Dynamic routing of access request streams in a unified policy enforcement system
The technology discloses processing incoming access requests of packets through cloud-based components that perform (a) packet-level access control and traffic inspection, (b) protocol-level access control and traffic inspection, (c) threat detection, and (d) activity contextualization, including a packet and stream router conveying each incoming access request of packets through all of components (a)-(d) that apply, at least until one of the components sets a restrictive state on at least one object corresponding to the incoming access request or until all of the components that apply have passed the incoming access request. The disclosed method also includes a restrictive state analyzer determining whether the first, second, third or fourth restrictive state has been set due to malformed packets, malicious signatures, requests directed to a threat destination or an activity classified as compromising, and based on setting of any of the states, taking restrictive steps in response to the incoming access request.
1. A system for providing cloud-based network security, the system including:
a cloud access security broker (CASB) component that runs on cloud-based hardware and is configured for providing security with respect to access to a cloud-based resource by users within an organization, via processing of one or more received packets being communicated between said users of said organization through a set of firewall components to said cloud-based resource, in compliance with a unified security policy;
a secure web gateway (SWG) component that runs on cloud-based hardware and is configured for providing security with respect to access to a web accessible destination by said users within an organization, via processing of one or more received packets being communicated between said users of said organization through the set of firewall components and said web accessible destination, in compliance with the unified security policy;
the set of firewall components that run on cloud-based hardware and are configured for providing packet-level and protocol-level traffic inspection and access control, with respect to received packets, and for selectively forwarding said received packets to the CASB and SWG dependent on a type of stream to which said received packets belong; and
a restrictive state analyzer that runs on cloud-based hardware, that is configured to be in communication with each of said components, and that is configured for determining if and what action should be performed with respect to said each packet, in response to said communication with at least one of said components and in compliance with the unified security policy.
2. The system of claim 1 wherein said cloud access security broker (CASB) component is configured for identification of a user within a user group within said organization that is attempting to access a cloud-based resource, via processing of a received packet, and configured for determination if said user is permitted to access said cloud-based resource, in compliance with said security policy.
3. The system of claim 1 wherein said secure web gateway (SWG) component is configured for identification of a user within a user group within said organization that is attempting to access a web accessible destination, via processing of a received packet, and configured for determination if said user within said user group is permitted to access said web accessible destination, in compliance with said security policy.
4. The system of claim 1 wherein said firewall components are configured to inspect packet headers via processing of a received packet, and for identification of a malformation within said received packet, and for communication of said identification with said restrictive state analyzer to determine performance of an action with respect to said received packet, in compliance with said security policy.
5. The system of claim 1 wherein said firewall components are configured to perform deep packet inspection via processing of a received packet, and for identification of whether said received packet is inspectable or non-inspectable, and for communication of said identification with said restrictive state analyzer, for a restrictive state analyzer determination of performance of an action with respect to said received packet, in compliance with said security policy.
6. The system of claim 1 wherein said action with respect to said each packet, is selected among actions of allow, block, alert, bypass, coach and quarantine and no action.
7. The system of claim 1 wherein said access to a cloud based resource includes access to a cloud-based service and includes access to data provided by said cloud-based service.
8. A method for providing cloud-based network security, the method including the steps of:
providing a cloud access security broker (CASB) component that runs on cloud-based hardware and is configured for providing security with respect to access to a cloud-based resource by users within an organization, via processing of one or more received packets being communicated between said users of said organization through a set of firewall components to said cloud-based resource, in compliance with a unified security policy;
providing a secure web gateway (SWG) component that runs on cloud-based hardware and is configured for providing security with respect to access to a web accessible destination by said users within an organization, via processing of one or more received packets being communicated between said users of said organization through the set of firewall components and said web accessible destination, in compliance with the security policy;
providing the set of firewall components that run on cloud-based hardware and are configured for providing packet-level and protocol-level traffic inspection and access control, with respect to received packets, and for selectively forwarding said received packets to the CASB and SWG dependent on a type of stream to which said received packets belong; and
providing a restrictive state analyzer that runs on cloud-based hardware, that is configured to be in communication with each of said components, and that is configured for determining if and what action should be performed with respect to said each packet, in response to said communication with at least one of said components and in compliance with the unified security policy.
