Abstract:
A data security system, including a security manager computer making network API calls to a service that performs data-exchange transactions for end users, the API calls remotely controlling the service so that the security manager computer accesses an outgoing transaction that has already entered the cloud-based service, by generating one or more security platform rules that are applied by the service and cause the service to automatically transmit the outgoing transaction to an inspection location prior to transmission of the outgoing transaction to a destination, and a data inspector operative to inspect data of the outgoing transaction in the inspection location for data leakage, wherein the security manager computer further controls the service so as to transmit the outgoing transaction to the destinations when the data inspector clears the data, and to perform a remedial action regarding the outgoing transaction when the data inspector does not clear the data.

Description:
PRIORITY REFERENCE TO PROVISIONAL APPLICATIONS 
       [0001]    This application is a non-provisional of U.S. Provisional Application No. 62/271,234, entitled NON-INLINE METHOD FOR BLOCK-AND-INSPECT BY REVOCATION-RESTORATION SYSTEM, and filed on Dec. 27, 2015 by inventors Roy Rotem, Gil Friedrich and Avraham Zelovich, the contents of which are hereby incorporated herein in their entirety. 
     
    
     FIELD OF THE INVENTION 
       [0002]    The present invention relates to data security for cloud-based services. 
       BACKGROUND OF THE INVENTION 
       [0003]    In today&#39;s work environment a major part of data communication is done over computer networks. Data needs to be inspected for presence of malware, and for presence of sensitive data. Often, the inspection process is not immediate and is resource-intensive, yet the receiver desires to prevent access to the data until the inspection completes and the data is allowed to continue its regular course. 
         [0004]    Common examples of inspection of data include:
       e-mail systems must check that all incoming file-attachments are safe from computer viruses, phishing schemes or other malware;   file sharing systems must check that files are clean from malicious content before being accessed or being shared with other parties;   messaging/collaboration systems must ensure that data flowing between entities does not leak sensitive information;   systems that share sensitive-data often need to encrypt that data upon send and arrival.       
 
         [0009]    Reference is made to  FIG. 1 , which is a simplified block diagram of a prior art security system, in accordance with an embodiment of the present invention.  FIG. 1  shows an enterprise data center  100  that provides various data exchange services to enterprise employees. The data exchange services include a collaborative document management service  220 , such as MICROSOFT EXCHANGE SERVER® developed by Microsoft Corporation of Redmond, Wash., USA, and a file sharing service  230 , such as DOCUMENTUM® developed by EMC Corporation of Hopkinton, Mass., USA. Employees  110 A,  1108  and  110 C access these services using any of a variety of devices, including inter alia a smartphone, a laptop computer and a desktop computer. Also shown in  FIG. 1  is a firewall  150  which scans incoming and outgoing data for malware and for leakage of sensitive data. 
         [0010]    Firewall  150  scans incoming data scan before the receiver has access to that data, using proxy technologies that often perform block-and-inspect. Specifically, network traffic between a sender and a receiver must flow through firewall  150 , which inspects data and, if the data is cleared, forwards the data to the receiver. Firewall  150  is often a store-and-forward device, which blocks the flow of the traffic until inspection completes. Other store-and-forward devices include mail-relay, routers, proxy-servers, software agents and other inspection modules. This type of inspection is referred to as being inline. Inline inspection techniques are described at https://en.wikipedia.org/wiki/Deep_packet_inspection. 
         [0011]    Conventional inline block-and-inspect techniques suffer from several drawbacks, including:
       Inline systems cannot fully support a fail-open mode, and introduce an additional point-of-failure to services  120  and  130 .   Block-and-inspect introduces additional latency, during which traffic is re-routed to an inline device and then back to services  120  and  130 .   Introduction of inspection entities into a network disrupts normal operation of other components of services  120  and  130 . For example, an added email mail transport agent adversely impacts anti-spam filters used by an e-mail server, because an original source IP address is no longer visible.   Traffic that is encrypted cannot be inspected easily by inline systems.   Inline systems increase network-latency, and negatively impact the end user experience.       
 
