Airgap Networks Inc.

Zscaler, Inc.

Vinay Adavi

Satish M Mohan

Ritesh R Agrawal

Raymond Wing Chon Cheh

Balireddy Ramesh Kumar Reddy

Chia Chi Cheng

Lokesh Mogra

Rajesh S Tiwari

A technique to stop lateral movement of ransomware between endpoints in a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication by overwriting the DHCP responses. Message traffic from compromised endpoints is detected. Attributes of ransomware may be detected in the message traffic, as well as attempts to circumvent the security appliance. Compromised devices may be quarantined by assigning them the default gateway to a preset blackhole IP address.

System and method for utilizing DHCP relay to accomplish quarantining client endpoints in a ransomware protected network

A technique to monitor device health of endpoints in a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication. Message traffic is analyzed and anomalies are detected relative to normal message traffic that correspond to device health problems that may require service by a field technician.

System and method for device health check and monitoring using a security appliance as a default gateway with point-to-point links between endpoints

A technique to provide early detection of ransomware is disclosed. Message traffic from secure gateways is monitored. Statistical anomaly detection and behavioral anomaly detection is performed. Visualization and alerts may be generated to aid operators to identify ransomware attacks and take proactive measures. In one implementation, the early detection of ransomware is performed in the cloud.

System and method for ransomware early detection using a security appliance as default gateway with point-to-point links between endpoints

A technique to stop lateral movement of ransomware between endpoints in a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication by overwriting the DHCP responses. A high availability cluster of the gateways is utilized to distribute traffic and implement load balancing amongst the gateways.

System and method for load balancing endpoint traffic to multiple security appliances acting as default gateways with point-to-point links between endpoints

A technique to stop lateral movement of ransomware between endpoints in a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication. Message traffic from compromised endpoints is detected. Attributes of ransomware may be detected in the message traffic, as well as attempts to circumvent the security appliance. Compromised devices may be quarantined. A disposable jump box may be utilized to provide an additional layer of protection against ransomware.

System and method to create disposable jump boxes to securely access private applications

A technique to improve security for a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication. Message traffic is analyzed and anomalies are detected relative to normal message traffic that correspond to device health problems that may require service by a field technician. Access to a cloud-based resource may be further protected by enforcing user-based access policies.

System gateway while accessing protected non-web resources connected to internet

A technique to improve security for a VLAN is disclosed. A security appliance is set as the gateway for intra-LAN communication. Message traffic is analyzed and anomalies are detected relative to normal message traffic that correspond to device health problems that may require service by a field technician. A network switch may be configured to drop certain types of Address Resolution Protocol messages from selected ports to aid in setting a security appliance as the gateway.

System and method for prevention of lateral propagation of ransomware using ARP control on network switches to create point-to-point links between endpoints

A technique to stop lateral movement of ransomware between endpoints in a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication by overwriting the DHCP responses. Message traffic from compromised endpoints is detected. Attributes of ransomware may be detected in the message traffic, as well as attempts to circumvent the security appliance. Compromised devices may be quarantined. Additionally, the DHCP address assignment may be policed to ensure accuracy and correctness to provide an additional layer of security.

System and method for utilizing DHCP relay to police DHCP address assignment in ransomware protected network

An extended browser provides additional protection against lateral propagation of ransomware to an endpoint device. The extended browser may monitor for inbound connection requests having access protocols vulnerable to ransomware attacks. The extended browser may select a certificate provided to an identity provider based on the ransomware threat level based at least in part on the detection of connection requests having access protocols vulnerable to ransomware attacks. Access to SaaS or private enterprise application may be limited or denied in response to detecting connection requests having the vulnerable access protocols. The endpoint device may also be part of a VLAN with endpoint device deployed under a default gateway with point-to-point links.

Extended browser monitoring inbound connection requests for agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links

An extended enterprise browser provides protection from ransomware attacks against SaaS and private enterprise application. In one implementation, the extended enterprise browser supports at least two different endpoint security certificates. A selection of the endpoint security certificate is made based on a ransomware risk level posture. Various factors may be used to determine the ransomware risk level posture to aid preventing ransomware attacks.

System and method for agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links

A system and method for ransomware protection includes an extended browser in an endpoint device. The extended browser selects a certificate for user authentication with an identity provider based on the enterprise ransomware threat level. The selection of the certification may be used to aid in providing protection from ransomware attacks of SaaS and private enterprise applications. The endpoint device may be part of a larger VLAN environment in which endpoint devices are deployed under a default gateway with point-to-point links.

Rapid incidence agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links

A technique to stop lateral movement of ransomware between endpoints in a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication. Message traffic from compromised endpoints is detected. Attributes of ransomware may be detected in the message traffic, as well as attempts to circumvent the security appliance. Compromised devices may be quarantined.

System and method for dynamically avoiding double encryption of already encrypted traffic over point-to-point virtual private networks for lateral movement protection from ransomware

An extended enterprise browser installed on an endpoint device provides protection from ransomware attacks to SaaS and private enterprise applications. The extended enterprise browser monitors for alternate browser installed on the endpoint device. The extended enterprise browser may take one or more actions to block the spread of ransomware by the alternate browser.

Extended enterprise browser blocking spread of ransomware from alternate browsers in a system providing agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links

An extended enterprise browser supports using at least two different authentication certificates depending on factors such as a ransomware risk posture. Secure user access may be provided by using a trusted platform module to encrypt/decrypt the authentication certificates based on a secret key generated based on information from the trusted platform module and the extended enterprise browser. Man-in-the Middle (MITM) attacks of the authentication certificated by ransomware is prevented.

System and method for secure user access and agentless lateral movement protection from ransomware for endpoints deployed under a default gateway with point to point links

A technique to stop lateral movement of ransomware between endpoints in a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication by overwriting the DHCP responses. Message traffic from compromised endpoints is detected. Attributes of ransomware may be detected in the message traffic, as well as attempts to circumvent the security appliance. Compromised devices may be quarantined. The security appliance may act in response to an initial detection of ransomware such that it does not ordinarily interfere with operation of a primary DHCP server.

Preventing lateral propagation of ransomware using a security appliance that dynamically inserts a DHCP server/relay and a default gateway with point-to-point links between endpoints

Growing community of inventors

Sunnyvale, CA, United States of America

Vinay Adavi