CyberArk Software Ltd.

Disclosed embodiments relate to systems and methods for detecting and mitigating unwanted instructions in artificial intelligence models authentication at a client application. Example techniques include receiving, an original request from a user; identifying historical data associated with a previous interaction with the user; receiving, from a trained model, an action identifier associated with raw data stored in a data source; receiving the raw data from the data source as a result of performing an action based on the action identifier; supplementing the raw data with a relevant portion of the historical data to generate supplemented data; determining whether the supplemented data includes an instruction; and based on a determination that the supplemented data includes the instruction, performing a control action.

Disclosed herein are techniques for securing a real time communication session between at least two computing devices. Operations may include monitoring the communication session between the at least two computing devices associated with an organizational communication security service, validating, by the organizational communication security service, the communication session, determining, by the organizational communication security service, a security status of the communication session based on the real-time validation of the communication session, and performing, by the organizational communication security service, a security action based on the security status.

Methods and systems of risk assessment for network access control through data analytics. An embodiment of the invention employs well-known machine-learning clustering methods to learn normal entity behavior by looking for patterns in the events that stream in continuously. In an embodiment of the invention, normal entity behaviors are represented as clusters of event vectors. An embodiment of the invention evaluates the risk level for a new event of an entity by comparing the event with the entity's profile represented as clusters of event vectors. In an embodiment of the invention, the risk level is associated with a confidence level. Confidence level indicates how well the system knows about the entity. Embodiments of the invention do not need human administration in the process of building entity profile and assessing risk level of events associated with an entity.

Disclosed embodiments relate to systems and methods for securely storing a secret. Techniques include accessing a secret associated with a network identity and generating a primary encryption key for encrypting the secret. Generating the primary encryption key includes: accessing a first encryption key associated with the network identity, accessing a second encryption key stored in a process memory location associated with a machine of the network identity, and applying a primary key hash function to the first encryption key and the second encryption key to generate the primary encryption key. Techniques further include encrypting the secret using the primary encryption key to generate an encrypted secret; obfuscating the encrypted secret to generate an obfuscated encrypted secret; and storing the obfuscated encrypted secret in a secured storage location associated with the machine of network identity.

Disclosed embodiments relate to systems and methods for securing kernel-level system functions. Techniques include hot patching of a kernel by a kernel module loaded into the kernel; identifying a kernel function initiated by a system call associated with a user-level application; intercepting the kernel function by the kernel module; making available, to a security agent, an indication of at least one operation associated with the kernel function; receiving, from the security agent, a determination of whether the at least one operation associated with the kernel function violates at least one security policy; and based on the determination indicating the at least one operation does not violate the at least one security policy, allowing the system call to the kernel; or based on the determination indicating the at least one operation violates at least one security policy, performing at least one control action.

Disclosed embodiments relate to non-transitory computer readable media, systems, and methods for biometrically securing application tasks. Techniques include identifying, by the application, a cryptographic key. Techniques further include prompting an encryption mechanism operated by an operating system to encrypt the cryptographic key using the biometrically protected key. Techniques further include storing the encrypted cryptographic key in a memory location. Techniques further include in a non-active state of the application, using the unencrypted cryptographic key to encrypt data or to ensure authenticity or integrity of data. Techniques further include upon a change of state of the application to an active state, performing at least one of: using the unencrypted cryptographic key or prompting the operating system to decrypt the encrypted cryptographic key using the biometrically protected key. Techniques further include using the decrypted cryptographic key to decrypt the encrypted data or to validate the signature.

Described herein are methods, systems, and computer-readable storage media for using a network identity. Techniques may include obtaining and encrypting a first data element using an encryption key and storing the encrypted first data element mapped to a network identity. Techniques may further include receiving a request from the network identity to perform an action on a resource and authenticating the network identity using an existing protocol, decrypting the first data element using a second data element calculated based on standard fields of the existing protocol, and enabling the action on the resource using the first data element.

Disclosed embodiments relate to systems and methods for securing kernel-level system functions and validating kernel-level verification of signed binaries. Techniques include identifying, by a system patched by a kernel module, a file signed by a user; receiving, by the kernel module, a second key from the user; and validating the signature embedded in the file, by identifying the file; determining whether the signature is embedded in the file; and validating that the signature corresponds to the second key.

Disclosed embodiments relate to systems and methods for detecting and addressing security risks in remote native access sessions. Techniques include identifying a remote native access session between a client and a target resource. The techniques may further include identifying connection data associated with the remote native access session obtained by a connection agent, wherein the connection data originates from the client and from a mobile device associated with a user, and comprises data indicative of at least one of: hardware of the client or mobile device, configuration settings of the client or mobile device, and network connection attributes of the client or mobile device. Techniques may further include comparing a first portion of the connection data associated with the client with a second portion of the connection data associated with the mobile device; and determining, based on the comparing, a security risk associated with the remote native access session.

Described herein are methods, systems, and computer-readable storage media for using a network identity. Techniques may include encrypting a first data element and storing the encrypted first data element mapped to a network identity. Techniques may further include receiving a request from the network identity to perform an action on a resource, dynamically determining a second data element, decrypting the first data element using the second data element, and performing the action on the resource using the first data element.