Wiz, Inc.

Roy Reznik

Ami Luttwak

Yinon Costica

Yaniv Shaked

Yarin Miran

Raaz Herzberg

Daniel Hershko Shemesh

Shai Keren

Avihai Berkovitz

Alon Schindel

Gal Kozoshnik

Matilda Lidgi

Avi Tal Lichtenstein

Yaniv Joseph Oliver

Mattan Shalev

Moran Cohen

Niv Roit Ben David

Osher Hazan

George Pisha

Amir Lande Blau

Amitai Cohen

Udi Reitblat

Barak Sharoni

Bar Magnezi

Omri Kornblau

Eyal Moscovici

Oron Noah

Itay Arbel

Elad Gabay

Daniel Klein

Aviel Fogel

Eliran Marom

Or Heller

Erez Eyal

Guy Rozendorn

Lidor Gonshorowitz

Liran Moysi

Assaf Rappaport

Arik Schimmel

A system and method for detecting lateral movement in a cloud computing environment is based on configuration code. The method includes: accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a cloud entity deployed in the cloud computing environment; selecting an identifier of an exposed cloud entity, the cloud entity associated with a secret; querying a security graph based on the identifier to detect a node representing the secret, wherein the node representing the secret is connected to a node representing the exposed cloud entity; traversing the security graph to detect a second node connected to the node representing the secret, the second node representing a second cloud entity deployed based on the code object of the plurality of code objects; and generating a mitigation action based on the second cloud entity.

Techniques for lateral movement detection in a cloud computing environment

A system and method for iterative cybersecurity remediation based on a digital forensic finding is disclosed. In an embodiment, the method includes detecting a forensic finding, the forensic finding based on a forensic artifact detected on a disk of a resource in a computing environment; generating an inspectable disk based on the disk of the resource; inspecting the inspectable disk for a cybersecurity object based on the forensic artifact; and initiating a remediation action on the disk based on the cybersecurity object detected on the inspectable disk.

Techniques for system feedback in remediating cybersecurity risks

In some aspects, a device includes selecting a signed software image for deployment in a computing environment, the software image signed utilizing a private cryptographic key of an asymmetrical cryptography scheme. Also, the device may include accessing a public cryptographic key corresponding to the private cryptographic key. Furthermore, the device may include configuring an admission controller of a software container cluster deployed in the computing environment to verify the signed software image utilizing the public cryptographic key. In addition, the device may include deploying the signed software image in the software container cluster in response to verifying the signed software image. Moreover, the device may include denying deployment of the signed software image, in response to determining that the signed software image is signed with a key which is not the private cryptographic key.

System and method for validating a signature of a virtual workload image in runtime

A system and method for near real time detection of cybersecurity threats in a computing environment. The method includes: detecting an event in a data log, the data log including a plurality of data records, each data record corresponding to at least an event; parsing a data record corresponding to the event to detect a data value; detecting a node in a security graph, the node corresponding to the detected data value, wherein the security graph includes a representation of the computing environment; initiating inspection of a resource corresponding to the node.

Near-real time dynamic cybersecurity inspection techniques

A system and method for generating a contextual cloud risk assessment of a cloud computing environment. The method includes accessing a plurality of cloud assessment policies, wherein a policy including a query executable on a security graph; applying the plurality of cloud assessment policies to the representation of the first cloud computing environment; generating a risk assessment report based on an output generated by applying a policy of the plurality of cloud assessment polices; and initiating a mitigation action based on a cybersecurity risk from the risk assessment report.

System and method for risk monitoring of cloud based computing environments

A system and method for applying a unified security policy across a technology stack, includes detecting a cloud object in a first cloud computing environment, the cloud object including a plurality of attributes, each attribute having a corresponding value; detecting a node in a security graph having a data field value which matches an attribute value of the cloud object, wherein the security graph includes a representation of a cloud environment; applying a policy based on the data field value to the detected cloud object; and applying the policy to another cloud object in a second cloud computing environment, in response to determining that a node representing the cloud object in the security graph is connected to a node representing the another cloud object.

Detecting vulnerabilities in configuration code of a cloud environment utilizing infrastructure as code

A system and method for detecting an application path utilizing active inspection of a cloud computing environment, includes selecting a reachable resource having at least one network path to access the reachable resource, wherein the reachable resource is a cloud object deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment; selecting a second resource having a second network path based on the network path of the reachable resource; and actively inspecting the second network path to determine if the second resource is accessible through the second network path from the reachable resource.

