Netskope, Inc.

VenkataSwamy Pathapati

Krishna Narayanaswamy

Muhammed Shafeek

Sudha Iyer

Kenil Patel

Anupam Kumar

Michael Koyfman

Vanshika Gupta

Yuri Duchovny

The technology disclosed relates to an introspector that scans an organization's accounts on cloud storage services and detects resources on the cloud storage services configured to store the organization's data, and identifies the detected resources in a resource list. The technology disclosed further includes an inline proxy that controls manipulation of the detected resources based on the resource list.

Data loss prevention (DLP) for cloud resources via metadata analysis

The invention provides a method, apparatus and system for preventing exfiltration of data caused by use of an unsanctioned CCS account. The invention intercepts a communication including a request for access to data, where the communication is being transmitted between a user of the CCS, and a CCS host website, referred to as a CCS endpoint. The intercepted communication is inspected for information that is processed to obtain a CCS account identifier associated with a CCS account being used by a user of that CCS account. The CCS account identifier is further processed to access tenant defined policy information associated with the CCS account. The invention further performs actions to determine if the CCS account associated with the account identifier is unsanctioned (unpermitted) with respect to access to the particular data for which access is being requested by the user of that CCS account.

Preventing data exfiltration to unsanctioned cloud computing services (CCS) accounts using CCS application programming interfaces

The disclosed technology teaches securing a collaboration tool against unauthorized data exfiltration and malicious files, setting policies for file exfiltration to external guest users, uploading users in the external category, and using a proxy that intercepts an add request and response for a collaboration tool. The add response contains a tag identifying the invited user in the category. The request doesn't identify the user as a guest. Also taught is storing metadata identifying the user in the guest category for applying policies, and using a proxy that intercepts a user request and response for file transfer, and looking up and identifying the user as in the category, and applying the applicable policy. Responsive to the policy, included is invoking DPI and detecting that the referenced file contains sensitive information not permitted by the policy to be transferred by the particular user in the external guest category and blocking file transfer.

Securing collaboration tools against unauthorized data exfiltration

The disclosed technology teaches keeping up with the deployment of APIs, so that Secure Access Service Edge (SASE) protection is afforded, parsing an OpenAPI specification for an API family, for identifying overall attributes of the API family. The method includes identifying resources with respective URIs within the API family and extracting usable attributes of the API resources, useful for building a connector, extracting per-activity attributes that correspond to core activities that trigger protective actions. The disclosed technology also includes applying a connector creator that performs actions including accessing a template for creating connector rules that recognize intercepted API calls and activities requested by the API calls, and that trigger the protective actions, using the template and the extracted attributes from the API resources, producing the connector rules, and storing the connector rules for use in processing intercepted APIs. Further taught is using the connector rules for the SASE protection.

Policy enforcement and visibility for IaaS and SaaS open APIs

The technology disclosed proposes a metadata-based solution to prevent malicious data egress resulting from resource-level transactions. In advance of the data egress requests, the technology disclosed crawls an organization's accounts on different cloud storage services and makes a resource list of different cloud-based resources configured under the organization's accounts. The resource list is then stored in a metadata store. When an inline proxy receives a resource-level transaction that is requesting to move a cloud-based resource outside the organization's account, the proxy looks up the metadata store and determines whether the resource-level transaction is attempting to manipulate any of the cloud-based resources listed in the resource list. If so, then the proxy blocks the resource-level transaction.

Growing community of inventors

Koduru Mandal, India

VenkataSwamy Pathapati