Abstract

A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.

IPC Classes  ?

• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result
• G06F 16/11 - File system administration, e.g. details of archiving or snapshots
• G06F 21/55 - Detecting local intrusion or implementing counter-measures
• G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
• H04L 9/40 - Network security protocols

Abstract

Embodiments of the present disclosure include a non-transitory computer readable medium that when executed by at least one processor cause the at least one processor to perform operations for dynamic cloud workload protection, the operations comprising: installing an agentless scanning system, the agentless scanning system being configured to scan a cloud server, the cloud server including a network and a memory; detecting, using a cloud provider application program interface (API), an installation of a new workload in the cloud server, the new workload including disks; scanning, using the agentless scanning system, the disks of the new workload; installing an agent on the new workload; monitoring, using the agent, the disks, the network, and the memory of the new workload; generating, using the agent, a notification when an interesting event occurs; scanning, using the agentless scanning system, the cloud server; and generating at least one command to perform one or more of a remediation or a policy update.

IPC Classes  ?

• H04L 9/40 - Network security protocols

Goods & Services

Software as a service (SAAS) services featuring software for protecting cloud computing platforms against cybersecurity threats

Abstract

Disclosed herein are methods, systems, and computer-readable media for vulnerability management. In an embodiment, a method may include a step of identifying a series of vulnerabilities. In some embodiments, the method may further include determining a risk associated with each vulnerability. In some embodiments, the method may include determining one or more characteristics related to a manner of repairing each vulnerability. In some embodiments, the method may further include identifying, based on at least one commonality between the one or more characteristics, one or more subsets of vulnerabilities. In some embodiments, the method may further include displaying the one or more subsets of vulnerabilities in an order, the order being based on the at least one commonality and the determined risk, wherein each subset is enabled to be addressed as a group.

IPC Classes  ?

• G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Goods & Services

Software as a service (SAAS) services featuring software for protecting cloud computing platforms against cybersecurity threats.

Abstract

Embodiments of the present disclosure include a non-transitory computer readable medium that when executed by at least one processor cause the at least one processor to generate automatic suggestions for changes to infrastructure as code (IaC) to remediate cloud security issues, the operations comprising: scanning at least one cloud account; generating an inventory of cloud assets based on the scanning of the at least one cloud account; scanning at least one repository of source files of an infrastructure as code (IaC) associated with the at least one cloud account; creating an inventory of IaC assets; matching each asset of the inventory of cloud assets with one or more assets of the inventory of IaC assets; identifying a vulnerability in at least one asset of the inventory of cloud assets; determining at least one asset of the inventory of IaC assets associated with the at least one asset of the inventory of cloud assets based on the matching; and generating at least one alert.

IPC Classes  ?

• H04L 29/06 - Communication control; Communication processing characterised by a protocol
• H04L 9/40 - Network security protocols

Abstract

A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result
• G06F 16/11 - File system administration, e.g. details of archiving or snapshots
• G06F 21/55 - Detecting local intrusion or implementing counter-measures
• G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

This disclosure describes many innovations including but not limited to systems, methods, and non-transitory computer readable media containing instructions for managing permission policies. Managing policies includes collecting activities for a plurality of identities, where each identity has a permission policy, and each activity complies with the permission policy; for each identity, calculating a risk margin indicating a gap between the permission policy and the activities; determining a plurality of clustering schemes, each corresponding to a partition of the identities based on a similarity of the activities; for at least one cluster of at least one clustering schemes, determining a reduced permission policy excluding a permission, while allowing each identity in the cluster to subsequently perform each activity; calculating an average risk margin for each clustering scheme based on the reduced permission policy; and select a specific clustering scheme based on a number of clusters and the average risk margin.

IPC Classes  ?

• G06F 16/28 - Databases characterised by their database models, e.g. relational or object models
• G06F 16/33 - Querying
• G06F 21/31 - User authentication
• G06F 21/55 - Detecting local intrusion or implementing counter-measures
• H04L 43/04 - Processing captured monitoring data, e.g. for logfile generation
• H04L 43/045 - Processing captured monitoring data, e.g. for logfile generation for graphical visualisation of monitoring data
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 17/00 - Digital computing or data processing equipment or methods, specially adapted for specific functions
• G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
• G06F 21/60 - Protecting data
• G06F 21/62 - Protecting access to data via a platform, e.g. using keys or access control rules

Abstract

Systems, methods, and non-transitory computer readable media including instructions for securing virtual cloud assets at rest against cyber threats are disclosed. Securing virtual cloud assets at rest against cyber threats includes determining a location of a snapshot of a virtual disk of a protected virtual cloud asset, wherein the protected virtual cloud asset is at rest, the protected virtual cloud asset being configured to be instantiated in the cloud computing environment when activated; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset, wherein during the detection of the potential cyber threats by analyzing the snapshot, the protected virtual cloud asset is at rest; and alerting detected potential cyber threats based on filtering or prioritizing using a determined risk of each detected threat.

