International Business Machines Corporation

Sonrai Security Inc.

Napatech A/s

Q1 Labs Inc.

William Alexander Bird

Ben A Wuest

Russell L Couturier

Brad J Peters

Rory F Bray

Wayne Francis Tackabury

Peter Dahl Ekner

Michael Milde Lilja

Philip Due Soeberg

Albert Lockett

Thomas D Silliman

Alex Omo Agerholm

Nataraj Nagaratnam

Marc Philippe Stoecklin

Sreekanth Ramakrishna Iyer

Youngja Park

Jiyong Jang

Sridhar R Muppidi

Josyula R Rao

Dhilung Hang Kirat

Vijay Dheap

Suzanne Carol Deffeyes

Jason David Keirstead

Archana Kumar

Patrick V Johnstone

Gregory A Davis

Dasharath P Chavda

Veranika Hadun

Alex Omø Agerholm

Dwight E Spencer

Jody D Brownell

Natalia Stakhanova

Iosif Viorel Onut

Christopher Daniel Newton

Matthew Aaron Rogers Carle

Ali-akbar Ghorbani

Joshua Luke Laver

Christopher Glen Fredericks

Carter James MacLennan

Aliakbar Ghorbani

A cloud security control platform and method enforces security controls across multiple cloud environments, services and disparate teams while providing a frictionless 'Permissions on Demand' mechanism for approvals and exceptions. In contrast to the prior art, security is evaluated on a permission by permission basis, with the default being that all permissions are denied and then only given to a particular identity on an as-needed basis. This approach reduces the security risks associated with the vast capabilities available in Public Cloud environments and permits an organization that uses the platform to grant access, approve exceptions and delegate approvals with the appropriate compliance.

Cloud security control platform that enforces scope-based security controls

A network-accessible service provides an enterprise with a view of identity and data activity in the enterprise's cloud accounts. The service enables distinct cloud provider management models to be normalized with centralized analytics and views across large numbers of cloud accounts. Based on identity and audit data received from a set of cloud deployments, and according to a cloud intelligence model, a set of permissions associated with each of a set of identities are determined. For each identity, and based on a set of identity chains extracted from the cloud intelligence model, a set of identity account action paths (IAAPs) are then determined. An IAAP defines how the identity obtains an ability to perform a given action in a given account. Using the identity account action paths together with context information, one or more roles, groups and accounts in the enterprise that are propagating permissions within the public cloud environment are then identified.

Cloud security platform with contextual hot-spot permissions analytics

A network-accessible service provides an enterprise with a view of all identity and data activity in the enterprise's cloud accounts. The service enables distinct cloud provider management models to be normalized with centralized analytics and views across large numbers of cloud accounts. The service enables an enterprise to model all activity and relationships across cloud vendors, accounts and third party stores. Display views of this information preferably can pivot on cloud provider, country, cloud accounts, application or data store. Using a domain-specific query language, the system enables rapid interrogation of a complete and centralized data model of all data and identity relationships. User reports may be generated showing all privileges and data to which a particular identity has access. Similarly, data reports shown all entities having access to an asset can be generated. Using the display views, a user can pivot all functions across teams, applications and data, geography, provider and compliance mandates, and the like.

Cloud intelligence data model and framework

A network-accessible service provides an enterprise with a view of identity and data activity in the enterprise's cloud accounts. The service enables distinct cloud provider management models to be normalized with centralized analytics and views across large numbers of cloud accounts. Using a domain-specific query language, the system enables rapid interrogation of a complete and centralized data model of all data and identity relationships. The data model also supports a cloud 'least privilege and access' framework. Least privilege is a set of minimum permissions that are associated to a given identity; least access is a minimal set of persons that need to have access to given piece data. The framework maps an identity to one or more actions collected in cloud audit logs, and dynamically-build a compete view of an identity's effective permissions. The resulting least privilege and access policies are then applied natively to a given cloud environment to manage access.

Cloud least identity privilege and data access framework

An automated method for processing security events in association with a cybersecurity knowledge graph. The method begins upon receipt of information from a security system representing an offense. An initial offense context graph is built based in part on context data about the offense. The graph also activity nodes connected to a root node; at least one activity node includes an observable. The root node and its one or more activity nodes represent a context for the offense. The knowledge graph, and potentially other data sources, are then explored to further refine the initial graph to generate a refined graph that is then provided to an analyst for further review and analysis. Knowledge graph exploration involves locating the observables and their connections in the knowledge graph, determining that they are associated with known malicious entities, and then building subgraphs that are then merged into the initial graph.

Cognitive offense analysis using contextual data and knowledge graphs

Embodiments are directed to a method of implementing a packet capture ring. The packet capture ring includes a plurality of appliances, and the plurality of appliances includes a first appliance and a second appliance. The first appliance and the second appliance are both attached to a network tap, and the first appliance works as a master appliance. The master appliance ingests packets from the network tap, encapsulates the packets and forwards encapsulated packets in the packet capture ring. The method includes: detecting, by the second appliance, a failure of the first appliance; working, by the second appliance, as the master appliance; and removing, by the second appliance, the first appliance from a forwarding designation list.

Fault-tolerant architecture for packet capture

Embodiments provide a system and method for network tracking. By using packet capture applications having a flow identifier and a time stamper, one or more raw packets from one or more packet flows intercepted from a network can be tagged with a unique identifier and timestamp that can later be used to aggregate packet flows that have been analyzed by one or more capture applications. The unique identifier can relate to the network interface of the particular capture application and can also have an increasing value, where the increase in value can be monotonic. Later capture applications, while capable of generating secondary timestamps, can disregard those secondary timestamps for the primary timestamp of the first capture application in order to remove complications arising from latency issues.

Persistent flow identifiers enabling disparate applications

Embodiments are directed to a packet capture ring that provides a single network tap for packet capture and a series of processors (or appliances) for handling serialization and search request processing in a confederated and highly scalable manner. One such appliance (a 'primary' appliance) maintains a tap port to the network. Each packet capture appliance has a locally attached repository that stores raw packets and a juxtaposed index that allows for retrieval of those packets. The primary appliance sends a single copy of encapsulated packets in opposite directions around the ring to its descendants. A designation is made across the system as to a 'currently designated' appliance for servicing requests for indexing and storage of captured packets. This current designation shifts from appliance to appliance in the system, as a &#x201c;previously designated&#x201d; appliance has its storage capacity filled.

Packet capture ring: reliable, scalable packet capture for security applications

A method, system and computer-usable medium are disclosed for identifying risk within an information technology (IT) environment, comprising: analyzing characteristics of a user accessing a system within an IT environment; associating a risk profile with the user based upon the characteristics of the user; determining when the user accesses a system within the IT environment; maintaining a user risk profile record of all systems within the IT environment accessed by the user, the user risk profile record continuing to be associated with the system after access by the user ceases; and, identifying a risk level for all systems within the IT environment based upon the user risk profile record.

User activity modelling, monitoring, and reporting framework

Growing community of inventors

Fredericton, Canada

William Alexander Bird