, wherein being classified into the second group of application activities indicates that corresponding application activities are each to be mapped to one of the plurality of activity categories; and
for each application activity of the second portion of the security-related application activities relating to the web application:
mapping the application activity to one of the plurality of activity categories based on a signature of the application activity;
associating a corresponding set of one or more security enforcement policies of the mapped activity category to the application activity; and
applying the corresponding set of one or more security enforcement policies to network traffic corresponding to the application activity based on the application activity being mapped to the mapped activity category;
generating metadata containing information indicative of the application activity, the web application, and the mapped activity category for the application activity; and
generating the corresponding set one or more of security enforcement policies for the application activity using the metadata.
3 . The method of claim 2 , wherein the corresponding set of one or more security enforcement policies of at least one application activity of the second portion of the security-related application activities relating to the web application includes security policies for threat detection, data encryption, data loss prevention, and access control.
4 . The method of claim 2 , wherein a first application activity of the second portion of the security-related application activities is mapped to a first activity category, the method further comprising:
tagging at least one data field in the first application activity; and
associating a first security enforcement policy of the first activity category to the first application activity, the first security enforcement policy comprising encrypting data in the tagged data fields associated with the first application activity.
5 . The method of claim 1 , further comprising:
classifying, using at least one hardware processor, the security-related application activities relating to the web application into at least a third group of application activities, wherein a third portion of the security-related application activities are classified into the third group of application activities, wherein being classified into the third group of application activities indicates that corresponding application activities are each to be ignored.
6 . The method of claim 1 , wherein the at least one hardware processor implements a containerized cloud security reverse proxy embedded in a containerized web application to monitor network traffic to and from the enterprise, the containerized web application being configured in an application container.
7 . The method of claim 6 , further comprising:
embedding the containerized cloud security reverse proxy into the application container containing the containerized web application by accessing an application programming interface (API) of the application container to generate a reverse proxy configuration.
8 . A system for implementing cloud security policy enforcement for web applications being used by an enterprise, the system comprising:
at least one hardware processor; and
a memory coupled with the at least one hardware processor, wherein the memory is configured to provide the at least one hardware processor with instructions which when executed cause the at least one hardware processor to:
classify security-related application activities relating to a web application into at least a first group of application activities, wherein a first portion of the security-related application activities are classified into the first group of application activities, wherein the first portion of the security-related application activities being classified into the first group of application activities indicates that the corresponding first portion of the security-related application activities cannot be mapped to any of a plurality of activity categories and that the corresponding first portion of the security-related application activities does not involve only viewing static resources of the web application; and
generate an alert in response to an application activity being classified into the third group, wherein the alert indicates that the application activity should be reviewed by a human and that the plurality of activity categories may need to be updated to include the application activity,
wherein the plurality of activity categories include at least two of administration, data access, data download, data updates, external data sharing, login success, report execution, service usage, user account creation, and user account deletion.
9 . The system recited in claim 8 , wherein the memory is further configured to provide the at least one hardware processor with instructions which when executed cause the at least one hardware processor to:
classify the security-related application activities relating to the web application into at least a second group of application activities, wherein a second portion of the security-related application activities is classified into the second group of application activities, wherein being classified into the second group of application activities indicates that corresponding application activities are each to be mapped to one of the plurality of activity categories; and
for each application activity of the second portion of the security-related application activities relating to the web application:
map the application activity to one of the plurality of activity categories based on a signature of the application activity;
associate a corresponding set of one or more security enforcement policies of the mapped activity category to the application activity;
apply the corresponding set of one or more security enforcement policies to network traffic corresponding to the application activity based on the application activity being mapped to the mapped activity category;
generate metadata containing information indicative of the application activity, the web application, and the mapped activity category for the application activity; and
generate the corresponding set of one or more security enforcement policies for the application activity using the metadata.
10 . The system recited in claim 9 , wherein the corresponding set of one or more security enforcement policies of at least one application activity of the second portion of the security-related application activities relating to the web application includes security policies for threat detection, data encryption, data loss prevention, and access control.
11 . The system recited in claim 9 , wherein a first application activity of the second portion of the security-related application activities is mapped to a first activity category, and wherein the memory is further configured to provide the at least one hardware processor with instructions which when executed cause the at least one hardware processor to:
tag at least one data field in the first application activity; and
associate a first security enforcement policy of the first activity category to the first application activity, the first security enforcement policy comprising encrypting data in the tagged data fields associated with the first application activity.
