Fortinet, Inc.

Lacework Inc.

Sowmya A Karmali

Yijou Chen

Theodore M Reed

Xiaofei Guo

Kenneth Beasley

Matti A Vanninen

John Payyappillil John

Nolan K Karpinski

Joshua L Vertes

Adin Aoki

Christopher E Pedigo

Bao Nguyen

Brandon Maister

Ravi Kiran Kumar

Carsten Varming

Ammar G Ekbote

Mary L Singh

Whitney L Smith

Jacob A Kilby

Nicholas W Mcnutt

Christopher Hall

Kinjal Gandhi

An illustrative method includes identifying, based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity and determining a set of one or more attack paths included in the plurality of attack paths that include a particular risk artifact. Based on one or more characteristics of the set of one or more attack paths, a risk score specific to the particular risk artifact may be determined and a risk mitigation operation associated with the particular risk artifact may be performed.

Compute resource risk mitigation by a data platform

An illustrative method includes identifying, based on static workload data associated with a compute environment, one or more attack paths from a network to one or more datasets associated with an entity, accessing runtime workload data associated with the compute environment, and performing, based on the runtime workload data, a risk mitigation operation associated with the one or more attack paths.

Attack path risk mitigation by a data platform using static and runtime data

An illustrative method includes accessing data representative of a first role associated with a set of permissions with respect to resources within the compute environment and specifying a group of identities assigned to the first role, determining that a first subgroup of one or more identities included the group of identities only uses a first subset of permissions included in the set of permissions to access the resources within the compute environment without using a second subset of permissions, and performing, based on the determining that the first subgroup of one or more identities only uses the first subset of permissions, an operation to reduce permissions usable by the first subgroup of one or more identities.

Role-based permission by a data platform

An illustrative method includes scanning a compute environment associated with an entity and identifying one or more attack paths from a network to one or more datasets associated with the entity. The one or more attack paths each include a series of risk artifacts within the compute environment that can be exploited by an attacker to access the one or more datasets. The method further includes generating one or more attack path risk scores associated with the one or more attack paths and indicative of one or more levels of risk that the one or more attack paths could be exploited to access the one or more datasets. A risk mitigation operation associated with the one or more attack paths is performed based on the one or more attack path risk scores.

Attack path risk mitigation by a data platform

An illustrative method includes accessing, by a data platform configured to monitor a compute environment, permissions data representative of a set of permissions that specify how an entity is entitled to interact with resources within the compute environment; collecting, by the data platform, runtime workload data representative of an actual interaction by the entity with the resources over a period of time; and performing, by the data platform based on the runtime workload data, an operation associated with modifying the set of permissions for the entity.

Runtime workload data-based modification of permissions for an entity

An illustrative method includes tracking, by a data platform configured to monitor a compute environment, a plurality of identity transitions that occur over time with respect to an entity, wherein each of the identity transitions includes a transition by the entity from being associated with one identity to being associated with another identity, the one identity and the another identity having different permission sets with respect to resources within the compute environment; determining, by the data platform while performing the tracking, that an attribute of the plurality of identity transitions satisfies a predetermined criterion; and performing, by the data platform based on the attribute of the plurality of transitions satisfying the predetermined criterion, a remedial action associated with the entity.

Transitive identity usage tracking by a data platform

An illustrative method includes a scanning driver providing an interface between data included in a data structure located within a compute environment and one or more scan modules included in an unprivileged agentless workload scanning configuration executing within the compute environment, the one or more scan modules configured to concurrently analyze the data in accordance with one or more respective scan use cases; receiving a request to add a new scan module to the unprivileged agentless workload scanning configuration, the new scan module associated with a new scan use case different than the one or more respective scan use cases, and dynamically loading, based on the request and while the one or more scan modules are concurrently analyzing the data, the new scan module into the unprivileged agentless workload scanning configuration.

Modular agentless scanning of cloud workloads

An illustrative method includes accessing data representative of a first role associated with a set of permissions with respect to resources within the compute environment and specifying a group of identities assigned to the first role, determining that a first subgroup of one or more identities included the group of identities only uses a first subset of permissions included in the set of permissions to access the resources within the compute environment without using a second subset of permissions, and performing, based on the determining that the first subgroup of one or more identities only uses the first subset of permissions, an operation to reduce permissions usable by the one or more identities.

Cloud infrastructure entitlement management by a data platform

Growing community of inventors

Tustin, CA, United States of America

Sowmya A Karmali