Systems and methods for managing endpoints and security policies in a networked environment
Systems, methods, and apparatuses enable deploying and executing a security policy on endpoints in a network. In an embodiment, a security orchestrator determines a set of endpoints in a network and determines transformed endpoints from the determined set of endpoints through an endpoint transformation process. The security orchestrator determines a connectivity vector for at least a first transformed endpoint and a second transformed endpoint, where the connectivity vector includes properties associated with the corresponding transformed endpoint. Using the properties from the connectivity vector of the first transformed endpoint, a security policy is generated and deployed to the first transformed endpoint. Based on a comparison of the connectivity vectors of the first and second transformed endpoints indicating a similarity between the first and second transformed endpoints, the security policy is further deployed to the second transformed endpoint.
1. A computer-implemented method comprising:
determining a set of endpoints in a network;
determining transformed endpoints based on the determined set of endpoints;
determining a connectivity vector for at least a first transformed endpoint and a second transformed endpoint of the transformed endpoints, wherein the connectivity vector includes network properties, protocol properties, and content properties, and wherein the network properties, protocol properties, and content properties include data indicating a direction of transmission;
deploying a security policy to the first transformed endpoint based on the connectivity vector of the first transformed endpoint;
deploying the security policy to the second transformed endpoint wherein the deploying is based on a comparison of the connectivity vectors of the first and second transformed endpoints; and
executing the security policy on network traffic at the first transformed endpoint and the second transformed endpoint.
2. The method of claim 1 , further comprising:
calculating a similarity metric between the first transformed endpoint and the second transformed endpoint by comparing properties associated with the first and second transformed endpoints, wherein the similarity metric is a value indicating an amount of similarity between the first transformed endpoint and the second transformed endpoint.
3. The method of claim 2 , wherein deploying the security policy to the second transformed endpoint further comprising:
determining that the first transformed endpoint and the second transformed endpoint are similar based on the similarity metric.
4. The method of claim 1 , wherein the security policy is an access control list defining network traffic allowed through the first and second transformed endpoints.
5. The method of claim 4 , wherein the access control list is generated from evaluating the network properties, protocol properties, and content properties associated with connectivity vectors of each of the first and second transformed endpoints.
6. The method of claim 1 , wherein determining the transformed endpoints based on the determined set of endpoints comprises:
identifying two or more endpoints having one more of similar network identities and domain identities; and
generating a transformed endpoint by combining two or more endpoints in response to identifying two or more endpoints have one more of similar network identities and domain identities.
7. One or more non-transitory computer-readable storage media storing instructions which, when executed by one or more hardware processors, cause performance of a method comprising:
determining a set of endpoints in a network;
determining transformed endpoints based on the determined set of endpoints;
determining a connectivity vector for at least a first transformed endpoint and a second transformed endpoint of the transformed endpoints, wherein the connectivity vector includes network properties, protocol properties, and content properties and wherein the network properties, protocol properties, and content properties include data indicating a direction of transmission;
deploying a security policy to the first transformed endpoint based on the connectivity vector of the first transformed endpoint;
deploying the security policy to the second transformed endpoint wherein the deploying is based on a comparison of the connectivity vectors of the first and second transformed endpoints; and
executing the security policy on network traffic at the first transformed endpoint and the second transformed endpoint.
8. The one or more non-transitory computer-readable storage media of claim 7 , further comprising:
calculating a similarity metric between the first transformed endpoint and the second transformed endpoint by comparing properties associated with the first and second transformed endpoints, wherein the similarity metric is a value indicating an amount of similarity between the first transformed endpoint and the second transformed endpoint.
9. The one or more non-transitory computer-readable storage media of claim 8 , wherein deploying the security policy to the second transformed endpoint further comprising:
determining that the first transformed endpoint and the second transformed endpoint are similar based on the similarity metric.
10. The one or more non-transitory computer-readable storage media of claim 7 , wherein the security policy is an access control list defining network traffic allowed through the first and second transformed endpoints.
11. The one or more non-transitory computer-readable storage media of claim 10 , wherein the access control list is generated from evaluating the network properties, protocol properties, and content properties associated with connectivity vectors of each of the first and second transformed endpoints.
12. The one or more non-transitory computer-readable storage media of claim 7 , wherein determining the transformed endpoints based on the determined set of endpoints comprises:
identifying two or more endpoints having one more of similar network identities and domain identities; and
generating a transformed endpoint by combining two or more endpoints in response to identifying two or more endpoints have one more of similar network identities and domain identities.
13. An apparatus, comprising:
one or more hardware processors;
memory coupled to the one or more hardware processors, the memory storing instructions which, when executed by the one or more hardware processors, causes the apparatus to:
determine a set of endpoints in a network;
determine transformed endpoints based on the determined set of endpoints;
determine a connectivity vector for at least a first transformed endpoint and a second transformed endpoint of the transformed endpoints, wherein the connectivity vector includes network properties, protocol properties, and content properties, and wherein the network properties, protocol properties, and content properties include data indicating a direction of transmission;
deploy a security policy to the first transformed endpoint based on the connectivity vector of the first transformed endpoint;
deploy the security policy to the second transformed endpoint wherein the security policy is deployed based on a comparison of the connectivity vectors of the first and second transformed endpoints; and
execute the security policy on network traffic at the first transformed endpoint and the second transformed endpoint.
14. The apparatus of claim 13 , wherein the instructions further cause the apparatus to:
calculate a similarity metric between the first transformed endpoint and the second transformed endpoint by comparing properties associated with the first and second transformed endpoints, wherein the similarity metric is a value indicating an amount of similarity between the first transformed endpoint and the second transformed endpoint.
15. The apparatus of claim 14 , wherein deploying the security policy to the second transformed endpoint further causes the apparatus to:
determine that the first transformed endpoint and the second transformed endpoint are similar based on the similarity metric.
16. The apparatus of claim 13 , wherein the security policy is an access control list defining network traffic allowed through the first and second transformed endpoints.
17. The apparatus of claim 16 , wherein the access control list is generated from evaluating the network properties, protocol properties, and content properties associated with connectivity vectors of each of the first and second transformed endpoints.
18. The apparatus of claim 13 , wherein determining the transformed endpoints based on the determined set of endpoints further causes the apparatus to:
identify two or more endpoints having one more of similar network identities and domain identities; and
generate a transformed endpoint by combining two or more endpoints in response to identifying two or more endpoints have one more of similar network identities and domain identities.