Forescout Technologies, Inc.

Normalyze, Inc.

Yang Zhang

Siying Yang

Ravishankar Ganesh Ithal

Arun Raghuramu

Mummoorthy Murugesan

Ajay Agrawal

Aveek Kumar Das

Yuzhou Song

Gautam Kanaparthi

Yi Zhang

Kapil Rajendra Neeralgi

Nimish Salve

The technology disclosed relates to a computing system configured to execute a cloud scanner in a cloud environment to discover one or more data stores in the cloud environment and return metadata representing a data schema of data objects in the one or more data stores, traverse the data objects in the one or more data stores based on the metadata to identify a plurality of data items, execute a content-based data classifier against the plurality of data items to identify a set of data items, in the plurality of data items, as conforming to one or more data profiles, and generate a graphical interface including one or more graphical objects configured to display a representation of the one or more data profiles, wherein the graphical interface is configured to filter the plurality of data items based on a selected data profile selected from the one or more data profiles.

Cloud scanner with database schema detection

The technology disclosed relates to analysis of data posture of a cloud environment. In particular, disclosed technology relates to a system and method for analyzing cloud assets, such as storage resources, compute resources, etc. to detect peak signals based on occurrences of sensitive data types or other data classifications in cloud assets. A computing system is configured to access data in plurality of cloud resources and, on a cloud resource-by-cloud resource basis, attribute a plurality of data sensitivity parameters to the data in a given cloud resource of the plurality of cloud resources, and generate a peak value indicating an appraisal of the data in given cloud resource based on the plurality of data sensitivity parameters attributed to the data. A graphical interface includes graphical objects configured to visually represent plurality of cloud resources, plurality of data sensitivity parameters, and the peak values generated for the plurality of cloud resources.

Cloud resource prioritization for data security posture management based on detection of cloud data peak signals

Systems, methods, and related technologies for determining a risk associated with a network portion are described. The determination of risk associated with a network portion may include accessing network traffic from a network and determining an entity type associated with at least one entity communicatively coupled to the network. A network portion associated with the at least one entity can be determined. A risk associated with the at least one entity can be determined. A risk associated with the network portion associated with the at least one entity can be determined based on the risk associated with the at least one entity. The risk associated with the network portion can then be stored.

Network portion risk assessment

The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a system that analyzes data posture in a cloud environment database using a snapshot of the database. A computer-implemented method includes receiving a request to access a database in the cloud environment, wherein the database includes a first authentication requirement. The method includes identifying a snapshot of the database, wherein the snapshot includes a second authentication requirement that is different than the first authentication requirement. The method includes accessing the snapshot using the second authentication requirement, generating a representation of the database using the snapshot, and generating a data posture analysis result indicative of a data posture of the database based on scanning the representation of the database.

Data posture analysis in a cloud environment using database snapshots

The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to accessing permissions data and access control data for pairs of compute resources and storage resources, tracing network communication paths between the pairs of the compute resources and the storage resources based on the permissions data and the access control data, accessing sensitivity classification data for objects in the storage resources, and qualifying a subset of the pairs of the compute resources and the storage resources as vulnerable to breach attack based on an evaluation of the permissions data, the access control data, and the sensitivity classification data against at least one risk criterion. A representation of propagation of the breach attack along the network communication paths is generated, the representation identifying relationships between the subset of the pairs of the compute resources and the storage resources.

Cloud data security posture detection based on network communication paths and sensitivity data

The disclosed technology receives a control input identifying a sampling criterion for classifying a data store storing a set of data objects in a computing environment as corresponding to a target data type and deploys one or more scanners configured to select a representative subset of data objects, from the set of data objects, based on the sampling criterion. A scanner result generated by the one or more scanners is received that represents detected instances, in the representative subset of data objects, of one or more pre-defined data patterns of the target data type. A classification result is generated based on a comparison of the number of detected instances of the one or more pre-defined data patterns to a threshold. The classification result represents a classification of the data store as having correspondence to the target data type. A computing action is performed based on the classification result.

Data scan sampling control for data discovery and posture management

Systems, methods, and related technologies for classification are described. In certain aspects, a plurality of device classification methods with associated models are accessed. Each of the classification methods have an associated reliability level. The models of classification methods with a higher reliability level than other classifications methods are used to at least one of train or tune the models associated with lower reliability level.

