Wiz, Inc.

Elad Gabay

Yaniv Shaked

Ami Luttwak

Alon Schindel

Shahar Rand

Eric Abramov

Roy Reznik

Yinon Costica

A system and method for risk and constraint-based cybersecurity inspection of a computing environment is presented. The method includes querying an application programming interface (API) of a computing environment to detect a plurality of workloads deployed therein; determining a constraint for inspection of the computing environment; provisioning resources of the computing environment to an inspection account based on the determined constraint; and initiating inspection of the plurality of workloads utilizing the provisioned resources.

Techniques for risk and constraint-based inspection

A system and method detect a malware infection path in a compute environment. The method includes detecting a malware object on a first workload in a computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph including an endpoint node representing a resource which is accessible to a public network; generating a potential infection path between the resource node and the endpoint node including at least a second resource node connected to the resource node; inspecting a second workload of the plurality of workloads represented by the second resource node; determining that the potential infection path is a confirmed infection path, in response to detecting the malware on the second workload; and determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware.

Detecting malware infection path in a cloud computing environment utilizing a security graph

A system and method reduces use of restricted operations in a cloud computing environment during cybersecurity threat inspection. The method includes: detecting an encrypted disk in a cloud computing environment, the encrypted disk encrypted utilizing a first key in a key management system (KMS); generating a second key in the KMS, the second key providing access for a principal of an inspection environment; generating a snapshot of the encrypted disk; generating a volume based on the snapshot, wherein the volume is re-encrypted with the second key; generating a snapshot of the re-encrypted volume; generating an inspectable disk from the snapshot of the re-encrypted volume; and initiating inspection for a cybersecurity object on the inspectable disk.

Techniques for circumventing provider-imposed limitations in snapshot inspection of disks for cybersecurity

Growing community of inventors

Tel Aviv, Israel

Elad Gabay