Cyberark Software Ltd.

Nimrod Stoler

Lavi Lazarovitz

Disclosed embodiments relate to systems and methods for securely provisioning sensitive data elements to virtualized execution instances. The techniques may include: identifying a request to provision a new virtualized execution instance; determining, in association with the request, that the new virtualized execution instance will require a prohibited data element in order to communicate with a target network resource; without providing the new virtualized execution instance the prohibited data element, registering the new virtualized execution instance; identifying a request from the new virtualized execution instance to communicate with the target network resource: performing a verification process for the request to communicate with the target network resource; and conditional on the verification process, provisioning the prohibited data element to the new virtualized execution instance.

Securing privileged virtualized execution instances

Disclosed embodiments relate to systems and methods for securely provisioning sensitive data elements to virtualized execution instances. The techniques may include: identifying a request to provision a new virtualized execution instance; determining, in association with the request, that the new virtualized execution instance will require a prohibited data element in order to communicate with a target network resource; without providing the new virtualized execution instance the prohibited data element, registering the new virtualized execution instance; identifying a request from the new virtualized execution instance to communicate with the target network resource; performing a verification process for the request to communicate with the target network resource; and conditional on the verification process, provisioning the prohibited data element to the new virtualized execution instance.

Memory management in virtualized computing environments

Disclosed embodiments relate to systems and methods for identifying vulnerabilities for virtualized execution instances to escape their operating environment and threaten a host environment. Techniques include identifying a virtualized execution instance configured for deployment on a host in a virtual computing environment; performing a privileged configuration inspection for the virtualized execution instance, the privileged configuration inspection analyzing whether the virtualized execution instance has been configured with one or more attributes that can permit operation of the virtualized execution instance to perform operations, beyond an environment of the virtualized execution instance, on an environment of the host; and implementing, based on the privileged configuration inspection, a control action for controlling the virtualized execution instance's ability to perform operations on the environment of the host.

Securing privileged virtualized execution instances from penetrating a virtual host environment

Secure and temporary access to sensitive assets by virtual execution instances

Disclosed embodiments relate to secure and reliable customization of operating system kernels. Techniques include configuring a kernel security module for loading to an operating system kernel to run kernel-level scripts on the kernel, the kernel security module being configured to perform a security verification comprising operations of: identifying, at the kernel security module, a script received at the kernel security module for requested execution by the kernel, and verifying whether the script has a valid signature; determining, at the kernel security module and based on the security verification, whether to permit the script to be processed by the kernel; and identifying, based on the determining, executable code corresponding to the script to execute at the kernel.

Customizing operating system kernels with secure kernel modules

Disclosed embodiments relate to systems and methods for dynamically analyzing and enrolling virtualized execution instances. Techniques include identifying a request for enrollment for a virtualized execution instance configured to be deployed on a host in a virtual computing environment, the request including a result of a privileged configuration inspection for the virtualized execution instance; determining, based on the result of the privileged configuration inspection, to automatically enroll the virtualized execution instance; and including the virtualized execution instance in a group of enrolled virtualized execution instances, the group being available for secure communications with one or more clients in a manner that is isolated from the host.

Systems and methods for dynamically enrolling virtualized execution instances and managing secure communications between virtualized execution instances and clients

Disclosed embodiments relate to systems and methods for implementing secure and multi-factor authentication for computing resources. Techniques include accessing at least one portion of identity data for a computing resource; providing the at least one portion of the identity data to the computing resource; identifying network address information unique to the computing resource; identifying a request, from the computing resource, to perform an action requiring an access token; provisioning the network address information unique to the computing resource, for use in transmitting the access token to the computing resource; and verifying both the at least one portion of the identity data and the network address information unique to the computing resource.

Growing community of inventors

Zoran, Israel

Nimrod Stoler