Automatic intervention
Securing a network is disclosed. A monitored session between a client and a network resource is provided. It is determined whether the client is attempting an authorized command. If the command is determined to be unauthorized, the command is intercepted. Optionally, remedial action is taken if it is determined that the client is attempting an unauthorized command.
1. A method of securing a network comprising:
providing, by a gatekeeper device, a monitored session between a first client in a first network and a first network resource in a second network, wherein the gatekeeper device monitors keystrokes entered at the first client and wherein the first client is authorized to communicate with the first network resource;
determining, using a processor, and at least in part by evaluating at least one of a black list of prohibited commands and a white list of permitted commands, that the monitored keystrokes indicate an attempt by the first client to execute an unauthorized command, wherein the unauthorized command, when executed, attempts to cause an access, from the first network resource, of a second network resource; and
taking, by the gatekeeper device, a remedial action, wherein the remedial action includes at least one of substituting the unauthorized command with a bogus command and preventing the first client from transmitting the unauthorized command to the first network resource.
2. The method of claim 1 wherein the first network resource is a router.
3. The method of claim 1 wherein the first network resource is a server.
4. The method of claim 1 wherein providing the session includes serving one or more applets to the first client.
5. The method of claim 1 wherein the black list of prohibited commands is evaluated to determine that the monitored keystrokes indicate an attempt by the first client to execute a command included in the black list.
6. The method of claim 1 wherein the white list of permitted commands is evaluated to determine that the monitored keystrokes indicate an attempt by the first client to execute a command that is not included in the white list.
7. The method of claim 1 wherein determining that the first client is attempting an unauthorized command includes monitoring for socket open attempts.
8. The method of claim 1 further comprising capturing the session.
9. The method of claim 1 wherein the remedial action includes issuing a warning message.
10. The method of claim 1 wherein the monitoring is bidirectional.
11. The method of claim 1 wherein a second client is authorized to execute the unauthorized command to access the second network resource from the first network resource.
12. A system for securing a network, including:
a processor; and
a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:
provide, at a gatekeeper device, a monitored session between a first client in a first network and a first network resource in a second network, wherein the gatekeeper device monitors keystrokes entered at the first client and wherein the first client is authorized to communicate with the first network resource;
determine, at least in part by evaluating at least one of black list of prohibited commands and a white list of permitted commands, that the monitored keystrokes indicate an attempt by the first client to execute an unauthorized command, wherein the unauthorized command, when executed, attempts to cause an access, from the first network resource, of a second network resource; and
take a remedial action, wherein the remedial action includes at least one of substituting the unauthorized command with a bogus command and preventing the first client from transmitting the unauthorized command to the first network resource.
13. The system of claim 12 wherein the first network resource is a router.
14. The system of claim 12 wherein the first network resource is a server.
15. The system of claim 12 wherein determining that the first client is attempting an unauthorized command includes monitoring for socket open attempts.
16. The system of claim 12 wherein a second client is authorized to execute the unauthorized command to access the second network resource from the first network resource.
17. The system of claim 12 wherein providing the session includes serving one or more applets to the first client.
18. The system of claim 12 wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to capture the session.
19. The system of claim 12 wherein the remedial action includes issuing a warning message.
20. The system of claim 12 wherein the black list of prohibited commands is evaluated to determine that the monitored keystrokes indicate an attempt by the first client to execute a command included in the black list.
21. The system of claim 12 wherein the white list of permitted commands is evaluated to determine that the monitored keystrokes indicate an attempt by the first client to execute a command not included in the white list.
22. A computer program product for securing a network, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:
providing, by a gatekeeper device, a monitored session between a first client in a first network and a first network resource in a second network, wherein the gatekeeper device monitors keystrokes entered at the first client and wherein the first client is authorized to communicate with the first network resource;
determining, at least in part by evaluating at least one of black list of prohibited commands and a white list of permitted commands, that the monitored keystrokes indicate an attempt by the first client to execute an unauthorized command, wherein the unauthorized command, when executed, attempts to cause an access, from the first network resource, of a second network resource; and
taking a remedial action, wherein the remedial action includes at least one of substituting the unauthorized command with a bogus command and comprising preventing the first client from transmitting the unauthorized command to the first network resource.
23. The computer program product of claim 22 wherein the black list of prohibited commands is evaluated to determine that the monitored keystrokes indicate an attempt by the first client to execute a command included in the black list.
24. The computer program product of claim 22 wherein the white list of permitted commands is evaluated to determine that the monitored keystrokes indicate an attempt by the first client to execute a command not included in the white list.