12 . The system recited in claim 8 , wherein the memory is further configured to provide the at least one hardware processor with instructions which when executed cause the at least one hardware processor to:
classify the security-related application activities relating to the web application into at least a third group of application activities, wherein a third portion of the security-related application activities are classified into the third group of application activities, wherein being classified into the third group of application activities indicates that corresponding application activities are each to be ignored.
13 . The system recited in claim 8 , wherein the memory is further configured to provide the at least one hardware processor with instructions which when executed cause the at least one hardware processor to:
provide a containerized cloud security reverse proxy embedded in a containerized web application to monitor network traffic to and from the enterprise, the containerized web application being configured in an application container.
14 . The system recited in claim 13 , wherein the memory is further configured to provide the at least one hardware processor with instructions which when executed cause the at least one hardware processor to:
embed the containerized cloud security reverse proxy into the application container containing the containerized web application by accessing an application programming interface (API) of the application container to generate a reverse proxy configuration.
15 . A non-transitory computer-readable medium containing computer executable instructions that, when executed by at least one processor, cause the at least one processor to perform a method for implementing cloud security policy enforcement for web applications being used by an enterprise, the method comprising:
classifying security-related application activities relating to a web application into at least a first group of application activities, wherein a first portion of the security-related application activities are classified into the first group of application activities, wherein the first portion of the security-related application activities being classified into the first group of application activities indicates that the corresponding first portion of the security-related application activities cannot be mapped to any of a plurality of activity categories and that the corresponding first portion of the security-related application activities does not involve only viewing static resources of the web application; and
generating an alert in response to an application activity being classified into the third group, wherein the alert indicates that the application activity should be reviewed by a human and that the plurality of activity categories may need to be updated to include the application activity,
wherein the plurality of activity categories include at least two of administration, data access, data download, data updates, external data sharing, login success, report execution, service usage, user account creation, and user account deletion.
16 . The non-transitory computer-readable medium of claim 15 , wherein the method further comprises:
classifying the security-related application activities relating to the web application into at least a second group of application activities, wherein a second portion of the security-related application activities is classified into the second group of application activities, wherein being classified into the second group of application activities indicates that corresponding application activities are each to be mapped to one of the plurality of activity categories; and
for each application activity of the second portion of the security-related application activities relating to the web application:
mapping the application activity to one of the plurality of activity categories based on a signature of the application activity;
associating a corresponding set of one or more security enforcement policies of the mapped activity category to the application activity; and
applying the corresponding set of one or more security enforcement policies to network traffic corresponding to the application activity based on the application activity being mapped to the mapped activity category;
generating metadata containing information indicative of the application activity, the web application, and the mapped activity category for the application activity; and
generating the corresponding set of one or more security enforcement policies for the application activity using the metadata.
17 . The non-transitory computer-readable medium of claim 16 , wherein the corresponding set of one or more security enforcement policies of at least one application activity of the second portion of the security-related application activities relating to the web application includes security policies for threat detection, data encryption, data loss prevention, and access control.
18 . The non-transitory computer-readable medium of claim 16 , wherein a first application activity of the second portion of the security-related application activities is mapped to a first activity category, and wherein the method further comprises:
tagging at least one data field in the first application activity; and
associating a first security enforcement policy of the first activity category to the first application activity, the first security enforcement policy comprising encrypting data in the tagged data fields associated with the first application activity.
19 . The non-transitory computer-readable medium of claim 15 , wherein the method further comprises:
classifying the security-related application activities relating to the web application into at least a third group of application activities, wherein a third portion of the security-related application activities are classified into the third group of application activities, wherein being classified into the third group of application activities indicates that corresponding application activities are each to be ignored.
20 . The non-transitory computer-readable medium of claim 15 , wherein the method further comprises:
providing a containerized cloud security reverse proxy embedded in a containerized web application to monitor network traffic to and from the enterprise, the containerized web application being configured in an application container.
21 . The non-transitory computer-readable medium of claim 20 , wherein the method further comprises:
embedding the containerized cloud security reverse proxy into the application container containing the containerized web application by accessing an application programming interface (API) of the application container to generate a reverse proxy configuration.