         [0017]    Even worse, in today&#39;s off-site environments such as cloud/SaaS services, firewall  150  cannot inspect traffic, because traffic often flows over a public-network to computing and storage systems that the enterprise does not own or control. Moreover, today&#39;s end users may access these services from any location, not only from an enterprise office. Some enterprises try to force traffic through a proxy to ensure that the traffic undergoes inspection, but this leads to difficulties of managing endpoint proxy configurations, and of overcoming network-topology limitations. 
         [0018]    Reference is made to  FIG. 2  is a simplified block diagram of a prior art data security system that gets bypassed by end users of cloud applications. Shown in  FIG. 2  are enterprise data center  100  and firewall  150 , and a variety of cloud-based data-exchange services that run in a cloud computing center  200 , the services including a collaborative document management service  220 , such as OFFICE 365® developed by Microsoft Corporation of Redmond, Wash., a file sharing service  230 , such as BOX.NET® developed by Box.net, Inc. of Palo Alto, Calif., and an e-mail service  240 , such as GMAIL® developed by Google Inc. of Mountain View, Calif. End users  210 A,  210 B and  210 C access these services, bypassing firewall  150 , using any of a variety of devices, including inter alia a smartphone, a laptop computer and a desktop computer. 
         [0019]    An enterprise&#39;s sensitive files are now in the enterprise cloud, and may be shared with external users; and malicious files may be enter or reside in the enterprise cloud. An enterprise, in fact any business, large or small, and even an individual using cloud services, requires protection against malware, against advanced persistent threats, against anomalies, against insider threats and against data leakage. An enterprise may require data sanitation, endpoint compliance, share policy management, security information and event management (SIEM), ticketing integration, and audit compliance. Cloud service providers do not always offer such comprehensive protection and management, and such protection and management is not covered by service level agreements. 
         [0020]    Because of these drawbacks enterprises must compromise between inline prevention systems and non-inline detection-only systems for which the system sends alerts but cannot block/prevent a security breach from occurring. 
         [0021]    It would this be of advantage to provide a robust security system that provides the requisite security, yet overcomes these drawbacks of in-line block-and-inspect systems for today&#39;s cloud/SaaS environments. 
       SUMMARY 
       [0022]    Embodiments of the present invention provide robust security systems that overcome drawbacks of conventional in-line block-and-inspect systems for today&#39;s cloud/SaaS environments. These systems are essential not only to large enterprises, but also to business, large and small, and to individuals who use cloud services. 
         [0023]    Embodiments of the present invention provide non-inline prevention methods, which prevent end users from accessing data during an inspection phase until access is cleared, while not being inline. Because they are not inline, these embodiments overcome the drawbacks of existing inline systems. Because they block access to data until the data is cleared, these embodiments overcome drawbacks of detection-only systems. 
         [0024]    Embodiments of the present invention use network application programming interfaces to remotely control cloud-based services, including inter alia e-mail, file-sharing, collaborative data processing services. 
         [0025]    Embodiments of the present invention protect against malware and data leakage for both incoming and outgoing data transactions, such as inter alia a new file that is uploaded or downloaded or shared, or a new e-mail that arrives or is sent. The data transactions may be inter-enterprise communications, between employees of an enterprise, or may be communications to or from sources external to the enterprise. 
         [0026]    There is thus provided in accordance with an embodiment of the present invention a data security system, including a security manager remotely controlling, via a network application programming interface, a cloud-based service that performs data-exchange transactions for end users, operative to cause the service to prevent end user access to incoming transactions so that the security manager accesses the incoming transactions prior to end users being able to access the incoming transactions, and a data inspector operative to inspect data of incoming transactions for security clearance by invoking one or more content scanners, wherein the security manager is further operative to cause the service to restore end user access to the incoming transactions, when the security inspector clears the data, and to cause the service to perform a remedial action vis-à-vis the incoming transactions, when the security inspector does not the data. 
         [0027]    There is additionally provided in accordance with an embodiment of the present invention a method for data security, including remotely controlling, by a security processor via a network application programming interface, a cloud-based service that performs data-exchange transactions for end users, causing, by the security processor, the service to prevent end user access to incoming transactions, including controlling the service so that the security processor accesses incoming transactions prior to end users being able to access the incoming transactions, inspecting data of incoming transactions for security clearance by invoking one or more content scanners, when the inspecting clears the data, then causing, by the security processor, the service to restore end user access to the incoming transactions, and when the inspecting does not clear the data, causing, by the security processor, the service to perform a remedial action vis-à-vis the incoming transactions. 
         [0028]    There is further provided in accordance with an embodiment of the present invention a data security system, including a security manager remotely controlling, via a network application programming interface, a service that performs data-exchange transactions for end users, operative to cause the service to prevent transmission of outgoing transactions so that the security manager accesses outgoing transactions prior to transmission of the outgoing transactions to their destinations, and a data inspector operative to inspect data of outgoing transactions for data leakage, wherein the security manager is further operative to cause the service to transmit the transactions to their destinations, when the security inspector clears the data, and to perform a remedial action vis-à-vis the outgoing transactions, when the security inspector does not clear the data. 
         [0029]    There is yet further provided in accordance with an embodiment of the present invention a method for data security, including remotely controlling, by a security processor via a network application programming interface, a service that performs data-exchange transactions for end users, causing, by the security processor, the service to prevent transmission of outgoing transactions, including controlling the service so that the security processor accesses outgoing transactions prior to the service transmitting the outgoing transactions to their destinations, inspecting data of outgoing transactions for data leakage breach, when the inspecting does not discover a breach, then causing, by the security processor, the service to transmit the outgoing transactions to their destinations, and when the inspecting discovers a breach, causing, by the security processor, the service to perform a remedial action vis-à-vis the outgoing transactions. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0030]    The present invention will be more fully understood and appreciated from the following detailed description, taken in conjunction with the drawings in which: 
           [0031]      FIG. 1  is a simplified block diagram of a prior art data security system; 
           [0032]      FIG. 2  is a simplified block diagram of a prior art data security system that gets bypassed by end users of cloud applications; 
           [0033]      FIG. 3  is a simplified block diagram of a cloud security system for end users, in accordance with an embodiment of the present invention; 
           [0034]      FIG. 4  is a simplified block diagram of a cloud security system for an enterprise, in accordance with an embodiment of the present invention; 
           [0035]      FIG. 5  is a simplified flowchart for a method for cloud security, in accordance with an embodiment of the present invention; 
           [0036]      FIG. 6  is a simplified flowchart for a method for setting rules for cloud security, in accordance with an embodiment of the present invention; 
           [0037]      FIG. 7  is a screen shot of a security stack interface, showing a configuration of services and data inspectors, in accordance with an embodiment of the present invention; 
           [0038]      FIGS. 8-13  are respective screen shots of dashboards displaying results of several content scanners for six cloud services, in accordance with an embodiment of the present invention; 
           [0039]      FIG. 14  is a screen shot of a main dashboard displaying overall results for several cloud services, in accordance with an embodiment of the present invention; 
           [0040]      FIG. 15  is a screen shot of an analytics interface for cloud services, in accordance with an embodiment of the present invention; 
           [0041]      FIG. 16  is a screen shot of an alerts interface for cloud services, in accordance with an embodiment of the present invention; 
           [0042]      FIGS. 17-20  are self-explanatory simplified drawings of various policies enforced by a cloud security system, in accordance with an embodiment of the present invention; and 
           [0043]      FIGS. 21-26  are self-explanatory simplified drawings of various workflows performed by a cloud security system, in accordance with an embodiment of the present invention. 
       
