CyberArk Software Ltd.

Disclosed embodiments relate to systems and methods for securely storing a secret. Techniques include accessing a secret associated with a network identity and generating a primary encryption key for encrypting the secret. Generating the primary encryption key includes: accessing a first encryption key associated with the network identity, accessing a second encryption key stored in a process memory location associated with a machine of the network identity, and applying a primary key hash function to the first encryption key and the second encryption key to generate the primary encryption key. Techniques further include encrypting the secret using the primary encryption key to generate an encrypted secret; obfuscating the encrypted secret to generate an obfuscated encrypted secret; and storing the obfuscated encrypted secret in a secured storage location associated with the machine of network identity.

Disclosed embodiments relate to systems and methods for securing kernel-level system functions. Techniques include hot patching of a kernel by a kernel module loaded into the kernel; identifying a kernel function initiated by a system call associated with a user-level application; intercepting the kernel function by the kernel module; making available, to a security agent, an indication of at least one operation associated with the kernel function; receiving, from the security agent, a determination of whether the at least one operation associated with the kernel function violates at least one security policy; and based on the determination indicating the at least one operation does not violate the at least one security policy, allowing the system call to the kernel; or based on the determination indicating the at least one operation violates at least one security policy, performing at least one control action.

Disclosed embodiments relate to non-transitory computer readable media, systems, and methods for biometrically securing application tasks. Techniques include identifying, by the application, a cryptographic key. Techniques further include prompting an encryption mechanism operated by an operating system to encrypt the cryptographic key using the biometrically protected key. Techniques further include storing the encrypted cryptographic key in a memory location. Techniques further include in a non-active state of the application, using the unencrypted cryptographic key to encrypt data or to ensure authenticity or integrity of data. Techniques further include upon a change of state of the application to an active state, performing at least one of: using the unencrypted cryptographic key or prompting the operating system to decrypt the encrypted cryptographic key using the biometrically protected key. Techniques further include using the decrypted cryptographic key to decrypt the encrypted data or to validate the signature.

Disclosed embodiments relate to systems and methods for securing kernel-level system functions and validating kernel-level verification of signed binaries. Techniques include identifying, by a system patched by a kernel module, a file signed by a user; receiving, by the kernel module, a second key from the user; and validating the signature embedded in the file, by identifying the file; determining whether the signature is embedded in the file; and validating that the signature corresponds to the second key.

Described herein are methods, systems, and computer-readable storage media for using a network identity. Techniques may include encrypting a first data element and storing the encrypted first data element mapped to a network identity. Techniques may further include receiving a request from the network identity to perform an action on a resource, dynamically determining a second data element, decrypting the first data element using the second data element, and performing the action on the resource using the first data element.

Disclosed embodiments relate to systems and methods for centrally analyzing and managing source code. Techniques include identifying, at a centralized resource in a network environment, a first source code; identifying the first source code as a candidate for an execution of an access control action; identifying, at the centralized resource, a security risk indication for the first source code, the security risk indication being based on permissions associated with a functionality of the first source code; performing, based on the security risk indication, at least one of: developing a least privilege set of permissions for the source code, or modifying the least privilege set of permissions.

Disclosed embodiments relate to systems and methods for enabling recurrent use of authentication tokens. Techniques include identifying a first request by a user to access a resource; receiving, from an identity provider service, a token for authentication of a user; encrypting the token based on a secret inputted by the user and first contextual data associated with at least one of: the user, the resource, or a source of the first request; identifying a second request to access the resource; receiving the secret input by the user; decrypting the encrypted token; and based on validating the decrypted token, determining whether the user is permitted to access the resource.

Disclosed embodiments relate to systems and methods for securing kernel-level system functions. Techniques include hot patching of a kernel by a kernel module loaded into the kernel; identifying a kernel function initiated by a system call associated with a user-level application; intercepting the kernel function by the kernel module; making available, to a security agent, an indication of at least one operation associated with the kernel function; receiving, from the security agent, a determination of whether the at least one operation associated with the kernel function violates at least one security policy; and based on the determination indicating the at least one operation does not violate the at least one security policy, allowing the system call to the kernel; or based on the determination indicating the at least one operation violates at least one security policy, performing at least one control action.

Systems, methods, and apparatuses are disclosed for securing the use of secondary processes using secured storage and code injection. Techniques may include identifying sensitive data including at least one secret, storing the sensitive data in a secured storage location, and invoking a secondary process in a suspended mode. Techniques may further include injecting at least one first code element into the secondary process, the at least one first code element being configured to perform at least one operation associated with the sensitive data, and resuming the secondary process, wherein the injected first code element makes the stored sensitive data available to the secondary process.

Disclosed embodiments relate to providing blind secret management and rotation. Techniques include identifying, by a secret rotation manager operating in a first network environment, an encrypted version of a first key material, generating, by the secret rotation manager, an additional key material, combining the encrypted first key material and the additional key material, and providing the combined key material to a rotation agent operating in a second network environment, wherein the rotation agent is configured to decrypt the encrypted first key material from the combined key material, and wherein the rotation agent is configured to generate, according to a secret generation policy, a secret using at least the combined key material.