Techniques for detecting applications paths utilizing exposure analysis

A system and method for generation of unified graph models for network entities are provided. The method includes collecting, for at least one network entity of a plurality of network entities, at least one network entity data feature, wherein the at least one network entity data feature is a network entity property; genericizing the collected at least one network entity; generating at least a network graph, wherein the generated network graph is a multi-dimensional data structure providing a representation of the plurality of network entities and relations between the network entities of the plurality of network entities; and storing the generated at least a network graph.

System and method for generation of unified graph models for network entities

A system and method for performing active inspection of a cloud computing environment to detect exposed sensitive data. The method also includes receiving at least one network path to access a first resource, where the first resource is a cloud object deployed in the cloud computing environment, and potentially accessible from a network which is external to the cloud computing environment; and generating a first instruction to access the first resource based on a plurality of reachability parameters designated in the at least one network path; causing execution of the generated first instruction to access the first resource; receiving an output, the output generated in response to execution of the generated first instruction; detecting in the output a predetermined sensitive data indicator; and initiating a mitigation action in response to detecting the sensitive data indicator in the output.

System and method for detecting sensitive data in active inspection of cloud computing resources

A system and method for performing active inspection of a computing environment utilizes optical character recognition. The method includes: receiving at least one network path to access a first resource, where the first resource is a cloud object deployed in the cloud computing environment, potentially accessible from a network which is external to the cloud computing environment; and generating a first instruction to access the first resource based on a plurality of reachability parameters designated in the at least one network path; causing execution of the generated first instruction to access the first resource; receiving a graphical output, the graphical output generated in response to execution of the generated first instruction; performing optical character recognition on the graphical output to generate a textual output; detecting in the textual output a predetermined data indicator; and initiating a second active inspection in response to detecting the data indicator in the textual output.

Techniques for active inspection of cloud computing applications utilizing optical character recognition

A system and method for performing active inspection of a cloud computing environment includes receiving at least one network path to access a first resource, wherein the first resource is a cloud object deployed in the cloud computing environment, and potentially accessible from a network which is external to the cloud computing environment; and actively inspecting the at least one network path to determine if the first resource is accessible through the at least one network path from a network external to the cloud computing environment.

Techniques for analyzing external exposure in cloud environments

A method and system for providing textual insights on objects deployed in a cloud environment are provided. The method includes collecting object data on objects deployed in the cloud environment, wherein objects are deployed and operable at different layers of the cloud environment; identifying objects deployed in the cloud environment; constructing a visual representation of the cloud environment, including the identified objects and their relationships; and generating textual insights on the identified objects and their relationships using natural language processing.

System and method for analyzing network objects in a cloud environment

An architecture of a multi-cloud inspector for any computing device type is provided. According to an embodiment, a method for implementing multi-cloud inspection includes accessing an object list, determining which objects to inspect, determining which inspectors to use, creating object copies, providing and running inspectors for each object copy, receiving inspection report summaries, generating an enriched dataset, and adding the enriched dataset to a security graph database.

Architecture of a multi-cloud inspector for any compute type

A system and method for assembling a disk for cybersecurity inspection is disclosed. The method includes receiving access to an inspectable disk, the inspectable disk including a block device and a list of partitions; mounting a first partition from the list of partitions at a first directory in response to detecting a first operating system on the first partition; detecting a boot directory on a second partition from the list of partitions in response to detecting a second operating system on the second partition; detecting a mounting partition from a configuration file of the detected boot directory; detecting a filesystem table on the mounting partition; and mounting each partition from the list of partitions based on an order indicated by the filesystem table.

Techniques for mounting disks in an inspection environment

In some implementations, the device may include detecting a virtual instance deployed in a computing environment, the virtual instance deployed based on a software image. In addition, the device may include detecting an image name of the software image. The device may include accessing an image software repository to retrieve the software image based on the detected image name. Moreover, the device may include initiating validation of the retrieved software image. Also, the device may include initiating a mitigation action on the virtual instance in response to detecting that the retrieved software image is an invalid software image.

Growing community of inventors

Tel Aviv, Israel

Roy Reznik