Cyber-security in heterogeneous networks
A method and a computer program product and an apparatus for securing communication in heterogeneous networks that include devices with different protection levels. The method comprises monitoring, by a security agent installed on a device, communication between the device and external devices. The method comprises determining a level of in-device protection for each device based on available protection thereof. The method further comprises employing, by the security agent, an associated security policy for communications originating from the device, based on the level of in-device protection; such as resources utilized for employing security policies for communications originating from devices are correlated with the protection levels thereof. The method may further comprise enabling sharing security workload between device having trusted security agents to improve performance efficiency thereof.
1 . A method comprising:
determining a communication map comprising at least a secured device, a first device and a second device, the map including information about security tasks performed by security agents installed on each device;
monitoring, by a first security agent of the security agents, installed on the secured device, communication between the secured device and external devices, wherein the external devices comprise at least the first device and the second device;
determining a first level of in-device protection for the first device, wherein the first device is protected by a second security agent of the security agents, the second security agent is an instance of a base agent, wherein the first security agent is also an instance of the base agent;
determining a second level of in-device protection for the second device, wherein the second level is a higher protection level than the first level;
employing, by the first security agent, a first security policy for communications originating from the first device, wherein the first security policy is determined based on the first level of in-device protection; and
employing, by the first security agent, a second security policy for communications originating from the second device, wherein the second security policy is determined based on the second level of in-device protection, wherein the second security policy utilizes more resources than the first security policy;
wherein the second security policy comprises:
directing traffic from the second device to the secured device through a server, wherein the server is configured to process a communication from the second device to the secured device to determine validation thereof; and
in response to the server validating the communication, transferring the communication to the secured device;
in response to the server not validating the communication, blocking the communication to the secured device; and
employing, by one of the first security agent and the second security agent, a partial list of actions for communications originating from external devices, other than the first device and the second device, that are not trusted or are partially trusted.
2 . The method of claim 1 ,
wherein the second security agent is trusted by the first security agent; and
wherein said determining the second level comprises determining that the second device is not protected by any security agent that is trusted by the first security agent.
3 . The method of claim 2 further comprises:
providing a suggestion to install a new security agent on the second device; and
after determining that the new security agent is protecting the second device, employing the first security policy for communications originating from the second device;
whereby reducing resource utilization by the first security agent.
4 . The method of claim 3 , wherein said providing the suggestion comprises requesting a vendor of the second device to install the first security agent on instances of devices of a type of the second device.
5 . The method of claim 3 , wherein said providing the suggestion comprises:
informing an intermediate gateway of a compromised communication from the second device, whereby causing the intermediate gateway to automatically install the new security agent on the second device.
6 . The method of claim 2 , wherein the second security agent is determined to be trusted by the first security agent due to the second security agent is published by a vendor, wherein the vendor is listed in a list of trusted vendors; or the second security agent is published by a vendor that published the first security agent.
7 . The method of claim 1 , wherein said determining the second-level of in-device protection is based on vulnerability information associated with devices from a type of the second device, wherein the vulnerability information is obtained from a vulnerability database, and wherein the vulnerability information comprises at least one item selected from the group consisting of: a list of attacks that can work on each device, weaknesses of each device, and known security bugs for each device.
8 . The method of claim 1 , wherein the second security policy comprises an examination action for incoming communications, wherein the examination action comprises:
determining whether an incoming communication is associated with a compromising action and in response to a determination that the incoming communication is associated with the compromising action, performing a responsive action; wherein the first security policy excludes the examination action; whereby the examination action is performed with respect to communication originating from the second device and is not performed with respect to communication originating from the first device.
9 . The method of claim 1 , wherein the second security policy comprises utilizing resources of a trusted server to improve security of the secured device with respect to communications originating from the second device, wherein the first security policy is devoid of utilization of the resources of the trusted server.