    
    
       [0044]    For reference to the figures, the following index of elements and their numerals is provided. Similarly numbered elements represent elements of the same type, but they need not be identical elements. 
         [0000]    
       
         
               
             
               
               
             
           
               
                   
               
               
                 Table of elements in the figures 
               
             
          
           
               
                 Element 
                 Description 
               
               
                   
               
               
                 100 
                 enterprise 
               
               
                 110 
                 end users 
               
               
                 120 
                 Microsoft Office software service, enterprise-based 
               
               
                 130 
                 Box.net file sharing service, enterprise-based 
               
               
                 150 
                 firewall 
               
               
                 200 
                 cloud computing center 
               
               
                 210 
                 end users 
               
               
                 220 
                 Microsoft Office software service, cloud-based 
               
               
                 230 
                 Box.net file sharing service, cloud-based 
               
               
                 240 
                 Google e-mail service, cloud-based 
               
               
                 300 
                 cloud security platform 
               
               
                 310 
                 security manager 
               
               
                 320 
                 data inspector 
               
               
                   
               
             
          
         
       
     
         [0045]    Elements numbered in the 1000&#39;s are operations of flow charts. 
       LIST OF APPENDICES 
       [0046]    APPENDIX A is a listing with application programming interface (API) calls, for implementing an embodiment of the present invention. 
       DETAILED DESCRIPTION 
       [0047]    In accordance with embodiments of the present invention, systems and methods are provided for non-inline security systems for cloud/SaaS computing environments. 
         [0048]    Reference is made to  FIG. 3 , which is a simplified block diagram of a cloud security system for end users, in accordance with an embodiment of the present invention. Shown in  FIG. 3  are enterprise data center  100  and firewall  150 , and cloud-based data-exchange services that run in cloud computing center  200 , the services including collaborative document management service  220 , such as OFFICE 365® developed by Microsoft Corporation of Redmond, Wash., USA, file sharing service  230 , such as BOX.NET® developed by Box.net, Inc. of Palo Alto, Calif., USA, and e-mail service  240 , such as GMAIL® developed by Google Inc. of Mountain View, Calif., USA. End users  210 A,  210 B and  210 C access these services using any of a variety of devices, including inter alia a smartphone, a laptop computer and a desktop computer. 
         [0049]    Also shown in  FIG. 3  is a cloud security platform  300 , including a security manager  310  and a data inspector  320 . Security manager  300  remotely accesses the various data-exchange services  220 ,  230  and  240  using their respective application programming interfaces (APIs). Security manager  300  may itself be a cloud-based system. Security manger  310  and data inspector  320  may or may not reside on the same computer or even within the same cloud. Data inspector  320  may be, for example, its own cloud service. 
         [0050]    Security manager  310  and data inspector  320  include programmable data processing, storage and communication circuitry for performing the operations described below and with reference to the flowchart of  FIG. 5 . 
         [0051]    Reference is made to  FIG. 4 , which is a simplified block diagram of a cloud security system for an enterprise  100 , in accordance with an embodiment of the present invention.  FIG. 4  shows cloud computing center  200  and cloud-based data-exchange services  220 ,  230  and  240 .  FIG. 4  also shows cloud security platform  300 , including security manager  310  and data inspector  320 . 
         [0052]    Enterprise  100  generally has enterprise level subscriptions for its employees to data-exchange services  220 ,  230  and  240 . Enterprise  100  itself uses a firewall  150  to access data-exchange services  220 ,  230  and  240 . However, employees of enterprise  100 , such as end users  210 A,  210 B and  210 C may access these services from locations outside of enterprise  100 , such as from their homes. Since these services are cloud-based, the enterprise has no direct control over them. 
         [0053]    Reference is made to  FIG. 5 , which is a simplified flowchart for a method  1000  for cloud security, in accordance with an embodiment of the present invention. Method  1000  is practiced by security manager  310  and data inspector  320 , to provide security for incoming and outgoing data transactions for services  220 ,  230  and  240 . Many of the operations in  FIG. 5  are performed via services  220 ,  230  and  240  themselves; namely, security manager  310  uses a network application programming interface (API) to control a service and thereby cause the service to perform various operations. Although method  1000  relates to both incoming and outgoing data transactions, it will be appreciated by those skilled in the art that separate methods may instead be used for incoming and outgoing data transactions. 
         [0054]    Briefly, at operation  1005  security manager  310  monitors one or more data-exchange services, such as one or more of services  220 ,  230  and  240 . At operation  1010 , security manager  310  ascertains the scope of inspection configured by an administrator, as explained in detail hereinbelow. At operation  1015 , security manager  310  optionally discovers in real-time occurrence of a new incoming or outgoing data transaction within the service, as explained in detail hereinbelow. Whether security manager  310  actively discovers the new data transaction at operation  1015 , or instead relies on services  220 ,  230  to do so, at operation  1020  security manager  310  causes end-user access to the new transaction to be temporarily prevented, as explained in detail hereinbelow, if the new transaction is an incoming transaction, or causes transmission of the transaction to its destination to be temporarily prevented, if the new transaction is an outgoing transaction. Operation  1020  ensures that security manager  310  accesses data of the new transaction prior to end users and recipients being able to access that data. At operation  1025 , security manager  310  optionally causes recipients to be alerted that the new transaction has been temporarily prevented. At operation  1030 , security manger  310  retrieves the data of the new transaction. At operation  1035 , data inspector  320  inspects the data of the new transaction, as explained in detail hereinbelow. At operation  1040  a determination is made as to whether or not the data of the new transaction passed the inspection of operation  1035 . If so, then at operation  1045 , security manager  310  optionally causes the new transaction to be marked with a special marker, indicating that the transaction passed inspection. At operation  1050 , security manager  310  causes end user access to the new transaction to be restored, if the new transaction is an incoming transaction, or causes the new transaction to be transmitted to its destination, if the new transaction is an outgoing transaction. Otherwise, if the data of the new transaction did not pass inspection, then at operation  1055 , security manager  310  causes a remedial action to be performed vis-à-vis the new transaction. 
         [0055]    Operations of the flowchart of method  1000  are now described in detail. 
       Operation  1010   
       [0056]    At operation  1010  security manager  310  ascertains the scope of inspection configured by an administrator. The administrator configures the inspection so as to be applied/not be applied to specific users, specific groups of users, or to the entire enterprise. The administrator also configures the inspection so as to be applied/not be applied to various types of files including inter alia
   e-mail attachments;   compressed files such as WINZIP® files;   editable documents such as Word documents, EXCEL® spreadsheets and POWERPOINT® presentations; and   multi-media content such as audio and video content.   
 
