Abstract: A method and system for role and access rights management in a cloud computing environment are presented. The method includes accessing a first identity provider system to detect a first role, including access to a first resource accessing a second identity provider system to detect a second role, including access to a second resource generating in a control database a representation of a canonical identity generating in the control database a representation of the first role, and a representation of the second role generating in the control database a connection between canonical identity and the representation of the first role and the representation of the second role representing the first resource and the second resource in the control database determining a level of access rights for the canonical identity based on the connection and providing secure user authentication for the canonical identity based on the level of access rights.

Abstract: A system and method for providing context-based access to managed resources in a computing environment is presented. The method includes detecting a request to access a resource in a computing environment, the request including an action, an identifier of the resource, and an identifier of a principal; determining an access permission required to access the resource; determining an access context based on the identifier of the principal; providing the principal with the access permission to access the resource, in response to determining that a risk score associated with the access context is below a first predetermined threshold; and initiating a remediation action in the computing environment in response to determining that the risk score exceeds a second predetermined threshold.

Abstract: A system and method for identity modeling and effective permission management in a cloud computing environment is presented. The method includes accessing a first identity provider system to detect a first identity, the first identity including a first permission; accessing a second identity provider system to detect a second identity, the second identity including a second permission; generating in a control database a representation of a canonical identity; generating in the control database a representation of the first identity, and a representation of the second identity; generating in the control database a connection between canonical identity and: the representation of the first identity, and the representation of the second identity; representing the first permission and the second permission in the control database; and determining an effective permission for the canonical identity based on each identity representation connected to the canonical identity.

Abstract: A system and method for utilizing an artificial intelligence (AI) browser agent to extract identity information for applying a cybersecurity control is presented. The method includes receiving access credentials to a software service, the software service including a plurality of associated identities; detecting in the software service each identity of the plurality of identities, and at least a metadata associated with each identity; generating for each detected identity a representation, the representation generated based on the associated at least a metadata; applying a control on the representation; and initiating an action in the software service, based on a result of applying the control on the representation.

Abstract: A system and method for providing context-based access to managed resources in a computing environment is presented. The method includes detecting a request to access a resource in a computing environment, the request including an action, an identifier of the resource, and an identifier of a principal; determining an access permission required to access the resource; determining an access context based on the identifier of the principal; providing the principal with the access permission to access the resource, in response to determining that a risk score associated with the access context is below a first predetermined threshold; and initiating a remediation action in the computing environment in response to determining that the risk score exceeds a second predetermined threshold.

Abstract: A computing device includes a computing system and a method for identifying files transmitted from an internal computing device within an internal network to an external computing device within an external network. The computing system comprises one or more internal computing devices which are connectable by an internal network. At least one of the internal computing devices is configured to be operable as a workstation or as a file server, wherein the workstation or the file server is capable of generating, storing and/or transmitting a data file. Further, at least one of the internal computing devices is configured to be operable as an insertion device. The insertion device is capable of inserting a data file element into the data file to generate a tagged data file. Further, at least one of the internal computing devices is configured to be operable as a gateway. The gateway is capable of connecting the internal network to an external network.

Abstract: A computing device includes a computing system and a method for identifying files transmitted from an internal computing device within an internal network to an external computing device within an external network. The computing system comprises one or more internal computing devices which are connectable by an internal network. At least one of the internal computing devices is configured to be operable as a workstation or as a file server, wherein the workstation or the file server is capable of generating, storing and/or transmitting a data file. Further, at least one of the internal computing devices is configured to be operable as an insertion device. The insertion device is capable of inserting a data file element into the data file to generate a tagged data file. Further, at least one of the internal computing devices is configured to be operable as a gateway. The gateway is capable of connecting the internal network to an external network.