Wiz, Inc.

Niv Roit Ben David

Raaz Herzberg

Ami Luttwak

Roy Reznik

Yarin Miran

Yaniv Joseph Oliver

Osher Hazan

Yinon Costica

Daniel Hershko Shemesh

Yaniv Shaked

Amir Lande Blau

Or Heller

Avihai Berkovitz

George Pisha

Udi Reitblat

Karin Magriso

Isaac Schnitzer

A system and method for detecting lateral movement in a cloud computing environment is based on configuration code. The method includes: accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a cloud entity deployed in the cloud computing environment; selecting an identifier of an exposed cloud entity, the cloud entity associated with a secret; querying a security graph based on the identifier to detect a node representing the secret, wherein the node representing the secret is connected to a node representing the exposed cloud entity; traversing the security graph to detect a second node connected to the node representing the secret, the second node representing a second cloud entity deployed based on the code object of the plurality of code objects; and generating a mitigation action based on the second cloud entity.

Techniques for lateral movement detection in a cloud computing environment

A system and method for applying a unified security policy across a technology stack, includes detecting a cloud object in a first cloud computing environment, the cloud object including a plurality of attributes, each attribute having a corresponding value; detecting a node in a security graph having a data field value which matches an attribute value of the cloud object, wherein the security graph includes a representation of a cloud environment; applying a policy based on the data field value to the detected cloud object; and applying the policy to another cloud object in a second cloud computing environment, in response to determining that a node representing the cloud object in the security graph is connected to a node representing the another cloud object.

Detecting vulnerabilities in configuration code of a cloud environment utilizing infrastructure as code

A system and method for cybersecurity inspection of private software registries is presented. The method includes: deploying an inspection broker in a computing environment, the inspection broker configured to communicate with a private registry of the computing environment; configuring the inspection broker to access the private registry for a list of objects stored in the private registry; selecting an object from the private registry for cybersecurity inspection; inspecting the object for a cybersecurity object in the computing environment; generating an inspection result based on detection of the cybersecurity object; sending the inspection result to an inspection environment, the inspection environment including a representation of the computing environment; and initiating a mitigation action based on the inspection result, the mitigation action generated in response to an instruction from the inspection environment.

System and method for private registry cybersecurity inspection

A system and method for detecting a permission escalation event in a computing environment is disclosed. The method includes: generating a cloned disk based on an original disk of a resource deployed in a computing environment; detecting an identifier of a first principal on the cloned disk; detecting a second principal in the computing environment, the first principal authorized to assume the first principal; storing a representation of the computing environment in a security database, including: a first principal node representing the first principal, and a second principal node representing the second principal, further associated with a permission; querying the representation to determine a permission of the first principal; determining that the second principal includes a permission which the first principal does not include based on a result of querying the representation; and generating a permission escalation event.

Techniques for cybersecurity identity risk detection utilizing disk cloning and unified identity mapping

A system and method for applying cybersecurity policies across multiple computing environments is presented. The method includes: generating an inspectable disk from a disk of a first workload deployed in a first computing environment, the computing environment including a cybersecurity policy applicable to a cybersecurity object; detecting the cybersecurity object on the inspectable disk; generating a policy exception; generating a representation of the cybersecurity object and the first workload in a security database, wherein the security database includes a representation of the first computing environment and a representation of a second computing environment which is associated with the first computing environment; detecting in the representation of the second computing environment a representation of a second workload associated with the representation of the first workload; and applying the policy exception to the second workload based on detecting that the second workload is associated with the first workload.

Detecting security exceptions across multiple compute environments

A system and method for inspecting a running container for a cybersecurity object in a cloud computing environment is disclosed. The method includes: generating a clone of a disk, wherein the disk is deployed in a cloud computing environment; detecting a software container on the generated clone of the disk; and inspecting the software container for a cybersecurity object, in response to determining that the container is a running container.

Techniques for inspecting running virtualizations for cybersecurity risks

A system and method for inspecting managed workloads in a cloud computing environment for cybersecurity threats improves inspection of managed workload service repositories, by only inspecting bases of managed workload deployed in the cloud computing environment. The method includes discovering a managed workload deployed in a cloud computing environment; determining an identifier of the managed workload, wherein the identifier includes an indicator to a base repository in which a base is stored, and wherein the managed workload is currently deployed in the cloud computing environment, the base repository further storing a plurality of bases, wherein a portion of the plurality of bases do not correspond to a deployed workload; accessing the base repository to pull the base; and inspecting the base of the deployed managed workload for a cybersecurity threat.

Growing community of inventors

Tel Aviv, Israel

Niv Roit Ben David