Cloud security policy enforcement for custom web applications

A system for implementing cloud security policy enforcement for web applications being used by an enterprise, the system comprising:

• at least one hardware processor;
• and
• a memory coupled with the at least one hardware processor, wherein the memory is configured to provide the at least one hardware processor with instructions which when executed cause the at least one hardware processor to:
• classify security-related application activities relating to a web application into at least a first group of application activities, a second group of application activities, and a third group of application activities, wherein a first portion of the security-related application activities is classified into the first group of application activities, wherein being classified into the first group indicates that the first group of application activities are each to be mapped to one of a plurality of activity categories, wherein a second portion of the security-related application activities are classified into the second group of application activities, wherein being classified into the second group indicates that second group of application activities are each to be ignored, wherein a third portion of the security-related application activities are classified into the third group of application activities, wherein being classified into the third group indicates that the third group of application activities cannot be mapped to any of the plurality of activity categories, and wherein each of the first portion of the security-related application activities, the second portion of security-related application activities, and the third portion of the security-related application activities is different;
• generate an alert in response to an application activity being classified into the third group, wherein the alert indicates that the application activity should be reviewed and that the plurality of activity categories may need to be updated to include the application activity;
• and
• for each application activity of the first portion of the security-related application activities relating to the web application:
• map the application activity to one of the plurality of activity categories based on a signature of the application activity;
• associate a corresponding set of one or more security enforcement policies of the mapped activity category to the application activity;
• and
• apply the corresponding set of one or more security enforcement policies to network traffic corresponding to the application activity based on the application activity being mapped to the mapped activity category.

A non-transitory computer-readable medium containing computer executable instructions that, when executed by at least one processor, cause the at least one processor to perform a method for implementing cloud security policy enforcement for web applications being used by an enterprise, the method comprising:

• classifying security-related application activities relating to a web application into at least a first group of application activities, a second group of application activities, and a third group of application activities, wherein a first portion of the security-related application activities is classified into the first group of application activities, wherein being classified into the first group indicates that the first group of application activities are each to be mapped to one of a plurality of activity categories, wherein a second portion of the security-related application activities are classified into the second group of application activities, wherein being classified into the second group indicates that second group of application activities are each to be ignored, wherein a third portion of the security-related application activities are classified into the third group of application activities, wherein being classified into the third group indicates that the third group of application activities cannot be mapped to any of the plurality of activity categories, and wherein each of the first portion of the security-related application activities, the second portion of security-related application activities, and the third portion of the security-related application activities is different;
• generating an alert in response to an application activity being classified into the third group, wherein the alert indicates that the application activity should be reviewed and that the plurality of activity categories may need to be updated to include the application activity;
• and
• for each application activity of the first portion of the security-related application activities relating to the web application:
• mapping the application activity to one of the plurality of activity categories based on a signature of the application activity;
• associating a corresponding set of one or more security enforcement policies of the mapped activity category to the application activity;
• and
• applying the corresponding set of one or more security enforcement policies to network traffic corresponding to the application activity based on the application activity being mapped to the mapped activity category.