Active push-based remediation for reputation-based security systems
The present disclosure relates to initiating remediation of security risks on an endpoint system based on updated reputation data. According to one embodiment, a reputation service receives a request, from a first endpoint system, for reputation data about an object. A reputation service transmits, in response to the request, data indicating a current reputation of the object. The reputation service determines that the object presents a security risk and updates reputation data associated with the object to indicate that the object presents a security risk. Upon updating the reputation data, the reputation system transmits, to the first endpoint system, updated reputation data associated with the object and instructions to remedy the security risk.
1. A method for initiating remediation of security risks on an endpoint system based on updated reputation data, comprising:
receiving a request, from a first endpoint system, for reputation data about an object;
transmitting, to the first endpoint system in response to the request, current reputation data associated with the object;
after transmitting the data indicating the current reputation data associated with the object in response to the request, determining that the object presents a security risk without receiving a subsequent request for reputation data about the object from the first endpoint system;
updating reputation data associated with the object to indicate that the object presents a security risk; and
asynchronously initiating remediation of the security risk at the first endpoint system by pushing, to the first endpoint system, the updated reputation data associated with the object and instructions to remediate the security risk at the first endpoint system, wherein the instructions to remediate the security risk comprise one or more of:
instructions to restore the first endpoint system to a state prior to execution of the object on the first endpoint system,
instructions to remove, from the first endpoint system, the object and one or more other objects installed by the object, or
instructions to block, at the first endpoint system, network traffic generated by the object to one or more network destinations.
2. The method of claim 1 , further comprising:
saving the request to a log file.
3. The method of claim 2 , wherein saving the request to the log file comprises saving a timestamp associated with the request and wherein an offset from the timestamp indicates a time at which the request is to be deleted from the log file.
4. The method of claim 2 , wherein the pushing the updated reputation data associated with the object and the instructions to remediate the security risk comprises:
searching the log file for requests performed by one or more second endpoint systems for reputation data related to the object; and
for each second endpoint system that requested reputation data related to the object, pushing the updated reputation data associated with the object and instructions to initiate remediation procedures against the object.
5. The method of claim 1 , wherein determining that the object presents a security risk comprises:
receiving, from one or more endpoint systems, telemetry data about activity on the endpoint systems related to the object; and
determining, based on the telemetry data, that the object includes a malicious payload.
6. A non-transitory computer-readable storage medium storing instructions, which, when executed on a processor, perform operations for initiating remediation of security risks on an endpoint system based on updated reputation data, the operations comprising:
receiving a request, from a first endpoint system, for reputation data about an object;
transmitting, to the first endpoint system in response to the request, current reputation data of the object;
after transmitting the data indicating the current reputation data of the object in response to the request, determining that the object presents a security risk without receiving a subsequent request for reputation data about the object from the first endpoint system;
updating reputation data associated with the object to indicate that the object presents a security risk; and
asynchronously initiating remediation of the security risk at the first endpoint system by pushing, to the first endpoint system, the updated reputation data associated with the object and instructions to remediate the security risk at the first endpoint system, wherein the instructions to remediate the security risk comprise one or more of:
instructions to restore the first endpoint system to a state prior to execution of the object on the first endpoint system,
instructions to remove, from the first endpoint system, the object and one or more other objects installed by the object, or
instructions to block, at the first endpoint system, network traffic generated by the object to one or more network destinations.
7. The computer-readable medium of claim 6 , wherein the operations further comprise:
saving the request to a log file.
8. The computer-readable medium of claim 7 , wherein saving the request to the log file comprises saving a timestamp associated with the request and wherein an offset from the timestamp indicates a time at which the request is to be deleted from the log file.
9. The computer-readable medium of claim 7 , wherein
the pushing the updated reputation data associated with the object and the instructions to remediate the security risk comprises:
searching the log file for requests performed by one or more second endpoint systems for reputation data related to the object; and
for each second endpoint system that requested reputation data related to the object, pushing the updated reputation data associated with the object and instructions to initiate remediation procedures against the object.
10. The computer-readable medium of claim 6 , wherein determining that the object presents a security risk comprises:
receiving, from one or more endpoint systems, telemetry data about activity on the endpoint systems related to the object; and
determining, based on the telemetry data, that the object includes a malicious payload.
11. A system comprising:
a processor; and
memory storing code, which, when executed on the processor, performs an operation for initiating remediation of security risks on a first endpoint system based on updated reputation data, the operation comprising:
receiving a request, from the first endpoint system, for reputation data about an object;
transmitting, to the first endpoint system in response to the request, current reputation data associated with the object;
after transmitting the current reputation data associated with the object in response to the request, determining that the object presents a security risk without receiving a subsequent request for reputation data about the object from the first endpoint system;
updating reputation data associated with the object to indicate that the object presents a security risk; and
asynchronously initiating remediation of the security risk at the first endpoint system by pushing, to the first endpoint system, the updated reputation data associated with the object and instructions to remediate the security risk at the first endpoint system, wherein the instructions to remediate the security risk comprise one or more of:
instructions to restore the first endpoint system to a state prior to execution of the object on the first endpoint system,
instructions to remove, from the first endpoint system, the object and one or more other objects installed by the object, or
instructions to block, at the first endpoint system, network traffic generated by the object to one or more network destinations.
12. The system of claim 11 , wherein the operation further comprises:
saving the request to a log file.
13. The system of claim 12 , wherein saving the request to the log file comprises saving a timestamp associated with the request and wherein an offset from the timestamp indicates a time at which the request is to be deleted from the log file.
14. The system of claim 12 , wherein the pushing the updated reputation data associated with the object and the instructions to remediate the security risk comprises:
searching the log file for requests performed by one or more second endpoint systems for reputation data related to the object; and
for each second endpoint system that requested reputation data related to the object, pushing the updated reputation data associated with the object and instructions to initiate remediation procedures against the object.
15. The system of claim 11 , wherein determining that the object presents a security risk comprises:
receiving, from one or more endpoint systems, telemetry data about activity on the endpoint systems related to the object; and
determining, based on the telemetry data, that the object includes a malicious payload.