Abstract: In a computer implemented method of discovering a data attack surface of a network, audit data for a plurality of datastores of the network is received, the audit data including time series data of access events to the plurality of datastores of the network. An access event identifies a host device accessing a datastore, a user identifier of the host device accessing the datastore, a timestamp of the access event, and an operation performed by the host device during the access event. Host devices and user identifiers accessing a datastore are identified based on the audit data. The host devices and user identifiers accessing datastores are correlated, the correlating identifying an intersection of the host devices and the user identifiers interacting with the plurality of datastores. The data attack surface of the network is generated based on the correlating the host devices and user identifiers accessing the plurality of datastores.

Abstract: In a computer implemented method of vulnerability assessment within a network, vulnerability assessment data including audit data is received for a plurality of storage devices of a network, the audit data including time series data of access events to the plurality of storage devices, an access event identifying a host device accessing the storage device of the plurality of storage devices, a user identifier of the host device accessing the storage device, and an operation performed by the host device during the access of the storage device. The vulnerability assessment data is evaluated to predict host devices and user identifiers of the network demonstrating a risk of vulnerability to stored data of the plurality of storage devices. A list is generated of the host devices and the user identifiers of the network demonstrating a risk of vulnerability to the stored data of the plurality of storage devices of the network.

Abstract: The present invention provides a method for providing a computer implemented method and system for creating a trusted cloud security architecture having the following steps: a primary agent communicating with two or more secondary agents creating a trust ring or other shape of agent communications, the primary agent operating on a primary guest OS and two or more secondary agents operating on two or more secondary guest OSs; implementing a latency based topology for the trust ring having a network of links between disparate IP addresses, the disparate IP addresses corresponding with the primary agent and two or more secondary agents; the primary agent and two or more secondary agents exchanging data packets between the latency based topology within the trust ring; and outputting the exchanged data packets to a processing engine, the processing engine determining a trust status for the trust ring, the trust status based on the data packets between the latency based topology.