Cloud ransomware protection
A newly created or modified object is sent to a networked local or remote server for analysis. While the object is being analyzed for vulnerabilities, the object is locked and made inaccessible to users, devices, and networks. If the object is identified as malicious, it may be marked for review, deleted, placed in quarantine, or have its permissions changed so that it cannot cause harm by propagating through the environment. Conversely, if the object is identified as safe, the risk of ransomware attacks may also be mitigated by replicating the object across multiple cloud storage platforms.
1 . A non-transitory computer-readable medium including stored instructions, the instructions, when executed by a computing system, causing the computing system to perform operations comprising:
obtaining scan results indicating a cloud storage object from a cloud storage platform is safe;
obtaining attributes of the cloud storage object;
determining, based on the attributes of the cloud storage object, to secure the cloud storage object against ransomware attacks, wherein determining to secure the cloud storage object against ransomware attacks comprises:
calculating a significance score of the cloud storage object using the attributes of the cloud storage object;
comparing the significance score to a threshold; and
determining to secure the cloud storage object against ransomware attacks responsive to the significance score exceeding the threshold; and
responsive to determining to secure the cloud storage object, replicating the cloud storage object to one or more additional cloud storage platforms.
2 . The non-transitory computer-readable medium of claim 1 , wherein obtaining the scan results comprises:
downloading a copy of the cloud storage object from the cloud storage platform; and
scanning the copy of the cloud storage object using a platform-agnostic scanner to generate the scan results.
3 . The non-transitory computer-readable medium of claim 1 , wherein the attributes of the cloud storage object include one or more of a size, frequency of access, total number of accesses, time since last use, frequency of edits, source, or storage location.
4 . The non-transitory computer-readable medium of claim 1 , wherein determining to secure the cloud storage object against ransomware attacks comprises:
classifying the cloud storage object into a significance category of a plurality of significance categories using the attributes of the cloud storage object; and
determining to secure the cloud storage object against ransomware attacks based on the significance category.
5 . The non-transitory computer-readable medium of claim 4 , wherein the cloud storage object is replicated to a greater number of additional cloud storage platforms than a second cloud storage object that is classified into a lower significance category than the significance category of the cloud storage object.
6 . The non-transitory computer-readable medium of claim 1 , wherein replicating the cloud storage object to one or more additional cloud storage platforms comprises storing a copy of the cloud storage object in all available cloud storage platforms.
7 . The non-transitory computer-readable medium of claim 1 , wherein the operations further comprise:
receiving, from the cloud storage platform, an event identifying the cloud storage object;
determining, using the event, to scan the cloud storage object;
responsive to determining to scan the cloud storage object, downloading a copy of the cloud storage object from the cloud storage platform;
scanning the copy of the cloud storage object using a platform-agnostic scanner to generate the scan results; and
providing instructions to the cloud storage platform to unlock the cloud storage object responsive to the scan results indicating that the cloud storage object is safe.
8 . A method comprising:
obtaining scan results indicating a cloud storage object from a cloud storage platform is safe;
obtaining attributes of the cloud storage object;
determining, based on the attributes of the cloud storage object, to secure the cloud storage object against ransomware attacks, wherein determining to secure the cloud storage object against ransomware attacks comprises:
calculating a significance score of the cloud storage object using the attributes of the cloud storage object;
comparing the significance score to a threshold; and
determining to secure the cloud storage object against ransomware attacks responsive to the significance score exceeding the threshold; and
responsive to determining to secure the cloud storage object, replicating the cloud storage object to one or more additional cloud storage platforms.
9 . The method of claim 8 , wherein obtaining the scan results comprises:
downloading a copy of the cloud storage object from the cloud storage platform; and
scanning the copy of the cloud storage object using a platform-agnostic scanner to generate the scan results.
10 . The method of claim 8 , wherein the attributes of the cloud storage object include one or more of a size, frequency of access, total number of accesses, time since last use, frequency of edits, source, or storage location.
11 . The method of claim 8 , wherein determining to secure the cloud storage object against ransomware attacks comprises:
classifying the cloud storage object into a significance category of a plurality of significance categories using the attributes of the cloud storage object; and
determining to secure the cloud storage object against ransomware attacks based on the significance category.
12 . The method of claim 11 , wherein the cloud storage object is replicated to a greater number of additional cloud storage platforms than a second cloud storage object that is classified into a lower significance category than the significance category of the cloud storage object.
13 . The method of claim 8 , wherein replicating the cloud storage object to one or more additional cloud storage platforms comprises storing a copy of the cloud storage object in all available cloud storage platforms.
14 . The method of claim 8 , further comprising:
receiving, from the cloud storage platform, an event identifying the cloud storage object;
determining, using the event, to scan the cloud storage object;
responsive to determining to scan the cloud storage object, downloading a copy of the cloud storage object from the cloud storage platform;
scanning the copy of the cloud storage object using a platform-agnostic scanner to generate the scan results; and
providing instructions to the cloud storage platform to unlock the cloud storage object responsive to the scan results indicating that the cloud storage object is safe.
15 . A cloud storage security system comprising:
a processor; and
a non-transitory computer-readable medium including instructions that, when executed by the processor, cause the cloud storage security system to perform operations comprising:
obtaining scan results indicating a cloud storage object from a cloud storage platform is safe;
obtaining attributes of the cloud storage object;
determining, based on the attributes of the cloud storage object, to secure the cloud storage object against ransomware attacks, wherein determining to secure the cloud storage object against ransomware attacks comprises:
calculating a significance score of the cloud storage object using the attributes of the cloud storage object;
comparing the significance score to a threshold; and
determining to secure the cloud storage object against ransomware attacks responsive to the significance score exceeding the threshold; and
responsive to determining to secure the cloud storage object, replicating the cloud storage object to one or more additional cloud storage platforms.
16 . The cloud storage security system of claim 15 , wherein determining to secure the cloud storage object against ransomware attacks comprises:
classifying the cloud storage object into a significance category of a plurality of significance categories using the attributes of the cloud storage object; and
determining to secure the cloud storage object against ransomware attacks based on the significance category,
wherein the cloud storage object is replicated to a greater number of additional cloud storage platforms than a second cloud storage object that is classified into a lower significance category than the significance category of the cloud storage object.
17 . The cloud storage security system of claim 15 , wherein the operations further comprise:
receiving, from the cloud storage platform, an event identifying the cloud storage object;
determining, using the event, to scan the cloud storage object;
responsive to determining to scan the cloud storage object, downloading a copy of the cloud storage object from the cloud storage platform;
scanning the copy of the cloud storage object using a platform-agnostic scanner to generate the scan results; and
providing instructions to the cloud storage platform to unlock the cloud storage object responsive to the scan results indicating that the cloud storage object is safe.