Dynamic access management for network security
A method for managing access to network resources by a first network device may include establishing a communication session with the first network device. The method may also include receiving information from the first network device during the communication session, the information indicating that the first network device is not in compliance with at least one security-related rule. The method may further include determining whether to modify access by the first network device to at least one of the network resources based on the received information.
1. A method for managing access to network resources by a first network device, comprising:
establishing, by a processor, a communication session with the first network device, the communication session providing the first network device with access to the network resources;
receiving, by the processor, information from the first network device during the communication session, the information indicating that the first network device is not in compliance with at least one security-related rule; and
determining, by the processor, whether to modify access by the first network device to at least one of the network resources based on the received information.
2. The method of claim 1 , further comprising:
sending a message to the first network device when the determining determines that access to a first one of the at least one network resources is to be modified, the message indicating that access by the first network device to the first network resource is prohibited.
3. The method of claim 2 , where the method further comprises:
continuing to allow the first network device to access at least one other network resource of the network resources while access to the first network resource is prohibited.
4. The method of claim 1 , further comprising:
receiving information from the first network device at periodic intervals during the communication session, the information indicating a status of at least one of software or hardware included on the first network device; and
determining, at the periodic intervals, whether to modify access by the first network device to at least one of the network resources in response to the received information.
5. The method of claim 1 , where the receiving information is triggered by a change in configuration of the first network device.
6. The method of claim 1 , where the receiving information is triggered in response to a timer at the first network device reaching a predetermined value.
7. The method of claim 1 , further comprising:
initiating a re-evaluation of access to network resources by a plurality of network devices in response to the received information.
8. The method of claim 1 , further comprising:
storing information associated with a plurality of network devices, the information identifying a plurality of security rules associated with managing access to network resources by the plurality of network devices.
9. The method of claim 8 , where the determining comprises:
determining whether the first network device complies with the at least one security-related rule based on the stored information.
10. A system, comprising:
a memory to store security-related rules; and
a processor coupled to the memory, the processor to:
establish a client session with a first client device, the client session providing the first client device with access to at least one resource,
receive information from the first client device during the client session, the information indicating that the first client device is not in compliance with at client device has changed, and
determine whether to modify access by the first client device to the at least one resource based on the received information and the information stored in the memory.
11. The system of claim 10 , where the at least one security-related rule comprises information identifying at least one of anti-virus software or anti-spyware software associated with accessing the at least one resource.
12. The system of claim 10 , where when receiving information, the processor is to receive information indicating that the configuration of at least one of hardware or software associated with the first client device has changed.
13. The system of claim 10 , where the memory is further to:
store information associated with a plurality of client devices, the information identifying a plurality of security-related rules associated with managing access to resources by the plurality of client devices.
14. The system of claim 10 , where the at least one resource comprises a plurality of resources, and the processor is further to:
generate a message to the first client device when the processor determines that access to a first one of the plurality of resources is to be modified, the message indicating that access by the first client device to the first resource is prohibited, and
terminate access by the first client device to the first resource,
the system further comprising:
a transmit device to transmit the message to the first client device.
15. The system of claim 14 , where the message does not affect access by the first client device to resources other than the first resource.
16. The system of claim 14 , where the message indicates why access to the first resource is prohibited.
17. The system of claim 10 , where the processor is further to:
receive information from the first client device at periodic intervals during the client session, the information indicating a status of at least one of software or hardware included on the first client device, and
determine, at the periodic intervals, whether to modify access by the first client device to at least one of the network resources in response to the received information.
18. The system of claim 10 , where the processor is further to:
generate a message to re-evaluate access by a plurality of client devices to network resources in response to the received information,
the system further including:
a transmit device configured to transmit the message to the plurality of client devices.
19. The system of claim 18 , where the message includes an identifier identifying the plurality of client devices.
20. The system of claim 18 , where the message identifies a function or role performed by at least some of the plurality of client devices.
21. The system of claim 10 , where the processor is to receive the information from the first client device in response to a triggering event at the first client device.
22. A system, comprising:
a memory to store instructions; and
a processor to execute the instructions to implement:
means for establishing a client-sever session with a first client device, the client-server session providing the first client device with access to at least one network service or resource;
means for receiving information from the first client device during the client-server session, the information indicating that the first client device is not in compliance with at least one security-related rule or that a configuration of the first client device has changed; and
means for determining whether to modify access by the first client device to the at least one network service or resource based on the received information.
23. The system of claim 22 , further comprising:
means for initiating re-evaluation of access associated with a plurality of client devices based on the received information.
24. A network device, comprising:
a processor to:
establish a client-server session with a server, the client-server session providing the network device with access to one or more network resources,
periodically scan the network device during the client-server session to identify a status associated with at least one of hardware or software included on the network device, the periodic scanning being triggered by the network device, and
report the status associated with the network device to the server.
25. The network device of claim 24 , where the processor is further to:
identify a change in configuration of the network device, and
when reporting the status, the processor is to:
report the status associated with the network device in response to the identified change in configuration of the network device.
26. A computer-readable memory device having stored thereon sequences of instructions which, when executed by a processor of a network device, cause the processor to:
establish a communication session with a server controlling access to a plurality of resources, the communication session providing the network device with access to the plurality of resources;
periodically scan the network device during the communication session to identify a status associated with at least one of hardware or software included on the network device, the periodic scanning being triggered by the network device and not by a command from the server; and
report the status associated with the network device to the server.
27. The computer-readable memory device of claim 26 , where the instructions cause the processor to report the status associated with the network device in response to at least one of a hardware or software change associated with the network device.