       Operation  1015  (Optional) 
       [0061]    At optional operation  1015 , security manager  310  discovers in real-time occurrence of a new data transaction within the one or more data-exchange services, such as inter alia a new file that is uploaded or downloaded or shared, or a new e-mail that arrives or is sent. The new data transaction may be an inter-enterprise communication, between employees of the enterprise, or a communication to or from a source external to the enterprise. 
         [0062]    It will be appreciate by those skilled in the art that embodiments of the present invention have the advantage of being fail-safe; namely, if security manager  310  fails then the enterprise does not lose its access to services  220 ,  230  and  240 . 
         [0063]    Inter alia, operation  1015  may comprise, respectively, one or more of the following:
       (i) services  220 ,  230  and  240  sends an event notification to security manager  310 ;   (ii) services  220 ,  230  and  240  forwards a message to security manager  310 , when a data transaction occurs;   (iii) security manager  310  polls services  220 ,  230  and  240  for occurrence of data transactions.
 
In one embodiment of the present invention, polling is performed using a network API for the service.
       
 
       Operations  1020  and  1050 —Incoming Transaction 
       [0067]    At operation  1020 , security manager  310  causes end-user access to a new incoming transaction to be temporarily prevented, ensuring that security manager  310  accesses the new transaction prior to end users being able to access that transaction. At operation  1050 , security manager  310  cause end user access to the new transaction to be restored. In embodiments of the present invention, causing prevention and restoration are performed using a network API for the service. 
         [0068]    In one embodiment of the present invention, operation  1020  is performed by using network API calls to quickly move a new transaction from an end user accessible location, such as an end user&#39;s inbox, to a quarantine location, as soon as occurrence of the new transaction is discovered at operation  1015 . 
         [0069]    Operation  1020  may optionally include a workflow that is triggered when a transaction is moved to a quarantine location. The workflow may include causing the service to place a message in an end user accessible location, such as an end user&#39;s inbox, the message including an explanation of the quarantine operation, and some highlights from the quarantined transaction. The workflow may also or alternatively include causing the service to provide a link enabling an end user to request release of a transaction from quarantine, or receiving a request from a user to release a transaction and optionally prompting an administrator to allow or deny the user&#39;s request. 
         [0070]    Operation  1050  may be performed using network API calls to move a transaction from a quarantine location to an end user accessible location, such as an end user&#39;s inbox. Alternatively, operation  1050  may be performed by using API calls to generate a transaction that is identical to the quarantined transaction, and placing the thus-generated transaction in the end user accessible location. Operation  150  may optionally cause the service to add helpful text into a restored transaction, indicating that the transaction has been scanned and cleared. 
         [0071]    Operation  150  may further optionally check if a transaction to be restored includes hyperlinks and, if so, re-direct the hyperlinks to a safe browsing system that scans the content of a link destination upon activation of a hyperlink by a user, to check if the link destination is safe for browsing. 
         [0072]    In another embodiment of the present invention, operation  1020  is performed by setting security platform rules within the one or more data-exchange services  220 ,  230  and  240 , the rules causing the service to automatically move new transactions from end user accessible locations, such as end user inboxes, to quarantine locations. The security platform rules may be set manually or via network APIs. The security platform rules are created by cloud security manager  310 , and set to be applied within the one or more data-exchange services. The one or more data-exchange services apply these rules prior to placing new transactions being in an end user&#39;s inbox. 
         [0073]    If necessary for a particular cloud service, the security platform rules are set up so that they do not apply again to transactions that were restored at operation  1050 . If needed, restored transactions are marked with a special marking, and the security platform rules are defined so as to ignore transactions that are thus-marked. Furthermore, when special markers are used at operation  1045 , then for security purposes and as appropriate, the special markers are regularly changed from time to time, so that if a special marker is discovered by a hacker, he cannot use it for any length of time to bypass security manager  310 . 
         [0074]    The security platform rules may optionally be set up to be fail-safe; i.e., so that the enterprise does not lose access to services  220 ,  230  and  240  in case of a fatal failure of security manager  310 . Specifically, the security platform rules may be set up so as to expire after a short time period, such as after five minutes, or so as to apply to data during a specific short time period, such as during a five minute interval, and shortly before or after the end of such time period new security platform rules are set up for a next short time period. As such, if security manager  310  were to fail, then new transactions would not be processed by security manager  310 , and enterprise data center  100  would operate as if the security layer of cloud security platform  300  had not been added. Transactions being processed during failure of security manager  310  would be re-introduced to end users after the short time period, and the enterprise would lose access to services  220 ,  230  and  240  for at most five minutes. 
         [0075]    It is of advantage that the security platform rules move new transactions to quarantine locations that are not easily accessible to end users. The quarantine locations may be, for example, in a trash folder or a subfolder thereof. This embodiment has the advantage that contents of a trash folder generally go unnoticed by an end user. This embodiment has a further advantage that generally cloud services have a very simple API in place to restore a message from trash to its original location, which runs faster and scales better than restoring a message from a general quarantine folder. 