Self-training classification

A computer-implemented method includes detecting occurrence of an event in a cloud environment, obtaining an indication of an identity associated with the event, obtaining an indication of a usage time stamp representing usage time of a privilege in association with the identity for the event, and classifying the privilege into a classification group selected from a plurality of predefined classification groups. Each respective classification group groups a respective set of privileges defined in the cloud environment. The method includes obtaining a grant time stamp representing a grant time of at least one privilege, in the respective set of privileges in the classification group, to the identity and, based on the usage time stamp and the grant time stamp, generating an excessive privilege determination that indicates the classification group includes at least one excessive privilege. The method includes performing a computing action based on the excessive privilege determination.

Cloud data attack surface tracking using graph-based excessive privilege detection

Systems, methods, and related technologies for profiling an entity and classifying an entity based on a profile are described. In certain aspects, data associated with communications of a first entity on a network are accessed, behaviors are determined based on the data associated with the communications of the first entity, and sequences of the behaviors of the first entity are determined. A profile of the first entity is determined based on the sequences of the behaviors, the profile including a classification of the first entity, a state machine of the profile of the first entity is determined, the state machine being associated with the classification against which the behaviors can be matched, a second entity is detected coming onto the network, and responsive to detecting the second entity coming onto the network, the second entity is classified based on the state machine of the profile of the first entity.

Behavior based profiling

The technology disclosed relates to analysis of security posture of a cloud environment. A computing system is configured to automatically discover a plurality of databases in the cloud environment and configure an orchestration engine to deploy a plurality of log analyzer microservices on the plurality of databases. Each log analyzer microservice, of the plurality of log analyzer microservices, is configured to scan a respective database log that represents database activities on a respective database of the plurality of databases. Analysis results are received from the plurality of log analyzer microservices. The analysis results represent detection of at least one of a performance criterion or a security criterion in one or more databases of the plurality of databases. An action signal representing the analysis results is generated.

Database log analyzer in a cloud environment using microservice orchestration

Systems, methods, and related technologies for device classification are described. Methods include determining device information associated with a device coupled to a network, the device information including information obtained from one or more sources, classifying the device using the device information as input to a classifier, and applying a policy to the device based on the classification of the device.

Device classification

Systems, methods, and related technologies for classification are described. Network traffic from a network may be accessed and an entity may be selected. One or more values associated with one or more properties associated with the entity may be determined. The one or more values may be accessed from the network traffic. A first model associated with a first level of granularity is accessed. A first classification result of the entity based on the first model is determined by a processing device. A second model associated with a second level of granularity is accessed. The second level of granularity is higher than the first level of granularity and the second model is accessed based on the first classification result. A second classification result of the entity based on the second model is determined. At least one of the first classification result or the second classification result is stored.

Multiple granularity classification

The technology disclosed relates to resource activity management in a cloud environment. A computer-implemented method includes detecting a plurality of virtual networks in the cloud environment and deploying a plurality of sensors in the plurality of virtual networks using an orchestration engine of the cloud environment. Each sensor, of the plurality of sensors, includes an executable package configured to execute in a respective virtual network, of the plurality of virtual networks, independent of other sensors, of the plurality of sensors, to manage activities in the respective virtual network. The method includes identifying an activity management task to be performed in a particular virtual network of the plurality of virtual networks, sending a task command representing the activity management task to the sensor deployed in the particular virtual network, and receiving an execution result representing execution of the activity management task by the sensor deployed in the particular virtual network.

Virtual private cloud resource activity management

The technology disclosed relates to analysis of data posture of a cloud environment. In particular, the disclosed technology relates to a system and method for analyzing cloud assets, such as storage resources, compute resources, etc. to detect peak signals based on occurrences of sensitive data types or other data classifications in the cloud assets. A system for prioritized presentation of high-value cloud resources susceptible to cloud security risks includes a processor, a display, and memory accessible by the processor and executable to, on a cloud resource-by-cloud resource basis, analyze data in a given cloud resource, and attribute a plurality of data sensitivity parameters to the data in the given cloud resource, and a peak value indicating an appraisal of the data in the given cloud resource. A graphical interface includes graphical objects configured to display the given cloud resource, the plurality of data sensitivity parameters, and the peak value.

Cloud data peak signal detection and prioritization for data security posture management

Systems, methods, and related technologies for classification are described. Network traffic from a network may be accessed and an entity may be selected. One or more values associated with one or more properties associated with the entity may be determined. The one or more values may be accessed from the network traffic. A search query based on the one or more values associated with the one or more properties associated with the entity is determined and performed. A search query result is received and the search query result comprises a plurality of webpages. Data from a webpage of the plurality of webpages is accessed. A classification result of the entity is determined, by a processing device, based on the data from the webpage of the plurality of webpages. The classification result is stored.

Growing community of inventors

Fremont, CA, United States of America

Yang Zhang