Abstract: Implementations of an access bridge to facilitate migration from a role-based access control management system to an attribute-based access control management system are provided.

Abstract: In some aspects, a method for managing security policies on a network may include a policy manager receiving, from one or more security services implemented on a network, information descriptive of a security policy data and a security status of at least one network connection between a user and a service protected by the one or more security services. The policy manager may also compare the security policy data and the security status of at least one network connection to determine one or more discrepancies between an intent of the security policy data and the security status. Finally, the policy manager may present a visual representation of the security data that includes at least an indication of the one or more discrepancies.

Abstract: An authenticating application may send instructions to a device to generate and emit an ultrasonic signal, the device being associated with a user having access credential to a virtual meeting. The application may receive in real time from the virtual meeting, audio data associated with the access credential. The application may search the audio data for the ultrasonic signal. Responsive to finding the ultrasonic signal in the audio data, the application may categorize the access credential as authentic and allow the access credential into the virtual meeting. Responsive to not finding the ultrasonic signal in the audio data, the application may categorize the access credential as unauthentic and reject the access credential from the virtual meeting.

Abstract: A method, system and nodes are disclosed. According to one or more embodiments, a management node is provided. The management node includes processing circuitry configured to receive an origin certificate for a first service type where the received origin certificate includes a public key and a private key, receive a certificate request for a first instance of the first service type, generate a first proxy certificate based at least on the received origin certificate, and transmit the first proxy certificate and the public key of the received origin certificate to a first virtual network function component where the public key of the received origin certificate is for inclusion to a listing of trusted certificates at the first virtual network function component.

Abstract: Determining policy content-based controls for real-time security and compliance monitoring including receiving, from a user computing system, a user-generated policy document associated with an organization; creating a set of user-generated control language records from the user-generated policy document, wherein each user-generated control language record corresponds to a description of a control in the user-generated policy document; converting each user-generated control language record in the set of user-generated control language records into a user-generated control language code; matching each user-generated control language code to a stock control language code within a stock control language code repository; and presenting, on the user computing system, the set of controls associated with the matched stock control language codes as controls for the user-generated policy document.

Abstract: Arrangements for steganography-based security document access control are provided. In some examples, a security policy for a document may be generated. The security policy may include identification of one or more users authorized to access the document and one or more response actions to execute upon violation of the security policy. The generated security policy may be embedded in the document using steganography. Accordingly, transmission of the document may include transmission of the security policy with the document. The document may be transmitted to a destination node. A user at the destination node may request access to the document. In response to the request, the security policy embedded in the document may be executed to confirm whether the user is an authorized user. If the user is authorized, access to the document may be enabled. If the user is not authorized, the one or more response actions may be executed.

Abstract: Systems and methods provide adaptive collection of telemetry by an Information Handling System (IHS). Telemetry is identified that is ready for transmission by the IHS. A position of the telemetry is determined within a telemetry chain of telemetry generated by the IHS. A signaling pathway is selected for transmission of the telemetry based on the position of the telemetry within the telemetry chain.

Abstract: Systems and methods provide synchronized collection of telemetry by an Information Handling System (IHS) operating in a zero-trust computing environment. Telemetry is identified that is ready for transmission by the IHS. A policy decision point of the zero-trust computing environment is notified of the identified telemetry that is ready for transmission by the IHS. The IHS receives a counter from the policy decision point for ordering the telemetry that is ready for transmission within the telemetry of the zero-trust computing environment. The telemetry is annotated with the counter that is received from the policy decision point. The transmitted telemetry may then be sequenced with all other telemetry generated in the zero-trust computing environment.

Abstract: A method of a first electronic device which is connected to a fabric network supporting end-to-end encryption (E2EE) in a wireless communication system is provided. The method includes generating a fabric key based on a pre-stored first device key and a second member key received from a second electronic device, transmitting the fabric key to the second electronic device through a fabric server, which manages the fabric network, and a service server, which manages service data, encrypting service data based on the fabric key, and transmitting the encrypted data to the second electronic device through the service server, wherein the fabric key is shared with the fabric server, which is a member entity of the fabric network, and the second electronic device, wherein the encrypted data is decryptable at a member entity of the fabric network that shares the fabric key.

Abstract: Hardware-based security systems with various codes can enhance the security, privacy, simplicity, and efficiency of various transactions between transmitting and receiving parties. The real-time parameters such as time, date, and location, which keep changing for each person are easily accessible. Such parameters may be used for a new security protocol and system, wherein, the devices can encrypt or decrypt the communication using regularly changing parameters that makes communication highly decentralized and harder to hack or figure out. Furthermore, various algorithms of encryption, decryption, or cryptography can be used in association with the parameters to enhance the communication security further.

Abstract: A policy enforcement device receives a first data packet sent by a source device. The first data packet carries information about a source security group and information about a destination security group, where the source security group is a security group to which the source device belongs, and where the destination security group is a security group to which a destination device of the first data packet belongs.

