Ca, Inc.

Proofpoint, Inc.

Nir Barak

Amir Jerbi

Itzhak Fadida

Eitan Hadar

Igal Weinstein

Guy Balzam

Yigal Meshulam

Tamir Pivnik

Miron Gross

Alex Korthny

Mayank Choudhary

Michael Kletskin

Shalom Shimoni

Yaacov Bezalel

Guy Ziv

Boris Traktirnik

Gabriel Kalmar

Ron Perlmuter

Alex Kremer

Serge Mankovskii

Ilan Kleinberger

Yaron Holland

Alexander Kremer

Rotem Gingold

Sagi Schechter

Tai Tikotzki

Efim Kulmov

Efim Kuimov

Tal Tikotzki

Miamon Dahan

Liliya Anissimov

Stefano Sali

Alex Kortney

Tal Yaffe

David Cohen

Laurent Lankri

Mike McKee

Azy Shalom

Ariel Lemelson

Yaakov Bezalel

Oded Tietz

Micky Oland

Tal Shemesh

Lior Calif

Lior Tal

Doron Seijffers

A system and method monitors access of an external storage device connected to a target device. A notification of a connection of the external storage device to the target device is received, a notification of an external file access on the external storage device is received, and activity of a user on the target device is monitored to detect a user operation accessing a source file stored on the target device. Events are logged based upon the connection, the user operation, and the external file access. Two or more of the events are associated with a copy of the source file to the external connected storage device and the source file history. An alert regarding the association is forwarded to a monitor application in communication with the target device.

Context based authorized external device copy detection

A computer-based method includes monitoring user activities at an endpoint device on a computer network, determining if one of the user activities at the endpoint device presents a potential threat to network security, creating an alert of the potential threat, and providing, with the alert, a redacted version of a screenshot from the endpoint device. One or more open windows that appeared on the screen of the endpoint device are obscured or removed in the redacted version of the screenshot of the endpoint device.

Focused image grabbing

A system monitors access to a computer file via a dynamically changeable non-heterogeneous collection load balanced across two hash tables. User activity is monitored on a target device to detect a user entered pattern including a wildcard character. A server in communication with the target device, receives the user entered pattern, selects one of the two hash tables, and calculates an index for the selected hash table based on the user entered pattern. The index is used to access the selected hash table to receive a stored pattern. The hash tables each have a plurality of entries, and each entry includes a list of one or more patterns that have the same hash index but different pattern values sorted by length in characters from longest to shortest.

System and method for scalable file filtering using wildcards

A computer-based method of reducing or limiting data transmissions from a computer to a remote network destination includes receiving an indication, at an agent on a computer, that a recent user activity has occurred at the computer. The indication typically includes data relevant to user context when the user activity occurred. The method further includes determining, with the agent, whether the data relevant to the user's context when the user activity occurred indicates that a change in user context relative to a user activity at the computer immediately prior to the recent user activity and conditioning a transmission of data relevant to the recent user activity from the computer to a remote network destination based on an outcome of the determination.

Reduction of data transmissions based on end-user context

A system for preventing duplication of a computer source file to a destination file includes a user application accessed by a user of a computer. An agent application hosted by the computer registers for a notification of a user interface action with an operating system (OS) of the computer. The agent receives notice from the OS of the user interface action and determines if the user interface action is indicative of a data file duplication operation of a source file to a destination file location The Agent compares a property of the source file and a property of the destination file location to a blocking criteria, and blocks the user interface action from reaching the application.

System and method for light data file duplication prevention

A computer-based method includes: receiving an indication from a computer's operating system that a user has performed a first action that may have caused a context menu with a paste option to open on a screen of the computer, and subsequently receiving an indication from the computer's operating system that the user has performed a second action at the computer that may have amounted to a selection of the paste option on the context menu. In response to the indication from the computer's operating system that the user has performed the second action, the method includes determining if the second action by the user amounted to a selection of the paste option on the context menu and thereby cause a paste action to occur.

Detecting paste and other types of user activities in computer environment

A computer-based method is disclosed to facilitate managing data exfiltration risk in a computer network environment. The method includes collecting computer file management information associated with each respective one of a plurality of computer files in an organization's computer network environment from a computer operating system, collecting user activity information associated with each respective one of a plurality of user sessions by users having access to the organization's computer network environment with a plurality of session monitoring agents, correlating at least some of the collected user activity information to one or more of the computer files associated with the collected file management information; and assessing data exfiltration risk with respect to one or more of the computer files based at least in part on some of the file management information and the correlated user activity information associated with a file history chain.

Managing data exfiltration risk

Reduction of data transmissions based on end-user content

Provided herein are systems and methods for providing isolated virtual image communication in a virtual computing environment. Initially, a guest virtual machine that is activated in a virtual computing environment may be isolated into a private network. A service request may then be formulated at the guest virtual machine and addressed to a predetermined non-existent address. The request is then ostensibly sent to the predetermined address, whereupon the service request is actually transmitted to a shared resource with a security appliance machine in the virtual computing environment. The request is then forwarded to the security appliance machine and a reply formulated. The reply is sent back to the guest virtual machine via the shared resource.

System and method for isolated virtual image and appliance communication within a cloud environment

Sanitizing passwords used in a shared, privileged account includes providing a password of a shared account to a user; identifying a first machine logged into using the password; determining when the first machine enters an inconsistent state; and modifying a memory area associated with the first machine to eliminate occurrences of the password in the memory area.

Privileged shared account password sanitation

A method includes receiving a target credential object having administrative rights over a first user account located on a target system. The first user account includes a log-in permission for the target system. The method also includes receiving data indicative of a second user account corresponding to the first user account, wherein the second user account is located on a local system. The method further includes sending a first request to remove the log-in permission from the first user account to the target system using the target credential object. The method still further includes receiving a log-in request corresponding to the second user account on the local system. The method additionally includes, in response to receiving the log-in request for the second user account, sending a second request to add the log-in permission on the first user account to the target system using the target credential object.

Managing privileged shared accounts

A method for requiring justifications for predetermined user operations may include maintaining a plurality of policies in a policy store, and detecting a user operation, via a policy module, that triggers a policy of the plurality of policies. The method may also include pausing user operation, notifying the user of the impact of the user operation that triggered the policy, and requesting justification from the user for the user operation. The method may further include storing user-provided justification in a predetermined location, and then resuming the user operation.

System that enforces accountability by requiring justifications for sensitive information technology operations

Systems and methods of implementing a secured cloud environment allow for design and instantiation of a security policy at the infrastructure level. An example system may comprise a first module to facilitate selecting at least two cloud computing component templates from a cloud computing component catalog. The system may comprise a second module to facilitate defining a connection between the at least two selected cloud computing component templates. The system may comprise a third module to facilitate assigning a security level and a policy to at least one of the at least two selected cloud computing component templates. The system may comprise a fourth module to facilitate building a cloud computing component blueprint.

Trusted public infrastructure grid cloud

A method for providing seamless access to a first account using authentication information associated with a second account includes receiving a first account identifier corresponding to the first account, the first account being a shared account on a computer system. The method also includes receiving submitted authentication information associated with the second account. The method also includes comparing the submitted authentication information with stored authentication information that is associated with a plurality of authorized accounts. The plurality of authorized accounts is associated with clients authorized to access the first account. The method also includes determining whether the second account is an authorized account based on comparing the submitted authentication information with the stored authentication information. The method also includes providing seamless access to the first account in response to determining that the second account is an authorized account.

Providing seamless and automatic access to shared accounts

Growing community of inventors

Karmi Yosef, Israel

Nir Barak