IPC Classes  ?

• G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
• G06F 21/55 - Detecting local intrusion or implementing counter-measures

Abstract

A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 16/11 - File system administration, e.g. details of archiving or snapshots
• G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result

Abstract

A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 16/11 - File system administration, e.g. details of archiving or snapshots
• G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result

Abstract

A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 16/11 - File system administration, e.g. details of archiving or snapshots
• G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result

Abstract

A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 16/11 - File system administration, e.g. details of archiving or snapshots
• G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result

Abstract

A method is disclosed for accessing a primary account maintained in a cloud environment, receiving information defining a structure of the primary account, the structure including a plurality of assets, and deploying, inside the primary account or a secondary account for which trust is established with the primary account, at least one ephemeral scanner configured to scan at least one block storage volume and output metadata defining the at least one block storage volume, the output excluding raw data of the primary account. The method further comprises receiving a transmission of the metadata from the at least one ephemeral scanner, excluding raw data of the primary account, analyzing the metadata to identify cybersecurity vulnerabilities, correlating each of the cybersecurity vulnerabilities with one of the assets, and generating a report correlating the cybersecurity vulnerabilities with the assets. Systems and computer-readable media implementing the method are also disclosed.

IPC Classes  ?

• H04L 9/08 - Key distribution
• H04L 9/14 - Arrangements for secret or secure communicationsNetwork security protocols using a plurality of keys or algorithms
• H04L 67/1008 - Server selection for load balancing based on parameters of servers, e.g. available memory or workload
• H04L 9/40 - Network security protocols
• H04L 67/101 - Server selection for load balancing based on network conditions
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 21/54 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by adding security routines or objects to programs
• G06F 21/55 - Detecting local intrusion or implementing counter-measures
• G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
• G06F 21/78 - Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
• G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• G06F 9/50 - Allocation of resources, e.g. of the central processing unit [CPU]

Abstract

A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• G06F 21/55 - Detecting local intrusion or implementing counter-measures
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 16/11 - File system administration, e.g. details of archiving or snapshots
• G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result
• G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A cybersecurity scanner deployment system, comprising: at least one processor configured to: access a primary account maintained in a cloud environment; receive information defining a structure of the primary account, the structure including a plurality of assets, and the information excluding raw data of the primary account; deploy, inside the primary account or a secondary account for which trust is established with the primary account, at least one ephemeral scanner configured to scan at least one block storage volume and output metadata defining the at least one block storage volume, the output excluding raw data of the primary account; receive a transmission of the metadata from the at least one ephemeral scanner, excluding raw data of the primary account; analyze the metadata to identify cybersecurity vulnerabilities; correlate each of the cybersecurity vulnerabilities with one of the assets; and generate a report correlating the cybersecurity vulnerabilities with the assets.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• H04L 67/1008 - Server selection for load balancing based on parameters of servers, e.g. available memory or workload
• H04L 67/101 - Server selection for load balancing based on network conditions
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 9/50 - Allocation of resources, e.g. of the central processing unit [CPU]
• G06F 21/54 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by adding security routines or objects to programs
• G06F 21/55 - Detecting local intrusion or implementing counter-measures
• G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
• G06F 21/78 - Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data

Abstract

Systems, methods, and computer-readable media are provided for securing cloud infrastructure, including a method comprising: establishing a trusted relationship between a source account in a cloud environment and a scanner account, using the established trust relationship, utilizing at least one cloud provider API to identify workloads in the source account, using the at least one cloud provider API to query a geographical location of at least one of the identified workloads, receiving an identification of the geographic location, using the cloud provider APIs to access block storage volumes of the at least one workload, determining a file-system of the at least one workload, mounting the block storage volumes on a scanner based on the determined file-system, activating a scanner at the geographic location, reconstructing from the block storage volumes a state of the workload, and assessing the reconstructed state of the workload to extract insights.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• H04L 67/1008 - Server selection for load balancing based on parameters of servers, e.g. available memory or workload
• H04L 67/101 - Server selection for load balancing based on network conditions
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 9/50 - Allocation of resources, e.g. of the central processing unit [CPU]
• G06F 21/54 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by adding security routines or objects to programs
• G06F 21/55 - Detecting local intrusion or implementing counter-measures
• G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
• G06F 21/78 - Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data

