Abstract: In some aspects, a system may receive security vulnerability indicators associated with one or more cloud-based applications and/or properties associated with one or more cloud-based images used to create cloud instances. The system may determine, for each indicator and/or property, a corresponding remediation recommendation. The system may generate a graphical user interface that provides the indicators and/or properties with the corresponding remediation recommendations. The system may transmit, based on a user setting, a corresponding message for each indicator and/or property. The system may trigger, based on at least one of the indicators and/or properties, an automated remediation script that instructs a cloud environment to perform an action for a cloud-based application and/or image associated with the at least one indicator and/or property. The system may transmit one or more status indicators associated with the automated remediation script. Numerous other aspects are described.

Abstract: Provided is a method for the validation of a digital certificate by a validation apparatus that checks the certificate of a communication partner on behalf of a first device, including the method steps of: the first device (requesting validation of the certificate of the communication partner at a first validation apparatus, the first validation apparatus querying validation information at a status collection apparatus, checking, in the first validation apparatus, whether validation information has been received from the status collection apparatus, and transmitting the validation information from the first validation apparatus to the first device, wherein, only in the event of a negative inspection result, the validation information of the certificate is determined in the first validation apparatus.

Abstract: To provide a limited access service to one or more applications, for example V2E applications, one or more preconfigured credentials in a user device a vehicle is equipped with are used by a base station to authenticate, from an application server, for example a V2E application server, the user device. If the authentication succeeds, a limited access service is granted.

Abstract: Human system operator identity audit trail systems, methods and products for improving computer technology, including in the field of cloud security in the use of computer networks and legal compliance of computer systems and networks is disclosed. An audit trail of a human system operator's identity and time-stamp to network activities of a containerized application may be established. A human system operator may be prevented from escalating privilege and making unauthorized use of service accounts available to the containerized application in order to issue commands such as higher privilege queries and requests than the ones within the granted access of the human system operator. Granular black-box testing mechanisms may also be provided to assess functional changes across software versions using boundary-scan techniques.

Abstract: What is provided is a method of generating a minimal forensic image of a target dataset to reduce upload demand. The method includes storing a set of criteria in an investigator device, wherein the set of criteria determines target data files of the target dataset which are to be included in the minimal forensic image, and wherein the set of criteria includes a plurality of file types and at least a first upload format for each file type in the plurality of file types, locating the target data files of the plurality of file types in the target dataset using the set of criteria, storing a representation of each target data file in the minimal forensic image in an MFI upload format determined according to the set of criteria, and transferring the minimal forensic image to a cloud server.

Abstract: Described herein are technologies related to generation of a summary of a function in binary code for review by an analyst. A first sequence to sequence model is configured to receive binary code (or a derivative thereof) and translate the binary code to an intermediate representation of the binary code, wherein the intermediate representation approximates source code for the binary code. A second sequence to sequence model is configured to receive the intermediate representation of the binary code and translate the intermediate representation to a human-readable summary of the binary code.

Abstract: Security automation, such as penetration testing or security hardening, is performed using robotic process automation (RPA) by directly connecting one or more robots into an operating system of a platform. The one or more robots execute a workflow to simulate the penetration testing of the operating system to identify malicious activity or vulnerable configurations within the operating system. The one or more robots also generate a report for the user identifying the malicious activity, misconfigurations or vulnerabilities within the environment.

Abstract: In one aspect, the present disclosure relates to a method comprising: receiving an input from a user; verifying the security clearance level in accordance with a user of the user interface; analyzing at least one security clearance level associated with each portion of the data request; locating a data element located in at least one external database, the data element being associated with the data request; parsing the data element, the parsing comprising: determining an allowance of access to at least a portion of the data element in accordance with the following: relevance to the data request, and the verified security clearance level of the user, generating a token, the token being configured to allow access data element, the token comprising a security layer in accordance with the parsing of the data element; and transmitting the token to the user device.

Abstract: Methods, systems, and apparatuses for device fingerprint-based authentication are provided herein. A computing device may receive, from a user device, authentication credentials and a first device fingerprint. The device fingerprint may be encrypted using a public/private key pair and may identify one or more aspects of the user device, such as operating parameters of the user device. Based on the authentication credentials, the computing device may authenticate the user device, store the first device fingerprint, and send a token to the user device. The computing device may receive a request for access to content. The request may comprise the token and a second device fingerprint. The second device fingerprint may be different from the first device fingerprint. Based on the token and comparing the first device fingerprint to the second device fingerprint, the computing device may determine whether to authenticate the device that sent the request.

