US 12,143,411 B2
On-demand and proactive detection of application misconfiguration security threats
Omer Tsarfati, Petach-Tikva (IL); and Asaf Hecht, Tel Aviv (IL)
Assigned to CyberArk Software Ltd., Petach-Tikva (IL)
Filed by CyberArk Software Ltd., Petach-Tikva (IL)
Filed on Apr. 7, 2020, as Appl. No. 16/841,840.
Prior Publication US 2021/0314339 A1, Oct. 7, 2021
Int. Cl. G06F 21/00 (2013.01); G06F 21/57 (2013.01); H04L 9/40 (2022.01)
CPC H04L 63/1433 (2013.01) [G06F 21/577 (2013.01); H04L 63/10 (2013.01); H04L 63/1416 (2013.01); H04L 63/20 (2013.01)] 15 Claims
OG exemplary drawing
 
1. A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for detecting application misconfiguration security threats, the operations comprising:
scanning a computing environment to identify an application on an authorization server, wherein the application is configured to maintain a trusted list of network resources and the authorization server is configured to generate an access token for a network device for accessing a target network resource based on whether the target network resource is included in the trusted list, wherein the target network resource is accessible by the network device conditional on the network device asserting the access token;
accessing the trusted list to identify a target network address included in the trusted list, wherein the target network address has been compromised by an attacker;
comparing the target network address to a whitelist of trusted target network addresses;
determining, based on the comparing, that the target network address has been compromised by the attacker;
determining, based on a comparison between at least one privilege associated with the identity and at least one credential accessible through the target network resource, that holding the at least one credential by the identity would potentially result in an illegitimate privilege elevation by the identity; and
performing, based on at least one of the determination that the target network address has been compromised by the attacker or the determination that holding the at least one credential by the identity would potentially result in an illegitimate privilege elevation, a control action associated with the target network address, wherein the control action includes at least one of: disabling the network device from accessing the target network resource or generating an alert.