Microsoft Technology Licensing, LLC

Aharon Naftali Michaels

Josef Weizman

Ram Haim Pliskin

Dotan Patrich

Idan Yehoshua Hen

Amit Magen

Generally discussed herein are devices, systems, and methods for cloud resource security. A method can include receiving, at a monitor device and from a first cloud resource of cloud resources hosted by a cloud provider, a request for a token that uniquely identifies the first cloud resource, the request indicating a destination that is a metadata server. The method can include comparing, based on entries in an application programming interface (API) access log, the cloud provider associated with the first cloud resource and a cloud provider associated with the metadata server. The method can include responsive to the cloud provider of the first cloud resource being different from the cloud provider of the metadata server performing a security mitigation action.

Cloud attack detection via API access analysis

Embodiments detect risky situations in which a domain name record remains viable after the target it identified is not. Such dangling records create various risks because substitute targets, such as fraudulent websites, may be installed without the knowledge of the original target's owner. By obtaining and correlating data from multiple tenants, a cloud service provider detects dangling structures and any attempts to exploit them. Dangling records may specify a custom domain name, for example, or a static IP address that can be misused. In response, the provider's security infrastructure can alert the original target's owner, block the attempted exploit, or otherwise mitigate the risks. Traffic monitoring, control plane API invocations, and domain name server queries may be employed by the security infrastructure to detect resource deletion, resource creation, and resource access attempts that correspond with vulnerable records or suspect activity involving them.

Dangling domain detection and access mitigation

Technologies are shown for detection of identity misconfiguration that involve collecting identity/role binding and role/access rules data from multiple clusters supported by a computing resource system. Access rules for identities are extracted from the collected data and an access rule prediction model created to predict access rules for identities. An identity definition request for a tenant is received having a requested identity and a role assigned to the identity. A set of access rules is obtained for the role assigned to the identity and a predicted set of access rules is obtained for the requested identity from the prediction model. The access rules for the requested role are compared to the predicted set of access rules and a misconfiguration alert generated when there is a difference between the set of access rules for the requested role and the predicted set of access rules for the requested identity.

Growing community of inventors

Beit Shemesh, Israel

Aharon Naftali Michaels