Netskope, Inc.

Anupam Kumar

Muhammed Shafeek

Prasenna Ravi

Venkataswamy Pathapati

VenkataSwamy Pathapati

Vanshika Gupta

The technology disclosed prevents phishing attacks where a malicious attacker creates a malicious file in a cloud-based store and shares it with endpoint users. A user, opening the shared document, is redirected to a malicious website where a corporation's critical data may be compromised. The cloud-based method applies a set of rules and policies to allow the shared document or block the shared document from the network, based on identifying the ownership or originator of the shared document. Documents from blacklisted websites are blocked. Documents from trusted sources are allowed access to the network. Unknown documents are blocked and threat-scanned to determine if they contain malicious content. If analysis proves a blocked document to be safe, it may be released into the network along with subsequent documents having the same ownership or originator.

Preventing cloud-based phishing attacks using shared documents with malicious links

The disclosed technology teaches securing a collaboration tool against unauthorized data exfiltration and malicious files, setting policies for file exfiltration to external guest users, uploading users in the external category, and using a proxy that intercepts an add request and response for a collaboration tool. The add response contains a tag identifying the invited user in the category. The request doesn't identify the user as a guest. Also taught is storing metadata identifying the user in the guest category for applying policies, and using a proxy that intercepts a user request and response for file transfer, and looking up and identifying the user as in the category, and applying the applicable policy. Responsive to the policy, included is invoking DPI and detecting that the referenced file contains sensitive information not permitted by the policy to be transferred by the particular user in the external guest category and blocking file transfer.

Securing collaboration tools against unauthorized data exfiltration

The technology disclosed includes a system and method for preventing phishing attacks caused by sharing documents with malicious content over a network, where the shared document may include links that redirect users to a malicious websites. The cloud-based method applies a set of rules and policies to allow the shared document or block the shared document from the network, based on identifying the ownership or originator of the shared document. Blocked documents are quarantined, analyzed for threats, and subjected to sandbox methods to determine malicious content that may compromise corporate data. If analysis proves the blocked document to be safe, it may be released into the network along with subsequent documents having the same ownership or originator. The technology disclosed is particularly useful where a malicious attacker creates a malicious file in a cloud-based store such a Google Drive and shares it with endpoint users. When users open the shared document, they are redirected to a malicious website where a corporation's critical data may be compromised.

Growing community of inventors

Bengaluru, India

Anupam Kumar