LOCAL ISOLATION IN A BROWSER
A communications system for providing secure access to a digital resource of a group of digital resources accessible via the internet, the system comprising: a data processing hub accessible via an IP (internet protocol) address; and a plurality of user equipment (UEs) useable to communicate via the internet, each configured to have a cyber secure isolated environment (CISE) isolated from ambient software in the UE, and comprising a secure web browser (SWB); wherein the hub and CISE are configured so that digital resources in motion and at rest in CISE are visible to the hub.
1 . A method comprising:
maintaining a first environment, which includes at least a browser, wherein the first environment is isolated on an endpoint; and
enabling secure data transfer within the first environment and/or between the first environment and one or more external environments, wherein enabling secure data transfer is based on a backend policy applied to context of the secure data transfer and a user authenticated to the first environment.
2 . The method of claim 1 , wherein the context of the secure data transfer and the user comprises at least one of characteristics of the user, characteristics of the endpoint, web services, user location, time, and characteristics of one or more processes associated with the secure data transfer.
3 . The method of claim 2 , wherein the characteristics include risk levels.
4 . The method of claim 1 , wherein enabling secure data transfer across at least the first environment comprises, based on detecting an attempt to communicate data across at least the first environment and external software-as-a-service and/or web applications, at least one of,
blocking the attempt to communicate data;
alerting the user regarding the attempt to communicate data;
prompting the user to provide additional data regarding the attempt to access data;
raising an alert to an alerting system indicating the attempt to access the data;
prompting an administrator to investigate the attempt to access the data to block or allow the attempt to access the data;
prompting the user to reauthenticate at least one of a password, a biometric method, and hardware device, and a two-factor authentication application to the browser;
deanonymizing the attempt to access the data;
logging the attempt to access the data;
erasing a process that attempted to access the data;
disabling one or more components of the endpoint;
pausing activity of the endpoint in the first environment for a predefined time period;
reinstalling the first environment; and
disconnecting the endpoint from a network.
5 . The method of claim 1 , wherein enabling secure data transfer across at least the first environment and the one or more external environments comprises allowing shared access by one or more processes running in the first environment to files in the first environment.
6 . The method of claim 5 , wherein the files comprise encrypted files, wherein allowing shared access to the encrypted files comprises, in the first environment,
based on detecting a first attempt, at a first of the one or more processes, to make first data available to the one or more processes via the encrypted files,
creating a cryptographic key; and
encrypting the first data in the encrypted files;
based on detecting a second attempt, at a second of the one or more processes, for access to the first data,
verifying that the second process is allowed to access the first data; and
decrypting the first data for the second process with the cryptographic key.
7 . The method of claim 6 , wherein at least one of,
verifying that the second process is allowed to access the first data comprises determining that a context of the second process indicates that the second process is allowed to access the first data, wherein the context of the second process comprises at least one of an identifier of the second process, an identifier of the user, an identifier of a process for the second process, and an identifier of a thread for the second process,
verifying that the second process is allowed to access the first data is by at least one of a file system hook, a file system filter, and a file system driver in the first environment, and
creating the cryptographic key comprises creating the cryptographic key at a hardware component in the first environment, wherein the hardware component comprises at least one of a hardware security module, a trusted platform module, and a secure enclave, wherein decrypting the first data with the cryptographic key comprises decrypting the first data at the hardware component.
8 . The method of claim 1 , wherein maintaining the first environment comprises allowing shared access to a clipboard in the first environment that is separate from a local clipboard for the endpoint.
9 . The method of claim 8 , further comprising at least one of,
purging the clipboard after at least one of a timeout event, a user logout event, and an idle event;
monitoring, modifying, and/or scanning the clipboard according to the backend policy; and
based on detecting a copy or paste event related to the clipboard,
determining whether the copy or paste event is allowed;
based on determining that the copy or paste event is allowed, storing data associated with the copy or paste event in the clipboard; and
based on determining that the copy or paste event is not allowed, performing one or more actions related to the copy or paste event.
10 . The method of claim 9 , wherein at least one of,
the one or more actions comprise modifying content of the clipboard based on the copy or paste event according to a privacy, security, and/or data leakage prevention policy of the backend policy, and
determining whether the copy or paste event is allowed comprises,
detecting uniform resource locators (URLs) in the copy or paste event; and
determining whether at least one of the URLs, content associated with the URLs, and personal data and/or credentials associated with the copy or paste event is malicious and/or sensitive.