         [0076]    The quarantine locations may be, for example, within a folder that is invisible to an end user, including inter alia a root folder, with an empty string name “ ” as its parent folder, or subfolder thereof. This embodiment has the advantage that the folder exists but is invisible and inaccessible to an end user. 
         [0077]    In some embodiments of the present invention, a watch service is run, which identifies, via a network API, new transactions that are stuck in quarantine locations; i.e., transactions that were moved to a quarantine location at operation  1020 , but that have not yet been restored at operation  1050  after lapse of a long time, such as 15 minutes. The watch service causes the service to move such transactions back to user inboxes, automatically and/or conditionally, based on a policy configuration. The watch service provides a safety precaution that prevents a transaction from disappearing in case of an unexpected system problem or failure. 
         [0078]    Reference is made to  FIG. 6 , which is a simplified flowchart for a method  1100  for setting rules for cloud security, in accordance with an embodiment of the present invention. Method  1100  begins at optional operation  1110 , where a special marker is assigned, for marking restored data transactions, which already passed inspection. At operation  1120 , security platform rules are activated, with (i) expiration after a short time period, such as five minutes, (ii) an optional setting to ignore data transactions that are marked with the special marker set at operation  1110 , and (iii) with an optional first priority to precede any other rules set by an end-user but with a “no-stop” attribute so as not to preempt other rules set by an end-user. These settings ensure that the end users rules will be applied, but only after the security platform rules are applied. Regarding expiration of security platform rules, generally these rules are set so as to apply to transactions that arrive within a specific time period, such as a 5 minute time interval. If these rules are not refreshed after the time period, then they are no longer applied. As such, setting of their active time periods effectively sets their expiration. 
         [0079]    At operation  1130 , a decision is performed to determine whether or not the security platform rules have expired. If so, then the method returns to operation  1120  to re-activate the rules for a next short period of time. Otherwise, the method proceeds to optional operation  1140 , where a decision is performed to determine whether or not the special marker should be changed. For security purposes, the special marker is changed at regular periods of time, in case a hacker reverse engineers the marker and tries to by-pass the security platform rules. If the special marker should be changed, then the method returns to operation  1110  to re-set the marker. Otherwise, the method returns to operation  1130 . 
         [0080]    For an e-mail service  240 , operations  1020  and  1045  may comprise, respectively, inter alia one or more of the following:
       (i) security manager  310  causes service  240  to prevent end user access by causing service  240  to move the e-mail from an inbox of an end user to a quarantine folder or quarantine mailbox, and causes service  240  to restore end user access by causing service  240  to move the e-mail from the quarantine folder or quarantine mailbox to the inbox of the end user;   (ii) security manager  310  causes service  240  to prevent end user access by causing service  240  to remove an attachment from the e-mail, and causes service  240  to restore end user access by causing service  240  to reinsert the attachment into the e-mail;   (iii) security manager  310  causes service  240  to alter the e-mail, e.g., by adding text like “virus alert”, so that an end user sees the e-mail in his mailbox, but the e-mail has a subject line or message body with warning text alerting the user of a risk;   (iv) security manager  310  causes service  240  to prevent end user access by causing service  240  to replace an attachment of the e-mail with a substitute attachment, and causes service  240  to restore end user access by causing service  240  to reinsert the original attachment into the e-mail;   (v) security manager  310  causes service  240  to prevent end user access by causing service  240  to encrypt an attachment of an e-mail, and causes service  240  to restore end user access by causing service  240  to decrypt the encrypted attachment.       
 
         [0086]    For a file sharing service  230 , operations  1020  and  1045  may comprise, respectively, inter alia one or more of the following:
       (i) security manager  310  causes service  230  to prevent end user access by causing service  230  to instantly alter or revoke share access to the file, and causes service  230  to restore end user access by causing service  230  to re-share the file with its original recipients;   (ii) security manager  310  causes service  230  to prevent end user access by causing service  230  to instantly alter or revoke access rights to the file, and causes service  230  to restore end user access by causing service  230  to restore access rights to the file;   (iii) security manager  310  causes service  230  to prevent end user access by causing service  230  to move the file from a main folder to a quarantine folder, and causes service  230  to restore end user access by causing service  230  to move the file from the quarantine folder to the main folder;   (iv) security manager  310  causes service  230  to prevent end user access by causing service  230  to instantly designate the file as “online-only” such that the file cannot be downloaded, and causes service  230  to restore end user access by causing service  230  to designate the file as “downloadable”;   (v) security manager  310  causes service  230  to prevent end user access by causing service  230  to instantly change an end user access level of the file so that the file is not visible to the end user, and causes service  230  to restore end user access by causing service  230  to restore the end user access level of the file;   (vi) security manager  310  causes service  230  to prevent end user access by causing service  230  to encrypt the file, and causes service  230  to restore end user access by causing service  230  to decrypt the encrypted file;   (vii) security manager  310  causes service  230  to prevent end user access by causing service  230  to replace the original file with a substitute file, and causes service  230  to restore end user access by causing service  230  to replace the substitute file with the original file.       
 
