Destination-specific network management
Methods and systems for providing destination-specific network management are described. One example method includes identifying a data movement rule associated with a set of one or more computers, the data movement rule including one or more criteria identifying restricted data movement, and one or more actions to take when a computer from the set of computers violates the data movement rule, detecting a data movement associated with a computer from the set of computers, the data movement including data being transferred from the computer to a destination, determining that the detected data movement violates the data movement rule, and performing the one or more actions associated with the data movement rule upon determining that the data movement violates the data movement rule.
1. A method performed by one or more data processing apparatus, the method comprising:
identifying a data movement rule associated with a set of one or more computers, the data movement rule including one or more criteria identifying restricted data movement, and one or more actions to take when a computer from the set of computers violates the data movement rule, the one or more criteria associated with the data movement rule including a data movement threshold specifying an amount of data;
detecting a data movement associated with a computer from the set of computers, the data movement including data being transferred from the computer to a destination, wherein at least part of the detecting occurs during the data movement;
determining that the detected data movement violates the data movement rule based at least in part on an amount of data associated with the detected data movement exceeding the data movement threshold associated with the data movement rule; and
performing the one or more actions associated with the data movement rule upon determining that the data movement violates the data movement rule.
2. The method of claim 1 , wherein the one or more criteria associated with the data movement rule include a data movement destination specifying a location to which data is moving.
3. The method of claim 2 , wherein the data movement destination includes at least one of: a country, a region, a city, an Internet Protocol (IP) address range, or an enterprise facility.
4. The method of claim 2 , wherein determining that the data movement violates the data movement rule comprises:
determining that an amount of data associated with the data movement is greater than the data movement threshold associated with the data movement rule; and
determining that the destination associated with the data movement matches the data movement destination associated with the data movement rule.
5. The method of claim 2 , wherein the data movement destination includes a wildcard destination indicating that data movement to any destination will violate that portion of the data movement restriction.
6. The method of claim 2 , wherein determining that the data movement violates the data movement rule includes determining that a data rate associated with the data movement is greater than a data rate threshold associated with the data movement rule.
7. The method of claim 1 , wherein the one or more actions associated with the data movement rule include at least one of: disabling the computer for an amount of time, or alerting an administrator of the data movement.
8. The method of claim 1 , wherein detecting the data movement includes determining an amount of data being moved and determining the destination to which the data is being moved.
9. The method of claim 8 , wherein determining the destination to which the data is being moved includes geo-locating an IP address to which the data is being moved.
10. The method of claim 1 , wherein the data movement occurs from a private network to a public network.
11. The method of claim 1 , wherein the data movement occurs from a first private network to a second private network.
12. A system comprising:
a processor configured to execute computer program instructions; and
a computer storage medium encoded with computer program instructions that, when executed by the processor, cause the system to perform operations comprising:
identifying a data movement rule associated with a set of one or more computers, the data movement rule including one or more criteria identifying restricted data movement, and one or more actions to take when a computer from the set of computers violates the data movement rule, the one or more criteria associated with the data movement rule including a data movement threshold specifying an amount of data;
detecting a data movement associated with a computer from the set of computers, the data movement including data being transferred from the computer to a destination, wherein at least part of the detecting occurs during the data movement;
determining that the detected data movement violates the data movement rule based at least in part on an amount of data associated with the detected data movement exceeding the data movement threshold associated with the data movement rule; and
performing the one or more actions associated with the data movement rule upon determining that the data movement violates the data movement rule.
13. The system of claim 12 , wherein the one or more criteria associated with the data movement rule include a data movement destination specifying a location to which data is moving.
14. The system of claim 13 , wherein the data movement destination includes at least one of: a country, a region, a city, an Internet Protocol (IP) address range, or an enterprise facility.
15. The system of claim 13 , wherein determining that the data movement violates the data movement rule comprises:
determining that an amount of data associated with the data movement is greater than the data movement threshold associated with the data movement rule; and
determining that the destination associated with the data movement matches the data movement destination associated with the data movement rule.
16. The system of claim 13 , wherein the data movement destination includes a wildcard destination indicating that data movement to any destination will violate that portion of the data movement restriction.
17. The system of claim 12 , wherein the one or more actions associated with the data movement rule include at least one of: disabling the computer for an amount of time, or alerting an administrator of the data movement.
18. The system of claim 12 , wherein monitoring the data movement includes determining an amount of data being moved and determining the destination to which the data is being moved.
19. The system of claim 18 , wherein determining the destination to which the data is being moved includes geo-locating an IP address to which the data is being moved.
20. The system of claim 12 , wherein the data movement occurs from a private network to a public network.