Abstract: A novel approach to dynamically build and maintain a trusted list of IP addresses is described. Using programmable Software Defined Networking (SDN) switch it is possible to duplicate the TLS Client Hello packets (flow establishments packets) and have the copy forwarded to a Verifier Process that cryptographically verifies the identity of the destination IP address together with its claimed domain name. Once the verification concludes that the IP address does indeed belong to a certain domain, it can compare it with a list of allowed listed domain names and decide to add the IP Address or not to the allow list. During the verification process, normal packet flow occurs. That is, packets would normally flow from a TLS application (often a web browser) to a TLS termination point (often a web server) via at least one cyber-security device (often a firewall).

Abstract: A system for generating a cybersecurity investigation case that comprises: an event parser for receiving an event and identifying at least one empty entity from the received event; a case investigator for determining a value to the at least one empty entity to obtain at least one enriched entity; a case correlator for associating at least one existing investigation case to the received event; and a case manager for generating and outputting the cybersecurity investigation case.

Abstract: A system and method for allowing direct storage access to a notebook computers resources. The system predetermines an environment given to a wireless enabled notebook, determines if the notebook has been moved, determines if the environment has been classified, determines a system end user's identification and determines if data to be transferred has been buffered. In addition, this method matches system resources to data to be translated, executes the data transfer and returns the resources to an idle state.