       Operations  1020  and  1050 —Outgoing Transaction 
       [0094]    At operation  1020 , security manager  310  causes transmission of a new outgoing transaction to be prevented, ensuring that security manager  310  accesses the new transaction prior to that transaction being transmitted. At operation  1050 , security manager  310  transmits the new transaction to its destination. In some embodiments of the present invention, prevention and restoration are performed using a network API for the service. 
         [0095]    Some services  220 ,  230  and  240  allow for “delayed sending”, setting a delay time e.g., 30 seconds, during which time an end user may cancel transmission of a data transaction. Security manager  310  may use this time period to scan the transaction using content filters and data leakage prevention scanners. If the transaction is discovered to violate an enterprise policy, then at operation  1020  the transaction is moved to a quarantine folder and blocked from being transmitted. 
       Operation  1025  (Optional) 
       [0096]    At operation  1025 , security manager optionally causes the service to alerts recipient that the new transaction has been temporarily prevented, and that an inspection process is being performed. In one embodiment of the present invention, causing the alerting is performed using a network API for the service. 
         [0097]    Operation  1025  may comprise inter alia one or more of the following:
       (i) send a notification e-mail, resembling the newly arrived e-mail, to the same recipients as those of the newly arrived e-mail, with an explanation that the e-mail is being scanned, and/or instructions regarding the inspection process, and replace the notification e-mail with the newly arrived email after the latter passes inspection;   (ii) attach a notification file, instead of the original attachment, to a newly-arrived e-mail, with an explanation and/or instructions regarding the inspection process;   (iii) share a file, that has similar access rights and a similar name and folder to a newly shared file, with an explanation and/or instructions regarding the inspection process.       
 
         [0101]    It is noted that operation  1020  ensures that an end user does not have a chance to interact with not-yet-inspected data, and operation  1025  informs the end user that new data is currently being inspected. Operations  1020  and  1025  may occur simultaneously, before the actual inspection is conducted. Alternatively, operation  1025  may occur at another stage in the flowchart of method  1000 , and not necessarily between operations  1020  and  1030 . 
         [0102]    Operation  1035 —Incoming Transaction 
         [0103]    At operation  1035 , data inspector  320  inspects the data of a new incoming transaction. Data inspector  320  may use any of a variety of manual or automated content scanning technologies, as required by enterprise  100 . It is noted that operation  1035  does not need to be performed on-the-fly in real time, since end uses cannot interact with the data being inspected during operation  1035 . 
         [0104]    Reference is made to  FIG. 7 , which is a screen shot of a security stack interface, showing a configuration of cloud services and data inspectors, in accordance with an embodiment of the present invention. For each of a plurality of cloud services, such as services  220 ,  230  and  240 , an administrator selects which of a plurality of commercial content scanners are applied to that service. The configuration is displayed as a matrix for which each row is a different service, including inter alia:
       BOX® of Box.net, Inc. of Palo Alto, Calif., USA,   GMAIL® of Google, Inc. of Mountain View, Calif., USA,   OFFICE  365 ® One Drive of Microsoft Corporation of Redmond, Wash., USA, OFFICE  3   6   5 ® E-mail of Microsoft Corporation of Redmond, Wash., USA,   DROPBOX® of Dropbox, Inc. of San Francisco, Calif., USA,   GOOGLE® Drive developed by Google Inc. of Mountain View, Calif., USA,   SLACK® developed by Slack Technologies, Inc. of San Francisco, Calif., USA,   AMAZON® S3 cloud storage developed by Amazon Technologies,       
 
         [0112]    Inc. of Reno, Nev., USA, and
       EGNYTE® of Egnyte Inc. of Mountain View, Calif., USA, and   SHAREFILE® by Citrix Systems Inc. of Raleigh, N.C., USA.
 
Each column is a different content scanner, SCN 1 , SCN 2 , . . . , SCN  15 . The content scanners may include inter alia:
   SOPHOS® developed by Sophos plc Corporation of Oxfordshire, England,   CHECK POINT® developed by Checkpoint Software Technologies of Tel Aviv, Israel,   AHNLAB® developed by Ahnlab, Inc. of South Korea,   AVG® developed by AVG Netherlands B.V. of Amsterdam,   AVIRA® developed by Avira Operations GmbH of Germany,   BITDEFENDER® developed by Bitdefender IPR Management Ltd. of Cyprus,   ESET® developed by Eset spol. s. r. o. Corporation of Bratislava Slovakia,   KASPERSKY developed by Kaspersky Lab of Moscow, Russia,   F-PROT® developed by Cyren Inc. of McLean, Va., USA,   CYANCE® developed by Cylance Inc., of Irvine, Calif., USA, and   SYMANTEC® developed by Symantec Corporation of Mountain View, Calif., USA.       
 
