Palo Alto Networks, Inc.

Andrew Clayton Scott

Matthew Kraning

Peter Dickinson

Corey Fredericks

Techniques for identifying and managing an organization's remote attack surface that account for the fluid nature of the remote attack surface are described. Data collected from organization-issued endpoint devices are obtained and analyzed to determine public IP addresses used by the endpoint devices. The devices connected to external networks (i.e., non-organization networks) at various time windows are identified by distinguishing between public IP addresses that are associated with the organization and those that are not. Data obtained from ongoing global probing of public IP addresses, which at least indicate software instances hosted on networks corresponding to the public IP address, are correlated with each public IP address determined to be associated with an external network to which an endpoint device has connected. From these data, any security risks that connections to external networks may pose to the organization's network can be identified.

Growing community of inventors

Westfield, IN, United States of America

Andrew Clayton Scott