Abstract: A computer implemented method includes determining a first level of risk based on a context of source code as stored. A second level of risk is determined based on a change history of the source code. A third level of risk is determined by assessing a nature of changes to the source code. The first, second, and third levels of risk are combined to generate an indication of trust in the source code.

Abstract: Methods, apparatus, systems, and articles of manufacture for comprehensive user-centric protection of digital assets are disclosed. An example apparatus includes at least one memory, instructions in the apparatus, and processor circuitry to execute the instructions to identify digital assets associated with a protection threat surface, detect protection events corresponding to threats associated with the digital assets, and determine protection vectors associated with the digital assets based on the protection events, the protection vectors corresponding to protection capabilities associated with the digital assets.

Abstract: Systems and methods for conducting a cloud-based forensic investigation of electronically-stored information are provided. The system includes an investigation requestor device configured to request a forensic investigation including selecting search criteria for the investigation, at least one remote system of the target, wherein the at least one remote system comprises electronically-stored information; a cloud server for storing forensic artifacts collected from the at least one remote system, wherein the forensic artifacts are collected based on the search criteria; and a cloud-based evidence-processing service configured to analyze the forensic artifacts and generate an initial report.

Abstract: One example method includes an optimized approach to real-time utilization, data transfer, data storage, and transience in a T Hz-enabled zone that may be implemented in edge networks, data management, and machine learning. Multiple policies can be enforced based on new sets of attributes such as data type, location, and device movement within a zone or between zones.

Abstract: A distributed security system includes a plurality of content processing nodes that are located external to a network edge of an enterprise and located external from one of a computer device and a mobile device associated with a user, and a content processing node is configured to monitor a content item that is sent from or requested by the external system; classify the content item via a plurality of data inspection engines that utilize policy data and threat data; and one of distribute the content item, preclude distribution of the content item, allow distribution of the content item after a cleaning process, or perform threat detection on the content item, based on classification by the plurality of data inspection engines; and an authority node communicatively coupled to the plurality of content processing nodes and configured to provide the policy data and the threat data for threat classification.

Abstract: Described is a content validation network including a certificate generation engine, a signature engine, a display engine, a certificate status engine, and a digital content card. The certificate generation engine includes a key pair generator to create a user's public and private key producing a digital certificate authenticating a user. The certificate generation engine embeds the public key into the digital certificate. The signature engine generates the user's digital signature unique to their digital content card when validated by their digital certificate. The display engine validates the user's digital signature using their digital certificate then displays the users created digital content card with the user's digital signature embedded into metadata elements of the digital content card. The certificate status engine determines whether the digital signature of the user's digital content card is valid.

Abstract: Techniques for user impact potential based security alert management in computer systems are disclosed. One example technique includes receiving an alert indicating that a security rule has been violated by a user. The example technique can also include, in response to receiving the data representing the alert, determining an impact score of the user based on the profile of the user. The impact score represents a deviation of an assigned value to the profile of the user and a mean value of assigned values of profiles of all users in the organization. The example technique can further include calculating a ranking value of the alert in relation to other alerts based on the determine impact score and other impacts scores corresponding to the other alerts and selectively surfacing the alert to a system analyst based on the calculated ranking value in relation to other alerts.

Abstract: Techniques are provided for detecting executable application that is subjected to tampering or unauthorized modification. A checksum for a portion of the executable application is computed at a run time of the executable application by a tamper detection module encoded in the executable application. The tamper detection module compares the checksum to a pre-determined hash value for the portion of the executable application. If the checksum is different from the hash value, the executable application has been tampered with or otherwise modified. The tamper detection module can then cause an alert to be sent to the user and/or the software vendor indicating that the executable application is not genuine.

Abstract: Example methods are provided to build a smart file reputation cache at a cloud, and to provide the smart file reputation cache to an antivirus (AV) endpoint such as a virtualized computing instance in a virtualized computing environment. Training techniques can be used to build the smart file reputation cache at the cloud, based on information learned from existing AV endpoints and a management server. The smart file reputation can then be provided to newly installed AV endpoints for local access, instead of the AV endpoints sending file reputation requests to the cloud.

Abstract: Systems, methods, and non-transitory computer-readable storage media for using mobile network authentication factors to authenticate a mobile device.

Abstract: Disclosed are various examples for configuring network security based on device management characteristics. In one example, a specification of a set of network resources on an internal network is received from an administrator client. The set of network resources are those network resources that a particular application executed in client devices on an external network should be authorized to access. A gateway from the external network to the internal network is then configured to permit the particular application to have access to the set of network resources.