Rapid7, Inc.

Emc Corporation

Samuel Adams

Yedidya Dotan

Jeffrey D Myers

Matthew Robert Hathaway

Nicholas Davis

Andrew Keely

Colin O'Brien

Sorin Faibish

Lawrence N Friedman

Yael Villa

Robert S Philpott

Jeff Myers

Suji Suresh

Christopher Corde

Philip A Darringer

H D Moore

Jonathan Kelly

Steven Torance

Methods and systems for detecting a malicious actor on a network. In some embodiments the system may gather data regarding one or more authentic hostnames on a network, and generate a pseudo hostname based on the gathered data. The system may then issue a network discovery request for the pseudo hostname. Based on a response to the network discovery request, the system may execute one or more remedial actions.

Detecting malicious actors

Systems and methods of identifying a security risk by monitoring and generating alerts based on attempts to access web domains that have been registered within a short period of time and are therefore identified as 'high-risk,' including identifying an attempt to access a domain; receiving a registration date of the domain; and detecting a security risk based on the registration date of the domain.

Domain age registration alert

Systems and methods of managing the security of a networked environment based on activity associated with deployed pseudo-accounts are presented. In one embodiment, a plurality of pseudo-accounts are deployed in one or more networks, domains, or virtual machines and activity associated with the pseudo-accounts is collected to identify security risks to facilitate remediation and mitigation.

Honey user

Systems and methods of correlating accounts among a plurality of network assets using account lateral movement data is presented in the context of network security. In one embodiment a plurality of authentication audit logs are received from a plurality of assets; the plurality of authentication audit logs are correlated; and a notification is generated based on a comparison of correlation results and a database of permitted account associations.

Lateral account mapping

A first cryptographic device is configured to generate a passcode for submission to a second authentication device. The second authentication device determines a particular type of shuffling to be applied to a passcode in conjunction with submission of that passcode for authentication, and verifies that the passcode has been entered in accordance with the particular type of shuffling. The first cryptographic device may comprise an authentication token and the second cryptographic device may comprise at least one authentication server. By way of example, the second cryptographic device may generate a shuffle indicator signal specifying the particular type of shuffling, such that the shuffle indicator signal can be transmitted and thereby made apparent to a user associated with the first cryptographic device. The user then alters his or her manner of entry of the passcode based on the received shuffle indicator signal, such as entering the passcode in a reverse order.

Shuffled passcode authentication for cryptographic devices

Event-based biometric authentication is provided using a mobile device of a user. A user attempting to access a protected resource is authenticated by receiving a request to access the protected resource; collecting biometric information from the user in response to the request using a mobile device of the user; performing biometric authentication of the user using the collected biometric information; and granting access to the protected resource based on the biometric authentication. The authentication optionally comprises an event-based authentication. The mobile device does not have to contain token generating material.

Event-based biometric authentication using mobile device

An improved authentication technique employs a user's mobile device to obtain a picture of the user from which facial geometry is extracted and applied as part of an authentication operation of the user to the remote network. In some examples, a server stores facial geometry for different users along with associated PINs. By matching facial geometry of the user with facial geometry on the server, the user's PIN can be obtained, without the user ever having to register or remember the PIN.

Growing community of inventors

Andover, MA, United States of America

Samuel Adams