Cyber-security in heterogeneous networks

1 . A method comprising:

identifying a connection between a first device and a second device,

wherein the first device is protected by a first security agent installed thereon,

wherein the first security agent is configured to secure communications between the first device and first external devices, the first external devices comprising at least one device not protected by any security agent that is trusted by the first security agent,

wherein the second device is protected by a second security agent installed thereon,

wherein the second security agent is configured to secure communications between the second device and second external devices, the second external devices comprising at least one device not protected by any security agent that is trusted by the second security agent,

wherein the first device is allocated to perform a first security workload comprising protecting from security risks associated with any of the first external devices,

wherein the second device is allocated to perform a second security workload comprising protecting from security risks associated with any of the second external devices, and

wherein the first security workload and the second security workload comprise an overlapping workload;

in response to determining that the first device and the second device have trusted security agents, wherein the trusted security agents are instances of a base agent, changing allocation of at least a portion of the first security workload and the second security workload between the first device and the second device based on the overlapping workload,

wherein said allocating further comprises allocating at least a portion of the first security workload and a third security workload between the first device and a third device, wherein the third device is protected by a third security agent installed thereon, wherein the third device is enabled to share the third security workload with the first device without determining that the third security agent is trusted by the first security agent, and

instructing the first security agent and the second security agent to perform tasks according to the changed allocation,

whereby improving efficiency of performing the first security workload and the second security workload.

2 . The method of claim 1 further comprises:

determining an intersection between the first security workload and the second security workload,

wherein the intersection comprises the overlapping workload which is configured to be performed by the first device and by the second device;

wherein the portion of the first security workload and the second security workload comprises the overlapping workload; and

wherein said allocating defines that each task of the overlapping workload is performed by a single device, whereby reducing overall resource utilization of the first and second devices in performing the first and second security workloads.

3 . The method of claim 1 , wherein said allocating is performed based on real-time available resources of the first device and the second device.

4 . The method of claim 1 , wherein the first security workload is a concretization of the second security workload, wherein said allocating comprises determining to perform the first security workload and not the second security workload, wherein the method further comprises utilizing an output of the first security workload instead of performing the second security workload.

5 . The method of claim 1 ,

wherein the first device and the second device are comprised by a trusted mesh network;

wherein the second security agent is trusted by the first security agent;

wherein the trusted mesh network comprises the third device,

wherein the third security agent is configured to monitor communications between the third device and third external devices,

wherein the third security agent is trusted by the second security agent; and

wherein the third device is configured to perform a third security workload;

whereby improving efficiency of performing the first security workload.

6 . The method of claim 5 further comprises:

identifying a communication between the first device and a fourth device;

determining that the fourth device is not protected by any security agent that is trusted by a security agent installed on a device comprised by the trusted mesh network;

providing a suggestion to install a new security agent on the fourth device; and

after determining that the new security agent is protecting the fourth device, adding the fourth device to the trusted mesh network, whereby enabling the fourth device to share security tasks with other devices in the trusted mesh network; whereby reducing resource utilization by security agents of devices in the trusted mesh network.

7 . The method of claim 1 , wherein changing the allocation is performed by a workload sharing protocol.

8 . The method of claim 1 , comprising: installing a simplified security agent on the first device, and using the simplified security agent for a fourth device when the fourth device is communicating with the first device, wherein the fourth device is not protected by a trusted security agent.

9 . A computer program product comprising a non-transitory computer readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method comprising:

identifying a connection between a first device and a second device,

wherein the first device is protected by a first security agent installed thereon, wherein the first security agent is configured to secure communications between the first device and first external devices, the first external devices comprising at least one device not protected by any security agent that is trusted by the first security agent,

wherein the second device is protected by a second security agent installed thereon, wherein the second security agent is configured to secure communications between the second device and second external devices, the second external devices comprising at least one device not protected by any security agent that is trusted by the second security agent,

wherein the first device is allocated to perform a first security workload comprising protecting from security risks associated with any of the first external devices,

wherein the second device is allocated to perform a second security workload comprising protecting from security risks associated with any of the second external devices,

wherein the first security workload and the second security workload comprise an overlapping workload;

in response to determining that the first device and the second device have trusted security agents, wherein the trusted security agents are instances of a base agent, changing allocation of at least a portion of the first security workload and the second security workload between the first device and the second device based on the overlapping workload,

wherein said allocating further comprises allocating at least a portion of the first security workload and a third security workload between the first device and a third device, wherein the third device is protected by a third security agent installed thereon, wherein the third device is enabled to share the third security workload with the first device without determining that the third security agent is trusted by first security agent, and

instructing the first security agent and the second security agent to perform tasks according to the changed allocation,

whereby improving efficiency of performing the first security workload and the second security workload.