Cyberark Software Ltd.

Hadas Elkabir

Asaf Hecht

Arthur Bendersky

Tal Kandel

Tal Zigman

Evgeni Aizikovich

Boris Spivak

Yaron Nisimov

Omer Tsarfati

Michael Yavnilovich

Dor Simca

Shlomi Benita

Omar Tsarfati

Noam Zweig

Disclosed embodiments relate to systems and methods for automatically detecting and addressing security risks in code segments. Techniques include accessing a plurality of code segments developed for execution in a network environment, automatically identifying a first code segment from the plurality of code segments for analysis, automatically performing a first code-level security risk assessment for the first code segment, and determining a first security risk level for the first code segment based on the application programming interface risk level. The first code-level security risk assessment may be performed based on at least one of an application programming interface risk level, an embedded credentials risk level, and a target resource risk level. Further techniques may include determining a second security risk level for a modified version of the first code segment; and enabling a comparison between the first security risk level and the second security risk level.

Security risk assessment and control for code

Disclosed embodiments relate to uniquely identifying and validating identities based on electronic file fingerprints. Techniques include identifying an identity associated with a computing device; accessing fingerprinting data associated with an electronic file stored on or transmitted from the computing device; generating, based on a diversity of different properties of the fingerprinting data, a profile for the electronic file; accessing a repository storing profiles corresponding to a plurality of identities; comparing the generated profile with one or more of the stored profiles; determining whether the generated profile matches a stored profile, from the repository of stored profiles, associated with the identity; and validating, conditional on the matching, the identity.

Identity verification based on electronic file fingerprinting data

Described herein are methods, systems, and computer-readable storage media for managing cryptographic keys needed for peripheral devices to securely communicate with host computing devices. Techniques include receiving, at a centralized identity management resource, a first key that is part of a cryptographic key pair comprising the first key and a second key, wherein the second key is stored at a peripheral device for use by the peripheral device in encrypting data. Techniques further include identifying a first host computing device that is permitted to engage in secure communications with the peripheral device. Further, making available the first key from the centralized identity management resource to the first host computing device to enable the first host computing device to decrypt the encrypted data.

Coordinated management of cryptographic keys for communication with peripheral devices

Disclosed embodiments relate to verifying identities based on identity-inherent data that is inaccessible to the system. Techniques include receiving, from a client, an encrypted token, the encrypted token having been encrypted at the client using a cryptographic key created at the client based on identity-inherent data of an identity of the client; wherein the identity-inherent data of the identity is not itself received by the system, and wherein the cryptographic key is accessible only to the client; and storing the encrypted token in association with a hash of a decrypted version of the encrypted token to allow for comparing the stored hash with a created hash and determining whether to verify the identity based on a result of the comparing.

Verification of client identities based on non-distributed data

Disclosed embodiments relate to systems and methods for securely communicating data via encoded scannable codes. Techniques include identifying data to be communicated, identifying fictive data, accessing a manipulation factor, generating a scannable code comprising codes corresponding to the data and fictive data manipulated according to the manipulation factor, and making the code available for decoding by a scanning device. Further techniques include scanning a scannable code via a scanning device, separating the scannable code into multiple codes according to a manipulation factor, decoding the code(s) corresponding to the data to obtain the data, and refraining from decoding the code(s) corresponding to the fictive data. Techniques relating to other embodiments include identifying multiple data elements to be communicated, accessing multiple manipulation factors, generating a plurality of manipulated scannable codes corresponding to the data elements, and making the scannable codes available for decoding by a scanning device.

Manipulation and secure communication of encoded visual representations of data

Disclosed embodiments relate to systems and methods for distributed transmission of divisible and reconstructible data among network resources. Techniques include identifying data to be securely transmitted across a network to a receiving network resource; applying a splitting scheme to form one or more data portions; obtaining a unique session identifier; selecting a distribution scheme; accessing one or more cryptographic keys; encrypting one or more data portions to form a plurality of corresponding encrypted blocks; transmitting, according to the selected distribution scheme, the one or more of the plurality of encrypted blocks to one or more of the constituent network nodes, en route to the receiving network resource. The receiving network resource may be configured to, upon obtaining the one or more data portions, and with reference to the unique session identifier, combine and validate the one or more data portions.

Secure and reconstructible distribution of data among network resources

The disclosed embodiments include systems and methods for securing an asset-to-asset cloud communication environment. The disclosed embodiments may involve identifying an asset spun up in the cloud communication environment based on a notification identifying the spun up asset, determining that the spun up asset will require authorization to achieve at least some secure communication functionality with a different asset in the cloud communication environment, automatically authenticating the spun up asset based on authentication information from a trusted source to the spun up asset, automatically determining, based on the authenticating, whether the spun up asset is authorized to perform secure communication functionality with at least one different asset, and automatically performing a control action, based on the authenticating, to enable the spun up asset to perform the secure communication functionality with the at least one different asset.

Growing community of inventors

Hod Hasharon, Israel

Hadas Elkabir