         [0126]    Reference is made to  FIGS. 8-13 , which are respective screen shots of dashboards displaying results of several content scanners for six cloud services (Google Drive, Box.net, Office 365 One Drive, Office 365 E-mail, Gmail and Dropbox), in accordance with an embodiment of the present invention. 
         [0127]      FIG. 8  shows a dashboard console for Google Drive, displaying statistics of overall traffic and malicious content in a Security Stack zone, showing that Scanner #1 found 62 suspicious files out of a total of 215 files, Scanner #2 found 2 suspicious files out of the 215 files, Scanner #3 found 63 suspicious files out of the 215 files, Scanner #4 found 66 suspicious files out of the 215 files, and Scanner #5 found 69 suspicious files out of the 215 files. 
         [0128]      FIG. 9  shows a dashboard console for Box.net, displaying statistics of overall traffic and malicious content in a Security Stack zone, showing that Scanner #1 found 41 suspicious files out of a total of 382 files, Scanner #2 found 16 suspicious files out of the 382 files, Scanner #3 found 38 suspicious files out of the 382 files, Scanner #4 found 55 suspicious files out of the 382 files, and Scanner #5 found 67 suspicious files out of the 382 files. 
         [0129]      FIG. 10  shows a dashboard console for Office 365 One Drive, displaying statistics of overall traffic and malicious content in a Security Stack zone, showing that Scanner #1 found 1 suspicious file out of a total of 112 files, Scanner #2 found 1 suspicious file out of the 112 files, Scanner #3 found no suspicious files out of the 112 files, Scanner #4 found 3 suspicious files out of the 112 files, Scanner #5 found 1 suspicious file out of the 112 files, Scanner #6 found 1 suspicious file out of the 112 files, Scanner #7 found 3 suspicious files out of the 112 files, Scanner #8 found 2 suspicious files out of the 112 files, Scanner #9 found no suspicious files out of the 112 files, and Scanner #10 found 3 suspicious files out of the 112 files. 
         [0130]      FIG. 11  shows a dashboard console for Office 365 E-mail, displaying statistics of overall traffic and malicious content in a Security Stack zone, showing that Scanner #1 found 18 suspicious e-mails out of a total of 19,018 e-mails, Scanner #2 found 18 suspicious e-mails out of the 19,018 e-mails, Scanner #3 found 29 suspicious e-mails out of the 19,018 e-mails, Scanner #4 found 280 suspicious e-mails out of the 19,018 e-mails, Scanner #5 found 31 suspicious e-mails out of the 19,018 e-mails, Scanner #6 found 29 suspicious e-mails out of the 19,018 e-mails, Scanner #7 found 297 suspicious e-mails out of the 19,018 e-mails, Scanner #8 found 280 suspicious e-mails out of the 19,018 e-mails, Scanner #9 found 29 suspicious e-mails out of the 19,018 e-mails, and Scanner #10 found 300suspicious e-mails out of the 19,018 e-mails. 
         [0131]      FIG. 12  shows a dashboard console for Gmail, displaying statistics of overall traffic and malicious content in a Security Stack zone, showing that Scanner #1 found 1 suspicious e-mail out of a total of 409 e-mails, Scanner #2 found no suspicious e-mails out of the 409 e-mails, Scanner #3 found no suspicious e-mails out of the 409 e-mails, Scanner #4 found 323 suspicious e-mails out of the 409 e-mails, and Scanner #5 found 16 suspicious e-mails out of the 409 e-mails, Scanner #6 found 16 suspicious e-mails out of the 409 e-mails, Scanner #7 found 339 suspicious e-mails out of the 409 e-mails, Scanner #8 found 323 suspicious e-mails out of the 409 e-mails, Scanner #9 found no suspicious e-mails out of the 409 e-mails, and Scanner #10 found 59 suspicious e-mails out of the 409 e-mails. 
         [0132]      FIG. 13  shows a dashboard console for Dropbox, displaying statistics of overall traffic and malicious content in a Security Stack zone, showing that no files were processed. 
         [0133]    Reference is made to  FIG. 14 , which is a screen shot of a main dashboard displaying overall results for several cloud services, in accordance with an embodiment of the present invention.  FIG. 14  shows a dashboard visualization of statistics of overall traffic, malicious content blocked, and data-loss prevention (DLP). Specifically,  FIG. 14  indicates a total of 6,261 malicious files, and 365 malicious incoming files; a total of 1,066 files with data leaks, and 445 outgoing files with data leaks. 
         [0134]    Reference is made to  FIG. 15 , which is a screen shot of an analytics interface for cloud services, in accordance with an embodiment of the present invention.  FIG. 15  shows results of a queries submitted by an administrator. Specifically,  FIG. 15  indicates 2 driver&#39;s license files shared externally on Box.net, 34 credit card numbers shared externally on Google Drive, 44 company confidential files on Box.net, etc. 
         [0135]    Reference is made to  FIGS. 16 , which is a screen shot of an alerts interface for cloud services, in accordance with an embodiment of the present invention.  FIG. 16  shows visualizations of statistics of alerts made by security manager  310 . Specifically,  FIG. 16  indicates 11,676 alerts of which 9,266 are of high severity, 2,287 are of medium severity, 65 are of low severity, and 58 are of no severity; 11,675 of the alerts are new alerts, and 1 alert is dismissed; 6,333 of the alerts are from Amazon S3 cloud, 210 of the alerts are from Slack, 2,352 of the alerts are from Microsoft Office 365 e-mails, 406 of the alerts are from Egnyte, 613 of the alerts are from Gmail, 1,315 of the alerts are from Box.net, and 447 of the alerts are from Google drive. 
       Operation  1035 —Outgoing Transaction 
       [0136]    At operation  1035 , data inspector  320  inspects the data of a new outgoing transaction. Data inspector  320  may use any of a variety of manual or automated data leakage protection technologies, as required by enterprise  100 . 
       Operation  1055   
       [0137]    At operation  1055 , security manager  310  causes the service to perform a remedial action vis-à-vis the new transaction. In one embodiment of the present invention, causing of the remedial action is performed using a network API for the service. 
         [0138]    Operation  1055  may comprise inter alia one or more of the following:
       (i) causing the service to permanently prevent end user access to the data of the transaction;   (ii) causing the service to replace the data of the transaction with modified data;   (iii) causing the service to alerts an administrator of enterprise  100 .       
 
