Certification of correct behavior of cloud services using shadow rank

Patent metadata

Field	Value
Publication number	US-2016127407-A1
Application number	US-201414529281-A
Country	US
Kind code	A1
Filing date	Oct 31, 2014
Priority date	Oct 31, 2014
Publication date	May 5, 2016
Grant date	—

Abstract

Determining potential harm associated with a network endpoint external to an enterprise includes receiving information about a network-based communication by a resource of the enterprise directed to the network endpoint external to the enterprise, and calculating a plurality of individual scores related to a risk associated with the network-based communication, wherein each individual score corresponds to a different category of risk. The determination also includes receiving data specifying a policy related to rules defined by the enterprise regarding usage of cloud services; calculating a composite risk score related to the network-based communication, wherein the composite risk score is based on the individual scores and the policy; and notifying an entity of the enterprise about the composite risk score.

First claim

1 . A method of determining potential harm associated with a network endpoint external to an enterprise, comprising:
receiving, by a computer, information about a network-based communication by a resource of the enterprise directed to the network endpoint external to the enterprise; calculating, by the computer, a plurality of individual scores related to a risk associated with the network-based communication,
wherein each individual score corresponds to a different category of risk;
receiving, by the computer, data specifying a policy related to rules defined by the enterprise regarding usage of cloud services; calculating, by the computer, a composite risk score related to the network-based communication,
wherein the composite risk score is based on the individual scores and the policy; and
notifying, by the computer, an entity of the enterprise about the composite risk score.

2 . The method of claim 1 , wherein the policy comprises a plurality of individual policies, each related to at least one of the different categories of risk.

3 . The method of claim 1 , wherein the composite score comprises a value and a probability indicative of a certainty of the value being an accurate measure of potential harm of the network-based communication.

4 . The method of claim 1 , comprising:
receiving, by the computer, a plurality of policy definitions related to acceptable usage of cloud services; and based on the policy definitions, storing by the computer, the policy in a policy database.

5 . The method of claim 1 , wherein the composite risk score varies based on the policy such that one set of particular individual scores results in a different composite score depending on the policy.

6 . The method of claim 1 , comprising:
preventing, by the computer, further network-based communication with the network endpoint external to the enterprise.

7 . The method of claim 1 , wherein one of the different categories of risk relates to a probability of security exposure.

8 . The method of claim 1 , wherein one of the different categories of risk relates to a probability of authenticity of the network endpoint external to the enterprise.

9 . The method of claim 1 , wherein one of the different categories of risk relates to a determination of previous usage of the network endpoint by the enterprise.

10 . The method of claim 1 , comprising:
receiving, by the computer, information from a data source external from the enterprise,
wherein the information from the data source relates to one of the different categories of risk; and
calculating one of the individual scores based on the information from the data source.

11 . A system for determining potential harm associated with a network endpoint external to an enterprise, comprising:
a memory storage device; a processor configured to execute instructions stored in the memory storage device, the instructions when executed by the processor cause the system to:
receive information about a network-based communication by a resource of the enterprise directed to the network endpoint external to the enterprise;
calculate a plurality of individual scores related to a risk associated with the network-based communication,
wherein each individual score corresponds to a different category of risk;

receive data specifying a policy related to rules defined by the enterprise regarding usage of cloud services;
calculate a composite risk score related to the network-based communication,
wherein the composite risk score is based on the individual scores and the policy; and

notify an entity of the enterprise about the composite risk score.

12 . The system of claim 11 , wherein the policy comprises a plurality of individual policies, each related to at least one of the different categories of risk.

13 . The system of claim 11 , wherein the composite score comprises a value and a probability indicative of a certainty of the value being an accurate measure of potential harm of the network-based communication.

14 . The system of claim 11 , wherein the instructions, when executed by the processor, cause the system to:
receive a plurality of policy definitions related to acceptable usage of cloud services; and based on the policy definitions, store the policy in a policy database.

15 . The system of claim 11 , wherein the composite risk score varies based on the policy such that a set of particular individual scores results in a different composite score which depends on the policy.

16 . The system of claim 11 , wherein the instructions, when executed by the processor, cause the system to:
prevent further network-based communication with the network endpoint external to the enterprise.

17 . The system of claim 11 , wherein one of the different categories of risk relates to a probability of security exposure.

18 . The system of claim 11 , wherein one of the different categories of risk relates to a probability of authenticity of the network endpoint external to the enterprise.

19 . The system of claim 11 , wherein one of the different categories of risk relates to a determination of previous usage of the network endpoint by the enterprise.

20 . The system of claim 11 , wherein the instructions, when executed by the processor, cause the system to:
receive information from a data source external from the enterprise,
wherein the information from the data source relates to one of the different categories of risk; and
calculate one of the individual scores based on the information from the data source.

21 . A computer program product for determining potential harm associated with a network endpoint external to an enterprise, comprising:
a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code for receiving information about a network-based communication by a resource of the enterprise directed to the network endpoint external to the enterprise;
computer readable program code for calculating a plurality of individual scores related to a risk associated with the network-based communication,
wherein each individual score corresponds to a different category of risk;

computer readable program code for receiving a policy related to rules defined by the enterprise regarding usage of cloud services;
computer readable program code for calculating a composite risk score related to the network-based communication,
wherein the composite risk score is based on the individual scores and the policy; and

computer readable program code for notifying an entity of the enterprise about the composite risk score.

Assignees

• Ca Inc

Inventors

• Mankovskii Serguei
• Greenspan Steven L
• Matthews Peter Brian

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title