Cyberark Software Ltd.

Lavi Lazarovitz

Andrey Dulkin

Tal Kandel

Nimrod Stoler

Asaf Hecht

Yair Sade

Matan Hart

Roi Cohen

Omer Benedict

Jessica Stanford

Doron Aharon Naim

Disclosed embodiments relate to systems and methods for securely provisioning sensitive data elements to virtualized execution instances. The techniques may include: identifying a request to provision a new virtualized execution instance; determining, in association with the request, that the new virtualized execution instance will require a prohibited data element in order to communicate with a target network resource; without providing the new virtualized execution instance the prohibited data element, registering the new virtualized execution instance; identifying a request from the new virtualized execution instance to communicate with the target network resource; performing a verification process for the request to communicate with the target network resource; and conditional on the verification process, provisioning the prohibited data element to the new virtualized execution instance.

Memory management in virtualized computing environments

Disclosed embodiments relate to systems and methods for automatically mediating among diversely structured operational policies. Techniques include identifying a first communication of a computing resource that is associated with an operational policy, identifying a second computing resource, determining if there is a conflict between the first communication and the second computing resource, applying a language processing protocol to the communication, normalizing the communication and policy, and generating a mediated communication. Other techniques include transmitting the mediated communication, generating a recommendation for implementing a security control on the first communication, and applying a security policy to the first communication.

Understanding and mediating among diversely structured operational policies

Disclosed embodiments relate to systems and methods for automatically processing diversely structured operational policies. Techniques include identifying a policy associated with an application or computer code; applying a language processing protocol to the policy to interpret the policy and extract attribute(s) of the policy, where the policy is defined using a vocabulary and syntax; normalizing the policy to define the policy using a standardized vocabulary and syntax agnostic to an infrastructure or service associated with the application or computer code, where one or more of the vocabulary and syntax are respectively different from the standardized vocabulary and syntax and where normalizing the policy comprises translating the attribute(s) of the policy; and evaluating the policy based on the normalizing to determine whether a potentially malicious activity is associated with the application or computer code.

Disclosed embodiments relate to systems and methods for identifying vulnerabilities for virtualized execution instances to escape their operating environment and threaten a host environment. Techniques include identifying a virtualized execution instance configured for deployment on a host in a virtual computing environment; performing a privileged configuration inspection for the virtualized execution instance, the privileged configuration inspection analyzing whether the virtualized execution instance has been configured with one or more attributes that can permit operation of the virtualized execution instance to perform operations, beyond an environment of the virtualized execution instance, on an environment of the host; and implementing, based on the privileged configuration inspection, a control action for controlling the virtualized execution instance's ability to perform operations on the environment of the host.

Securing privileged virtualized execution instances from penetrating a virtual host environment

An endpoint configured for adaptively generating responses to data queries, comprising program store for storing code, and one or more processors of an endpoint coupled to the program store for executing the code which comprises:

Adaptive response generation on an endpoint

Secure and temporary access to sensitive assets by virtual execution instances

Disclosed embodiments relate to systems and methods for automatically processing diversely structured operational policies. Techniques include identifying first and second operational policies, determining if the policies use different vocabulary or syntax, applying a language processing protocol to the policies, and normalizing the policies. Other techniques include making available the normalized policies to a computing resource, identifying a set of related rules based on the normalizing, identifying that one of the polices has an unnecessarily high level of privileges, and reducing the level of privileges according to a least-privileges policy.

Analyzing diversely structured operational policies

Disclosed embodiments include identifying a first identity having a first level of privileged network access, identifying a network resource that the first identity is communicating with, classifying the network resource as a network resource to be dynamically monitored, dynamically monitoring connections activity of the identified network resource to determine a second identity, wherein the second identity is determined based on it having a second level of privileged network access that is different from the first level of privileged network access and having attempted to establish a connection with the network resource, classifying, based on the determination of the second identity, the network resource as a potential source of privileged access escalation vulnerabilities, and performing, based on the classification that the network resource is a potential source of privileged access escalation vulnerabilities, at least one of: triggering an alert regarding the potential source of privileged access escalation vulnerabilities, performing a network security remediation operation for at least one of the first identity, the second identity, and the network resource, and identifying a plurality of other identities with levels of privileged network access different from the first level of privileged network access and that have attempted to establish connections with the network resource.

Actively identifying and neutralizing network hot spots

Described herein are systems and methods for detecting potentially malicious activity in a network session. Embodiments may involve identifying a requested network session between a first computer device and a second computer device, wherein the requested network session includes at least one security access message having an encrypted portion, obtaining a decryption key suitable for decrypting the encrypted portion of the security access message, decrypting the encrypted portion of the security access message with the decryption key, identifying a session key within the decrypted portion of the security access message, decrypting an application message that has been transmitted between the first computer device and the second computer device in the requested network session using the session key, and determining whether the decrypted application message includes an indicia of potentially malicious activity.

Detecting and reacting to malicious activity in decrypted application data

Described herein are systems and methods for performing potentially malicious activity detection operations. Embodiments may include receiving data associated with a plurality of authentication messages; analyzing the received data associated with the plurality of authentication messages; determining, based on the analyzing, a plurality of characteristics of the data associated with the authentication messages; receiving data associated with a new authentication message communicated over the network; determining a plurality of characteristics of the data associated with the new authentication message; comparing at least one determined characteristic of the new authentication message data with at least one of: a determined characteristic of the plurality of authentication messages data, known valid data, and known invalid data; and generating, based on the comparison, an assessment of whether the new authentication message is indicative of the potentially malicious activity in the network.

Systems and methods for detecting and reacting to malicious activity in computer networks

Described herein are systems and methods for performing operations responsive to potentially malicious activity. Embodiments may include receiving an indication of the potentially malicious activity in a computer network; identifying, based on data included in the indication, at least one network account associated with the potentially malicious activity; determining, based on the identifying and further based on the data included in the indication and according to a defined policy, at least one responsive operation with respect to the at least one identified network account; and invoking, based on the determining, the at least one responsive operation, the at least one responsive operation being implemented to mitigate the potentially malicious activity in the computer network.

Growing community of inventors

Petach-Tikva, Israel

Lavi Lazarovitz