Abstract

Systems, methods, and computer-readable media are provided for securing cloud infrastructure, including a method comprising: establishing a trusted relationship between a source account in a cloud environment and a scanner account, using the established trust relationship, utilizing at least one cloud provider API to identify workloads in the source account, using the at least one cloud provider API to query a geographical location of at least one of the identified workloads, receiving an identification of the geographic location, using the cloud provider APIs to access block storage volumes of the at least one workload, determining a file-system of the at least one workload, mounting the block storage volumes on a scanner based on the determined file-system, activating a scanner at the geographic location, reconstructing from the block storage volumes a state of the workload, and assessing the reconstructed state of the workload to extract insights.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• H04L 67/1008 - Server selection for load balancing based on parameters of servers, e.g. available memory or workload
• H04L 67/101 - Server selection for load balancing based on network conditions
• G06F 9/50 - Allocation of resources, e.g. of the central processing unit [CPU]
• G06F 21/54 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by adding security routines or objects to programs
• G06F 21/55 - Detecting local intrusion or implementing counter-measures
• G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
• G06F 21/78 - Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
• G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• H04L 9/08 - Key distribution
• H04L 9/14 - Arrangements for secret or secure communicationsNetwork security protocols using a plurality of keys or algorithms

Abstract

Systems, methods, and computer-readable media are provided for securing cloud infrastructure, including a method comprising: establishing a trusted relationship between a source account in a cloud environment and a scanner account, using the established trust relationship, utilizing at least one cloud provider API to identify workloads in the source account, using the at least one cloud provider API to query a geographical location of at least one of the identified workloads, receiving an identification of the geographic location, using the cloud provider APIs to access block storage volumes of the at least one workload, determining a file-system of the at least one workload, mounting the block storage volumes on a scanner based on the determined file-system, activating a scanner at the geographic location, reconstructing from the block storage volumes a state of the workload, and assessing the reconstructed state of the workload to extract insights.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• H04L 67/1008 - Server selection for load balancing based on parameters of servers, e.g. available memory or workload
• H04L 67/101 - Server selection for load balancing based on network conditions
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 21/54 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by adding security routines or objects to programs
• G06F 21/55 - Detecting local intrusion or implementing counter-measures
• G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
• G06F 21/78 - Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
• G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• H04L 9/08 - Key distribution
• H04L 9/14 - Arrangements for secret or secure communicationsNetwork security protocols using a plurality of keys or algorithms
• G06F 9/50 - Allocation of resources, e.g. of the central processing unit [CPU]

Abstract

A system for inspecting data, the system comprising: at least one processor configured to: establish a trusted relationship between a source account in a cloud environment and a scanner account; using the established trust relationship, utilize at least one cloud provider API to identify workloads in the source account; use the at least one cloud provider API to query a geographical location of at least one of the identified workloads; receive an identification of the geographic location; use the cloud provider APIs to access block storage volumes of the at least one workload; determine a file-system of the at least one workload; mount the block storage volumes on a scanner based on the determined file-system; activate a scanner at the geographic location; reconstruct from the block storage volumes a state of the workload; and assess the reconstructed state of the workload to extract insights.

IPC Classes  ?

• H04L 9/40 - Network security protocols

Abstract

A method and system for securing virtual cloud assets at rest against cyber threats. The method comprises determining a location of a view of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is at rest and, when activated, instantiated in the cloud computing environment; accessing the view of the virtual disk based on the determined location; analyzing the view of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset, wherein the virtual cloud asset is inactive during the analysis; and alerting detected potential cyber threats based on a determined priority.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 16/11 - File system administration, e.g. details of archiving or snapshots
• G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result

Abstract

A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.

IPC Classes  ?

• H04L 9/40 - Network security protocols
• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• G06F 16/11 - File system administration, e.g. details of archiving or snapshots
• G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result

Abstract

A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.

IPC Classes  ?

• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• H04L 9/40 - Network security protocols
• G06F 16/11 - File system administration, e.g. details of archiving or snapshots
• G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result

Abstract

A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.

IPC Classes  ?

• G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
• H04L 9/40 - Network security protocols
• G06F 16/11 - File system administration, e.g. details of archiving or snapshots
• G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result

Goods & Services

Software as a service (SAAS) services featuring software for protecting cloud computing platform against cybersecurity threats

Goods & Services

Software as a service (SAAS) services featuring software for protecting cloud computing platforms against cybersecurity threats

Goods & Services

Software as a service (SAAS) services featuring software for protecting cloud computing platforms against cybersecurity threats