         [0142]    In addition, security manager  310  may conducts an analysis the data of the transaction possibly via a security analysis cloud service. 
       Policy Enforcement 
       [0143]    It will be appreciated by those skilled in the art that, in addition to scanning of content for data transactions, cloud security platform  300  provides security policy enforcement for enterprise  100 . 
         [0144]    Reference is made to  FIGS. 17-20 , which are self-explanatory simplified drawings of various policies enforced by cloud security system  300 , in accordance with an embodiment of the present invention. 
         [0145]      FIG. 17  shows a policy for data leakage scan and protection. 
         [0146]      FIG. 18  shows a policy for malware protection. 
         [0147]      FIG. 19  shows a policy for compliance enforcement for Saas login, using cloud security platform  300  as a single sign-on (SSO) proxy and using the EPOLICY ORCHESTRATOR® (ePO) developed by McAfee, Inc. of Santa Clara, Calif. 
         [0148]      FIG. 20  shows a policy for detection of anomalies including data leakage, internal threats, administrative breaches and lost devices. 
         [0149]    Reference is made to  FIGS. 21-26 , which are self-explanatory simplified drawings of various workflows performed by cloud security system  300 , in accordance with an embodiment of the present invention. 
         [0150]      FIG. 21  shows a workflow for time limits of external sharing. 
         [0151]      FIG. 22  shows a workflow for consent of sharing data with external users. 
         [0152]      FIG. 23  shows a workflow for external users offloading data. 
         [0153]      FIG. 24  shows a workflow for forwarding of shared content. 
         [0154]      FIG. 25  shows a workflow for termination of an enterprise employee including operations of blocking the employee login to enterprise services, un-sharing that employee&#39;s externally shared files, and remote wiping of that employee&#39;s synchronized files. 
         [0155]      FIG. 26  shows a workflow for backup and version management. 
       Implementation Details 
       [0156]    Appendix A includes a listing with APIs for implementing an embodiment of the present invention, for specific use with Microsoft Office 365 and Google Gmail. Appendix A is structured as follows. 
       OFFICE 365 
       [0000]    
       
         
           
             1. API for obtaining internal user data
           Example of obtaining internal user data   
         
             2. API for managing rules
           Example of rule creation   Example of rule removal   
         
             3. API for creating a folder 
             4. API for subscribing to web notification 
             5. API for downloading a message/attachment 
             6. API for moving a message to Inbox (release) 
             7. API for quarantining a message to Inbox (quarantine
           Example of quarantining a message   
         
             8. API for restoring a message to Inbox (restore)
           Example of restoring a message   
         
           
         
       
     
       GMAIL 
       [0000]    
       
         
           
             1. Creating an API object 
             2. API for obtaining user data 
             3. API for managing rules 
             4. API for creating labels 
             5. API for subscribing to notifications 
             6. API for reading emails from notifications 
             7. API for downloading attachments 
             8. API for changing labels (release) 
             9. API for quarantine and admin notification 
           
         
       
     
       Advantages 
       [0179]    It will thus be appreciate by those skilled in the art that embodiments of the present invention provide the following advantages vis-à-vis conventional enterprise security systems. Because these embodiments are network-API-based, then do not rely on a proxy and are not inline. They are immediately deployable and do not require changes to an enterprise network configuration, nor to the end user experience.
       These embodiments effectively block transactions in real-time without being inline.   These embodiments apply to remote data services, cloud-based services, and SaaS applications not under control of the enterprise.   These embodiments do not alter flow of data over a network, and thus do not adversely impact other functional components such as spam-filters, firewalls, routers and proxy servers.   These embodiments do not adversely impact latency and responsiveness of services  220 ,  230  and  240 .   These embodiments are transparent to end users, because their transactions are restored immediately upon completion of inspection.   These embodiments allow participants to partially continue a transaction while inspection of the sensitive components is taking place. For example, an email message will be available while its original attachments are being scanned.   These embodiments are fail-safe, and if security manager  310  fails, the flow of data continues normally. By not proxying traffic and being fail-safe, these embodiments do not introduce any new points of failure.   These embodiments use network-APIs provided by services  220 ,  230  and  240 , thus not requiring reverse-engineering, and not breaking support contracts.   These embodiments use the same configuration and network infrastructure for monitoring/detection and blocking/prevention. As such, the enterprise may start with detection and upgrade to prevention, by changing the configuration of cloud security platform  300 , without requiring changes to enterprise networks or to enterprise systems.   These embodiments may be selectively applied to specific users, so that they ignore other users. This has a clear advantage over proxy solutions, which proxy data for all users even if only a few users are being protected.   These embodiments are scalable for large enterprises.       
 
         [0191]    In the foregoing specification, the invention has been described with reference to specific exemplary embodiments thereof. It will, however, be evident that various modifications and changes may be made to the specific exemplary embodiments without departing from the broader spirit and scope of the invention. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense.