Xage Security, Inc.

Qualys, Inc.

Shape Security, Inc.

Ganesh B Jampani

Susanto Junaidi Irwan

Andy Sugiarto

Roman M Arutyunov

Kenneth K Okumura

Wolfgang Kandek

Holger Kruse

Wissam Ali-Ahmad

Vikas Dewan

Khair-ed-dine Mazboudi

Bao Q Ngo

Dhananjayan Santhanakrishnan

Jeffrey Charles Venable, Sr

Kd Mazboudi

Vishal Gupta

Roman Arutyunov

In one embodiment, a method may implement a multi-layer cybersecurity model for a multi-layer distributed computer system which comprises a sensitive data resource, such as a computing environment with an operational technology (OT) layer with multiple zones, an information technology (IT) layer, a DMZ, and a cloud layer. The method can assess a policy based on a zero-trust model for the sensitive data resource. The method can receive one or more requests, at any layer of a multi-layer distributed computing system, to access the sensitive data resource and acquire identity information for a user account specified in the first request. The method can perform a multi-layer multi-factor authentication of the user account using the identity information and the multi-layer cybersecurity model. In response to authenticating the identity information, the method can acquire sensitive access data corresponding to the identity information. The method can determine a sensitive resource access value using the sensitive access data and the zero trust model. In response to determining the sensitive resource access value is above a predetermined threshold, the method can authenticate the user account.

Zero-trust cybersecurity enforcement in operational technology systems

Methods and systems for scanning an endpoint terminal across an open computer network are disclosed. An exemplary method includes providing a scanner engine in a computer server in communication with an open computer network, and establishing a secure connection across the open computer network between the scanner engine and a scanner agent installed on the endpoint terminal in communication with the open computer network. Commands for collecting data regarding the endpoint terminal are sent from the scanner engine across the secure connection to the scanner agent. The scanner engine then receives the collected data from the scanner agent across the secure connection, analyzes the data to assess a current posture of the endpoint terminal, and determines any updates for the endpoint terminal from the analysis. Updates are sent across the secure connection to the scanner agent for installation on the endpoint terminal, and the secure connection may then be terminated.

System and method for performing remote security assessment of firewalled computer

A computer-implemented method comprises accessing, by a networking hardware device, identity awareness data for a plurality of client computing devices and device security policies of a plurality of IoT computing devices from at least one distributed data repository; authenticating, by the networking hardware device, a client computing device requesting access to at least one Internet of Things (IoT) computing device, based on the accessed identity awareness data; establishing, at the networking hardware device, firewall rules based on the accessed device security policies; creating, by the networking hardware device, a session for the authenticated client computing device to communicate with the at least one IoT computing device, wherein creating a session comprises posting information relating to the session as authentication session information to the at least one distributed data repository.

Inline filtering to secure access and data between user and application to device and between device to device

In an embodiment, a computer-implemented method comprising: posting, by a broker computing device, device control data to a distributed datastore including distributed ledger and blockchain, wherein the device control data is collected at a plurality of directory services in a federation; receiving, at a computing hardware device, the device control data from the distributed datastore; using, by the computing hardware device, the device control data received from the distributed datastore, remotely managing user accounts and access control and security policies on at least one networked device.

Centrally managing data for orchestrating and managing user accounts and access control and security policies remotely across multiple devices

In an embodiment, a computer-implemented method comprises receiving, by at least one broker computing devices, identity awareness data from a plurality of directory services in a federation; posting, by the at least one broker computing device, the identity awareness data to a distributed data repository; establishing, at a networking hardware device having a first type, firewall rules using the identity awareness data from the distributed data repository; controlling, by the networking hardware device having the first type, network traffic based on the identity awareness data.

Centrally managing data for distributed identity-based firewalling

In an embodiment, a computer-implemented method comprises, receiving an authentication request from a first computing device; in response to receiving the authentication request from the first computing device, performing one or more authentication services on behalf of a second computing device using identity information that is stored in a first data repository; generating, based on data from an access control list maintained at the second computing device, a list of one or more third computing devices; receiving a request from the first computing device to access a third computing device in the list of one or more third computing devices; generating service identity information for authenticating to the third computing device and storing the service identity information in a second data repository; and performing one or more authentication services on behalf of the first computing device using the service identity information that is stored in the second data repository.

Single authentication portal for diverse industrial network protocols across multiple OSI layers

In an embodiment, a computer-implemented method comprises, receiving, at a first server, a plurality of certificates and an inventory list and storing the plurality of certificates and the inventory list in a blockchain; receiving, at a second server associated with the blockchain, a validation request from a device and validating the device; in response to validating the device, receiving, at the second server, a certificate request from the device and verifying the certificate request against the inventory list stored in the blockchain; and in response to verifying the certificate request, enrolling the device by sending a certificate from the plurality of certificates stored in the blockchain to the device.

Decentralized enrollment and revocation of devices

A computer-implemented method provides an improvement in security breach detection and comprises using a broker computing device, sending an initial digital fingerprint of a computing device out-of-band for storing in a distributed data repository, wherein the initial digital fingerprint is based on initial security service data of the computing device; using a gateway computing device, remotely calculating a current digital fingerprint of the computing device based on current security service data of the computing device; using the gateway computing device, conducting a real-time out-of-band health check of the computing device based, at least in part, on the initial digital fingerprint stored in the distributed data repository; and using the gateway computing device, in response to conducting the real-time out-of-band health check, determining whether to restore the computing device with configurations consistent with the initial digital fingerprint stored in the distributed data repository.

Protocol agnostic security by using out-of-band health checks

A computer-implemented method comprises posting, by a broker computing device, identity awareness data for a plurality of client computing devices to a distributed data repository (DDP); receiving, by a networking hardware device, the identity awareness data from the DDP; using, by the networking hardware device, the identity awareness data from the DDP to authenticate a client computing device requesting access to at least one Internet of Things (IoT) computing device; in response to authenticating the client computing device, creating, by the networking hardware device, a session for the client computing device to communicate with the at least one IoT computing device, wherein creating a session comprises: opening a port on the networking hardware device, wherein communication between the client computing device and the at least one IoT computing device is through the port; posting information relating to the session as authentication session information to the DDP.

A computer-implemented method provides an improvement in security breach detection and comprises calculating a digital fingerprint based on security service data of a computing device, and sending the fingerprint out-of-band for storing in a data repository; generating encrypted current security service data from the computing device and sending the encrypted current security service data out-of-band to a gateway computing device; using the gateway computing device, receiving the encrypted current security service data out-of-band and conducting a real-time out-of-band health check of the computing device based, at least in part, on the fingerprint that is stored in the data repository; and using the gateway computing device, in response to conducting the real-time out-of-band health check, determining whether to allow access to in-band communication data.

Protocol agnostic security by using out-of-band health check

In an embodiment, a computer-implemented method comprises: in response to receiving a first authentication request from one or more first computing devices, authenticating the first computing devices on behalf of a first client device using a first set of identity information; in response to authenticating the first computing devices, generating and queuing a first set of one or more transactions corresponding to at least one of the one or more first computing devices; in response to receiving a second authentication request from the first client device configured to access the first set of one or more transactions, authenticating the first client device on behalf of a second computing device using a second set of identity information that is associated with the first client device; in response to performing the second authentication service, encrypting and sending the first set of one or more transactions to the first client device.

Enabling multitenant data access on a single industrial network

In an embodiment, a computer-implemented method comprises receiving, at multiple broker computing devices, device control data from a plurality of directory services in a federation; posting, by the broker computing devices, the device control data to a distributed datastore including distributed ledger and blockchain; receiving, at a computing hardware device, the device control data from the distributed datastore; in response to receiving the device control data from the distributed datastore, remotely managing, by the computing hardware device, user accounts and access control and security policies on at least one networked device.

Growing community of inventors

San Francisco, CA, United States of America

Ganesh B Jampani