Abstract: According to one embodiment, a method, computer system, and computer program product for managing application access is provided. The embodiment may include receiving real-time biometric data of a user as the user interacts with a computing device and deriving a real-time biometric signature of the user based on the received real-time biometric data. Responsive to determining that the real-time biometric signature is known, the embodiment may include identifying the user, computing a confidence score of the real-time biometric signature, and configuring application access and application functionality available to the user via the computing device based on the identification of the user and the computed confidence score. The embodiment may include continuously performing the receiving and the deriving as the user interacts with the computing device. While a successive real-time biometric signature is known, the embodiment may include continuously performing the identifying, the computing, and the configuring.

Abstract: A method includes: generating a manifest of assets during the target time interval; labeling each asset in the manifest of assets with a set of attributes exhibited by the asset during the target time interval; defining a first attribute category exhibiting a first combination of attributes; assigning a first action to the first attribute category; identifying a subset of assets in the manifest of assets matching the first attribute category, each asset in the subset of assets exhibiting a set of attributes including the first combination of attributes; and executing the first action on the first subset of assets.

Abstract: Embodiments described herein are generally related to systems and methods for providing cloud environments, for use by tenants of a cloud infrastructure environment in accessing software products, services, or other offerings associated with the environment, including methods for defining and enforcing service control policies directed to services and service features. In accordance with an embodiment, the system comprises a service control repository or service catalog that provides a definition of the services and service features, together with service control policies or rules that define availability or access to the service features. A service control policy framework, comprising a feature management service, determines, by reference to a hierarchy of entities defining the service control policies, which different entities can control the availability of particular services or service features to end users.

Abstract: Systems, computer program products, and methods are described herein for improving network and data security by automatically preventing rogue database queries. The present disclosure is configured to identify a query request, wherein the query request comprises query request metadata; apply the query request to a generative adversarial network (GAN) model, wherein the GAN model is protected by a security gateway; generate, by the GAN model, a result metadata based on the query request, wherein the GAN model is trained on a database schema; and determine, based on a comparison of the query request metadata and the result metadata, whether to allow the query request by the security gateway.

Abstract: Non-human identities (NHI) are present in many organizations. NHIs may be associated with automated processes, bots, devices, and so forth. NHIs may be involved in operations within an organization, as well as operations that interact with other organizations. The creation and management of NHIs differs from human identities. A system for managing NHIs ingests data from an existing system and determines the NHIs. Once determined, the system provides a single management point for NHIs, providing visibility and allowing management according to specified best practices appropriate to the organization. New NHIs may be provisioned as needed and with appropriate security permissions. Access credentials of NHIs may be rotated. Old, unused, or compromised NHIs may be quickly deprovisioned. Operations that are better performed by an NHI may be migrated from a human identity to the NHI, avoiding breakage due to changes in the human identity status.

Abstract: Presented herein are systems and methods for reactive hard zoning. In one or more embodiments, a monitoring and visibility services (MVS) controller receives zoning information from a centralized discovery controller and also receives data traffic flow information from traffic samplers that continuously monitor network traffic flows (e.g., using SFLOW) in the network. Responsive to the MVS detecting a violating data traffic flow (i.e., zoning configuration does not allow a host to access a storage port), an enforcement engine of the MVS may cause one or more actions to be taken relative to the detected violation. An action may comprise adding a networking configuration (e.g., ACL or disable (a.k.a., fence) the interface on the switch that the host is attached to) to deny that communication, flagging the communication, etc. The network configuration may be reset to a default policy either automatically (e.g., timeout) or manually via administrative configuration.

Abstract: Systems and methods are disclosed for determining authenticity of a resource system. The method includes receiving a dataset that includes a first subset and a second subset associated with a first resource system; down-sampling the first subset but not the second subset; generating a first feature for a machine learning model based on the down-sampled first subset; generating a second feature for the machine learning model based on the second subset; generating, via input of at least one of the first feature or the second feature into the machine learning model that is trained to output a fraudulent measure, one or more data objects indicative of validating the fraudulent measure; and initiating performance of one or more prediction-based actions in response to the generating.

Abstract: Three-dimensional density key authentication employs a solid three-dimensional key, opaque to visible light, having varying three-dimensional density. A first three-dimensional reader-sensor scans the three-dimensional key and creates a first digital density map of the three-dimensional key, or/or a hash thereof. An authentication server Information Handling System (IHS), operatively coupled to the first three-dimensional reader-sensor preloads the first digital density map or hash, and maps a user, action, operation and/or the like with the three-dimensional key.

Abstract: Even though serverless computing has advantages like lower cost, simplified scalability, simplified backend code and quicker turnaround, they have also given rise to a new form of cyber-attacks. Most of the conventional approaches are reactive based where steps are taken to control the aftereffects of an attack and preventive mechanism is of less focus. The present honeypot based approach for serverless cloud architecture, honeypots capture unauthorized users in order to provide security of the overall system. The honeypots redirect the attackers to a set of dummy nodes that form a random loop. Using a controlled time based loop, the attacker could be trapped for a maximum amount of time, thus penalizing the attacker by a negative award. It would result in exhaustion of resources and bandwidth of attacker. The present disclosure is also applicable to multi-cloud or hybrid cloud setup.