11 . The method of claim 1 , further comprising:
based on detecting an attempt to at least one of export data from the first environment to the one or more external environments and import data from the one or more external environments to the first environment, evaluating the attempt for allowability against a context of the attempt;
based on determining that the attempt is allowable, communicating the data to a target of the attempt in the one or more external environments; and
based on determining that the attempt is not allowable, performing a remediation action based on characteristics of the attempt.
12 . The method of claim 11 , wherein evaluating the attempt for allowability against context of the attempt comprises evaluating a risk level associated with context of the attempt, wherein the context for the attempt comprises at least one of a user and/or service that submitted the attempt, a target website, service, and/or resource of the attempt, endpoint posture, a time of day of the attempt, a location of the attempt, and an endpoint type and/or security posture of the endpoint.
13 . The method of claim 1 , further comprising:
identifying screen capture events across the first environment; and
acting upon the screen capture events according to the backend policy, wherein acting upon the screen capture events comprises,
logging the screen capture events across the first environment; and
applying the backend policy to at least partially mitigate risk of data leakage of screen captures from the first environment.
14 . The method of claim 1 , further comprising:
analyzing keyboard capture across the endpoint to identify a process and/or driver and/or malware running on the endpoint that accessed data for the keyboard capture; and
determining whether the process is allowed to access data for the keyboard capture based, at least in part, on the analysis.
15 . The method of claim 14 , further comprising, based on determining that the process is not allowed to access data for the keyboard capture, erasing all or part of the data of the keyboard capture being communicated to the process, wherein analyzing the keyboard capture comprises identifying hooks used for keyboard capture across the endpoint.
16 . The method of claim 1 , further comprising:
monitoring copy of files across the first environment and the one or more external environments to identify an attempt to copy a file between the first environment and the one or more external environments; and
based on determining that the attempt is not allowed, at least one of,
encrypting the file with a cryptographic key only accessible to the first environment;
storing the file in an undocumented location;
protecting the file to disallow access by the one or more external environments;
configuring the files and/or a file system to disable access to the file by processes running only in the one or more external environments;
logging the attempt to copy the file; and
blocking the attempt to copy the file.
17 . A non-transitory machine-readable medium having program code stored thereon, the program code comprising instructions to:
maintain a first environment which includes at least a browser, wherein the first environment is isolated on a endpoint; and
enable secure data transfer within the first environment and/or between the first environment and one or more external environments, wherein the instructions to enable secure data transfer are based on a backend policy applied to context of the secure data transfer and a user authenticated to the first environment.
18 . The non-transitory machine-readable medium of claim 17 , wherein the context of the secure data transfer and the user comprises at least one of characteristics of the user, characteristics of the endpoint, web services, user location, time, and characteristics of one or more processes associated with the secure data transfer.
19 . The non-transitory machine-readable medium of claim 17 , wherein the instructions to enable secure data transfer across at least the first environment comprise instructions to, based on detecting an attempt to communicate data across at least the first environment and external software-as-a-service and/or web applications, at least one of,
block the attempt to communicate data;
alert the user regarding the attempt to communicate data;
prompt the user to provide additional data regarding the attempt to access data;
raise an alert to an alerting system indicating the attempt to access the data;
prompt an administrator to investigate the attempt to access the data to block or allow the attempt to access the data;
prompt the user to reauthenticate at least one of a password, a biometric method, and hardware device, and a two-factor authentication application to the browser;
deanonymize the attempt to access the data;
log the attempt to access the data;
erase a process that attempted to access the data;
disable one or more components of the endpoint;
pause activity of the endpoint in the first environment for a predefined time period;
reinstall the first environment; and
disconnect the endpoint from a network.
20 . The non-transitory machine-readable medium of claim 17 , wherein the instructions to enable secure data transfer across at least the first environment and the one or more external environments comprise instructions to allow shared access by one or more processes running in the first environment to files in the first environment.
21 . The non-transitory machine-readable medium of claim 17 , wherein the instructions to maintain the first environment comprise instructions to allow shared access to a clipboard in the first environment that is separate from a local clipboard for the endpoint.
22 . The non-transitory machine-readable medium of claim 17 , wherein the program code further comprises instructions to:
based on detecting an attempt to at least one of export data from the first environment to the one or more external environments and import data from the one or more external environments to the first environment, evaluate the attempt for allowability against a context of the attempt;
based on determining that the attempt is allowable, communicate the data to a target of the attempt in the one or more external environments; and
based on determining that the attempt is not allowable, perform a remediation action based on characteristics of the attempt.