10 . The method of claim 9 , wherein said utilizing comprises executing a second security agent on the trusted server, wherein the second security agent is configured to validate outgoing communications from the second device;
wherein the first device is configured to execute a first third security agent, wherein the first third security agent is configured to validate outgoing communications from the first device;
wherein the second security policy comprises employing, the first security policy for communications originating from the second device and tunneled through the server.
11 . The method of claim 1 , further comprises:
installing a new security agent on the secured device, wherein the new security agent is configured to process communications originating from the second device, whereby mitigating the potential risk to the secured device resulted from the communication from the second device using a dedicated security agent.
12 . The method of claim 1 , further comprises:
installing a new security agent on a third device, wherein the third device is connected to the secured device, wherein the new security agent is configured to process communications originated from the second device to the secured device, whereby mitigating the potential risk to the secured device resulted from the communication from the second device using a dedicated security agent.
13 . The method of claim 1 , wherein the external devices comprise a third device, wherein the method further comprises:
determining a third level of in-device protection for the third device, wherein said determining the third level comprises determining that the third device is not protected by any security agent that is trusted by the first security agent, wherein the third level is a higher protection level than the second level;
wherein said determining the second level comprises determining that the second device is not protected by any security agent that is trusted by the first security agent;
employing, by the first security agent, a third security policy for communications originating from the third device, wherein the third security policy is determined based on the third level of in-device protection, wherein the third security policy utilizes more resources than the second security policy.
14 . A computer program product comprising a non-transitory computer readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method comprising:
determining a communication map comprising at least a secured device, a first device and a second device, the map including information about security tasks performed by security agents installed on each device;
monitoring, by a first security agent of the security agents, installed on the secured device, communication between the secured device and external devices, wherein the external devices comprise at least the first device and the second device;
determining a first level of in-device protection for the first device, wherein the first device is protected by a second security agent of the security agents, the second security agent is an instance of a base agent, wherein the first security agent is also an instance of the base agent;
determining a second level of in-device protection for the second device, wherein the second level is a higher protection level than the first level;
employing, by the first security agent, a first security policy for communications originating from the first device, wherein the first security policy is determined based on the first level of in-device protection; and employing, by the first security agent, a second security policy for communications originating from the second device, wherein the second security policy is determined based on the second level of in-device protection, wherein the second security policy utilizes more resources than the first security policy;
wherein the second security policy comprises:
directing traffic from the second device to the secured device through a server, wherein the server is configured to process a communication from the second device to the secured device to determine validation thereof; and
in response to the server validating the communication, transferring the communication to the secured device;
in response to the server not validating the communication, blocking the communication to the secured device; and
employing, by one of the first security agent and the second security agent, a partial list of actions for communications originating from external devices, other than the first device and the second device, that are not trusted or are partially trusted.
15 . A system comprising a secured device, that determine a communication map comprising at least a first device and a second device, the map including information about security tasks performed by security agents installed on each device;
monitor, by a first security agent of the security agents, installed on the secured device, communication between the secured device and external devices, wherein the external devices comprise at least the first device and the second device;
determine a first level of in-device protection for the first device, wherein the first device is protected by a second security agent of the security agents, the second security agent is an instance of a base agent, wherein the first security agent is also an instance of the base agent;
determine a second level of in-device protection for the second device, wherein the second level is a higher protection level than the first level;
employ, by the first security agent, a first security policy for communications originating from the first device, wherein the first security policy is determined based on the first level of in-device protection; and
employ, by the first security agent, a second security policy for communications originating from the second device, wherein the second security policy is determined based on the second level of in-device protection, wherein the second security policy utilizes more resources than the first security policy;
wherein the second security policy comprises:
directing traffic from the second device to the secured device through a server, wherein the server is configured to process a communication from the second device to the secured device to determine validation thereof; and
in response to the server validating the communication, transferring the communication to the secured device;
in response to the server not validating the communication, blocking the communication to the secured device; and
employing, by one of the first security agent and the second security agent, a partial list of actions for communications originating from external devices, other than the first device and the second device, that are not trusted or are partially trusted.