Techniques for controlling and regulating network access on air-gapped endpoints

1. A method for controlling access to networks by an air-gapped endpoint, comprising:

identifying, by a hypervisor, a type of a network being connected, upon detection of a new network connection to the air-gapped endpoint;

determining for each security zone of a plurality of isolated security zones at least one access rule to access the network, wherein the plurality of isolated security zones is operable in a virtual environment instantiated on the air-gapped endpoint, wherein the hypervisor prevents any interfacing of a user device with the primitive OS;

initializing, on the air-gapped endpoint, the hypervisor for execution over a primitive operating system (OS) of the air-gapped endpoint in the virtual environment, wherein the primitive OS is configured to execute only device drivers and is restricted from executing any application received over the network;

allowing a connection between a security zone and the network based on the at least one access rule; and

exposing a virtual network interface card (NIC) corresponding to a physical NIC, wherein the connection to the network is through the physical NIC;

managing the connection to the network by a networking virtual machine, wherein the networking virtual machine operates in a non-persistent mode, wherein the networking virtual machine returns to its initial clean state after each boot; and

monitoring all traffic between the security zone and the network to at least maintain compliance with a security policy set for the respective security zone.

2. The method of claim 1 , wherein identifying the type of the network further comprises:

querying a dynamic host configuration protocol (DHCP) server to receive network parameters of the network;

determining based on the network parameters if the network is classified as a known network; and

in response to determining that the network is classified as the known network, verifying if the network is a legitimate known network.

3. The method of claim 2 , wherein verifying if the external network is a known network further comprises:

performing a secure socket layer (SSL) verification by verifying an SSL certificate of a known entity in the network.

4. The method of claim 2 , wherein the known network is preconfigured in a list of known networks.

5. The method of claim 1 , wherein the at least one access rule includes at least one a firewall rule.

6. The method of claim 1 , wherein the a MAC address of the virtual NIC is the same as the a MAC address of the physical NIC.

7. The method of claim 1 , wherein maintaining compliance with the security policy, further comprises performing any one of:

tunneling traffic from the security zone through a virtual private network (VPN); and blocking traffic from the security zone.

8. The method of claim 1 , wherein maintaining compliance with the security policy, further comprises:

forcing the security zone to communicate with a specific entity in the network by modifying dynamic DHCP requests and replies.

9. The method of claim 1 , wherein maintaining compliance with the security policy, further comprises:

detecting suspicious activity related to an upload and download of files; and

alerting on suspicious activity by rendering a dialog box requesting to approve or deny activity related to the upload and download of files.

10. The method of claim 1 , wherein maintaining compliance with the security policy, further comprises:

detecting malicious activity executed by the security zone; and

quarantining the security zone when malicious activity is detected.

11. The method of claim 10 , wherein detecting malicious activity further comprises:

detecting malicious activity by setting at least one internal fake network entity;

simulating user activity to direct an access to the at least one internal fake network entity; and

tracking any access to at least one internal fake network entity that mimics the simulated user activity.

12. The method of claim 1 , further comprising:

creating the plurality of isolated security zones by instantiating a plurality of corresponding virtual machines using the hypervisor, wherein each of the plurality of security zones includes a plurality of applications executed over a guest OS; and

instantiating a networking virtual machine (VM) using the hypervisor.

13. The method of claim 12 , wherein the method is performed by the networking virtual machine (VM).

14. The method of claim 12 , further comprising:

resetting a state of the networking VM upon detection of a new network connection.

15. The method of claim 12 , wherein the primitive OS is executed by a hardware layer of the air-gapped endpoint.

16. The method of claim 12 , wherein the hypervisor includes an abstraction layer, at least one native hypervisor, an optimization module, and a security module.

17. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for controlling access to networks by an air-gapped endpoint, the process comprising: identifying, by a hypervisor, a type of a network being connected, upon detection of a new network connection to the air-gapped endpoint:

determining for each security zone of a plurality of isolated security zones at least one access rule to access the network, wherein the plurality of isolated security zones is operable in a virtual environment instantiated on the air-gapped endpoint, wherein the hypervisor prevents any interfacing of a user device with the primitive OS;

initializing, on the air-gapped endpoint, the hypervisor for execution over a primitive operating system (OS) of the air-gapped endpoint in the virtual environment, wherein the primitive OS is configured to execute only device drivers and is restricted from executing any application received over the network;

allowing a connection between a security zone and the network based on the at least one access rule;

exposing a virtual network interface card (NIC) corresponding to a physical NIC, wherein the connection to the network is through the physical NIC;

managing the connection to the network by a networking virtual machine, wherein the networking virtual machine operates in a non-persistent mode, wherein the networking virtual machine returns to its initial clean state after each boot; and

monitoring all traffic between the security zone and the network to at least maintain compliance with a security policy set for the respective security zone.

18. An air-gapped computing system, comprising: a network card interface; a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: identify, by a hypervisor, a type of an a network being connected, upon detection of a new network connection to the air-gapped endpoint;

determine for each security zone of a plurality of isolated security zones at least one access rule to access the network, wherein the plurality of isolated security zones is operable in a virtual environment instantiated on the air-gapped endpoint, wherein the hypervisor prevents any interfacing of a user device with the primitive OS;

initialize, on the air-gapped endpoint, the hypervisor for execution over a primitive operating system (OS) of the air-capped endpoint in the virtual environment, wherein the primitive OS is configured to execute only device drivers and is restricted from executing any application received over the network;

allow a connection between a security zone and the network based on the at least one access rule;

exposing a virtual network interface card (NIC) corresponding to a physical NIC, wherein the connection to the network is through the physical NIC;

managing the connection to the network by a networking virtual machine, wherein the networking virtual machine operates in a non-persistent mode, wherein the networking virtual machine returns to its initial clean state after each boot; and

monitor all traffic between the security zone and the external network to at least maintain compliance with a security policy set for the respective security zone.