23 . The non-transitory machine-readable medium of claim 17 , wherein the program code further comprises instructions to:
identify screen capture events across the first environment; and
act upon the screen capture events according to the backend policy, wherein the instructions to act upon the screen capture events comprise instructions to,
log the screen capture events across the first environment; and
apply the backend policy to at least partially mitigate risk of data leakage of screen captures from the first environment.
24 . The non-transitory machine-readable medium of claim 17 , wherein the program code further comprises instructions to:
analyze keyboard capture across the endpoint to identify a process and/or driver and/or malware running on the endpoint that accessed data for the keyboard capture; and
determine whether the process is allowed to access data for the keyboard capture based, at least in part, on the analysis.
25 . The non-transitory machine-readable medium of claim 17 , wherein the program code further comprises instructions to:
monitor copy of files across the first environment and the one or more external environments to identify an attempt to copy a file between the first environment and the one or more external environments; and
based on determining that the attempt is not allowed, at least one of,
encrypt the file with a cryptographic key only accessible to the first environment;
store the file in an undocumented location;
protect the file to disallow access by the one or more external environments;
configure the files and/or a file system to disable access to the file by processes running only in the one or more external environments;
log the attempt to copy the file; and
block the attempt to copy the file.
26 . A system comprising:
one or more endpoints that host one or more external environments; and
a first endpoint that,
maintains a first environment which includes at least a browser, wherein the first environment is isolated on the first endpoint; and
enables secure data transfer within the first environment and/or between the first environment and the one or more external environments, wherein enabling secure data transfer is based on a backend policy applied to context of the secure data transfer and a user authenticated to the first environment.
27 . The system of claim 26 , wherein the context of the secure data transfer and the user comprises at least one of characteristics of the user, characteristics of the first endpoint, web services, user location, time, and characteristics of one or more processes associated with the secure data transfer.
28 . The system of claim 26 , wherein enabling secure data transfer across at least the first environment comprises, based on detecting an attempt to communicate data across at least the first environment and external software-as-a-service and/or web applications, at least one of,
blocking the attempt to communicate data;
alerting the user regarding the attempt to communicate data;
prompting the user to provide additional data regarding the attempt to access data;
raising an alert to an alerting system indicating the attempt to access the data;
prompting an administrator to investigate the attempt to access the data to block or allow the attempt to access the data;
prompting the user to reauthenticate at least one of a password, a biometric method, and hardware device, and a two-factor authentication application to the browser;
deanonymizing the attempt to access the data;
logging the attempt to access the data;
erasing a process that attempted to access the data;
disabling one or more components of the first endpoint;
pausing activity of the first endpoint in the first environment for a predefined time period;
reinstalling the first environment; and
disconnecting the first endpoint from a network.
29 . The system of claim 26 , wherein enabling secure data transfer across at least the first environment and the one or more external environments comprises allowing shared access by one or more processes running in the first environment to files in the first environment.
30 . The system of claim 26 , wherein maintaining the first environment comprises allowing shared access to a clipboard in the first environment that is separate from a local clipboard for the first endpoint.
31 . The system of claim 26 , wherein the first endpoint:
based on detecting an attempt to at least one of export data from the first environment to the one or more external environments and import data from the one or more external environments to the first environment, evaluates the attempt for allowability against a context of the attempt;
based on determining that the attempt is allowable, communicates the data to a target of the attempt in the one or more external environments; and
based on determining that the attempt is not allowable, performs a remediation action based on characteristics of the attempt.
32 . The system of claim 26 , wherein the first endpoint:
identifies screen capture events across the first environment; and
acts upon the screen capture events according to the backend policy, wherein acting upon the screen capture events comprises,
logging the screen capture events across the first environment; and
applying the backend policy to at least partially mitigate risk of data leakage of screen captures from the first environment.
33 . The system of claim 26 , wherein the first endpoint:
analyzes keyboard capture across the first endpoint to identify a process and/or driver and/or malware running on the first endpoint that accessed data for the keyboard capture; and
determines whether the process is allowed to access data for the keyboard capture based, at least in part, on the analysis.
34 . The system of claim 26 , wherein the first endpoint:
monitors copy of files across the first environment and the one or more external environments to identify an attempt to copy a file between the first environment and the one or more external environments; and
based on determining that the attempt is not allowed, at least one of,
encrypts the file with a cryptographic key only accessible to the first environment;
stores the file in an undocumented location;
protects the file to disallow access by the one or more external environments;
configures the files and/or a file system to disable access to the file by processes running only in the one or more external environments;
logs the attempt to copy the file; and
blocks the attempt to copy the file.