9. The method of claim 8 wherein said cloud access security broker (CASB) component is configured for identification of a user within a user group within said organization that is attempting to access a cloud-based resource, via processing of a received packet, and for determination if said user is permitted to access said cloud-based resource, in compliance with said security policy.
10. The method of claim 8 wherein said secure web gateway (SWG) component is configured for identification of a user within a user group within said organization that is attempting to access a web accessible destination, via processing of a received packet, and configured for determination if said user within said user group is permitted to access said web accessible destination, in compliance with said security policy.
11. The method of claim 8 wherein said firewall components are configured to inspect packet headers via processing of a received packet, and for identification of a malformation within said received packet, and for communication of said identification with said restrictive state analyzer for determination by said restrictive analyzer, of performance of an action with respect to said received packet, in compliance with said security policy.
12. The method of claim 8 wherein said firewall components are configured to perform deep packet inspection via processing of a received packet, and for identification of whether said received packet is inspectable or non-inspectable, and for communication of said identification with said restrictive state analyzer, for a determination by said restrictive state analyzer of performance of an action with respect to said received packet, in compliance with said security policy.
13. The method of claim 8 wherein said action with respect to said each packet, is selected among actions of allow, block, alert, bypass, coach and quarantine and no action.
14. The method of claim 8 wherein said access to a cloud based resource includes access to a cloud-based service and to data provided by said cloud-based service.
15. A tangible non-transitory computer readable medium including program instructions that, when executed on one or more processors, cause the processors to implement a method, the method including actions of:
providing a cloud access security broker (CASB) component that runs on cloud-based hardware and is configured for providing security with respect to access to a cloud-based resource by users within an organization, via processing of one or more received packets being communicated between said users of said organization through a set of firewall components to said cloud-based resource, in compliance with a unified security policy;
providing a secure web gateway (SWG) component that runs on cloud-based hardware and is configured for providing security with respect to access to a web accessible destination by said users within an organization, via processing of one or more received packets being communicated between said users of said organization through a set of firewall components to said web accessible destination, in compliance with the unified security policy;
providing the set of firewall components that run on cloud-based hardware and are configured for providing packet-level and protocol-level traffic inspection and access control, with respect to received packets, and for selectively forwarding said received packets to the CASB and SWG dependent on a type of stream to which said received packets belong; and
providing a restrictive state analyzer that runs on cloud-based hardware, that is configured to be in communication with each of said components, and that is configured for determining if and what action should be performed with respect to said each packet, in response to said communication with at least one of said components and in compliance with the unified security policy.
16. The medium of claim 15 wherein said cloud access security broker (CASB) component is configured for identification of a user within a user group within said organization that is attempting to access a cloud-based resource, via processing of a received packet, and for determination if said user is permitted to access said cloud-based resource, in compliance with said security policy.
17. The medium of claim 15 wherein said secure web gateway (SWG) component is configured for identification of a user within a user group within said organization that is attempting to access a web accessible destination, via processing of a received packet, and configured for determination if said user within said user group is permitted to access said web accessible destination, in compliance with said security policy.
18. The medium of claim 15 wherein said firewall components are configured to perform deep packet inspection via processing of a received packet, and for identification of whether said received packet is inspectable or non-inspectable, and for communication of said identification with said restrictive state analyzer, for a restrictive state analyzer determination of performance of an action with respect to said received packet, in compliance with said security policy.
19. The medium of claim 15 wherein said action with respect to said each packet, includes actions of allow, block, alert, bypass, coach and quarantine and no action.
20. The medium of claim 15 wherein said access to a cloud based resource includes access to a cloud-based service and includes access to data provided by said cloud-based service.