Managing admission of unrecognized devices onto an enterprise network
A threat management facility detects a device on an enterprise network and determines whether the device is one of a set of managed devices for the enterprise network. When the device is not one of the set of managed devices, the threat management facility may selectively direct the device to a portal that provides support to the user of the device while the device awaits admission to the enterprise network. As the user interacts with the portal, the portal may manage admission of unrecognized devices onto the enterprise network while making efficient use of network administrator resources.
1. A method comprising:
detecting a device on an enterprise network;
when the device provides, to a threat management facility, a heartbeat from a local security agent executing on the device that identifies the device as one of a set of managed devices for the enterprise network, permitting the device to communicate over the enterprise network; and
when the device does not provide the heartbeat to the threat management facility, identifying a type of the device from among two or more device types, and upon determining that the type includes a user interface and that the type is manageable by the threat management facility by delivery of the local security agent to the device, directing the device to a landing page of a portal configured to manage admission of unrecognized devices onto the enterprise network by interactively guiding a user of the device through a network entry procedure in the user interface and delivering device management capability to the device by delivering the local security agent that provides the heartbeat to the device for installation on the device.
2. The method of claim 1 , further comprising sending a request from the portal to the device for the heartbeat that identifies the device.
3. The method of claim 1 , wherein the two or more device types are distinguishable based on a fingerprint associated with the device.
4. The method of claim 3 , wherein the fingerprint of the device is based on one or more of network traffic, packet header information, or status reports obtained from communications by the device.
5. The method of claim 1 , wherein delivering device management capability to the device includes presenting a landing page to the device, the landing page interactively guiding a user of the device through a network entry procedure.
6. The method of claim 1 , wherein delivering device management capability to the device includes installing the local security agent on the device.
7. The method of claim 1 , wherein delivering device management capability to the device includes scanning the device for compliance with a security policy.
8. The method of claim 1 , further comprising presenting an admission decision for the device to an administrator through a user interface at the threat management facility.
9. A computer program product encoded on one or more non-transitory computer storage media, the computer program product comprising instructions that, when executed by one or more computing devices, cause the one or more computing devices to perform operations comprising:
detecting a device on an enterprise network;
when the device provides, to a threat management facility, a heartbeat from a local security agent executing on the device that identifies the device as one of a set of managed devices for the enterprise network, permitting the device to communicate over the enterprise network; and
when the device does not provide the heartbeat to the threat management facility, identifying a type of the device from among two or more device types, and upon determining that the type includes a user interface and that the type is manageable by the threat management facility by delivery of the local security agent to the device, directing the device to a landing page of a portal configured to manage admission of unrecognized devices onto the enterprise network by interactively guiding a user of the device through a network entry procedure in the user interface and delivering device management capability to the device by delivering the local security agent that provides the heartbeat to the device for installation on the device.
10. The computer program product of claim 9 , wherein the two or more device types are distinguishable based on a fingerprint associated with the device.
11. The computer program product of claim 10 , wherein the fingerprint of the device is based on one or more of network traffic, packet header information, or status reports obtained from communications by the device.
12. The computer program product of claim 9 , wherein delivering device management capability to the device includes presenting a landing page to the device, the landing page interactively guiding a user of the device through a network entry procedure.
13. The computer program product of claim 9 , wherein delivering device management capability to the device includes installing the local security agent on the device.
14. The computer program product of claim 9 , wherein delivering device management capability to the device includes scanning the device for compliance with a security policy.
15. A system comprising:
a portal for managing admission of unrecognized devices onto an enterprise network, the portal including a first memory and a first processor, the first memory having stored thereon computer executable instructions for causing the first processor to deliver device management capability to a device on the enterprise network; and
a threat management facility associated with the enterprise network and in communication with the portal, the threat management facility including a second memory and a second processor, the second memory having stored thereon computer executable instructions for causing the second processor to identify the device as one of a set of managed devices for the enterprise network, to permit the device to communicate over the enterprise network when the device is one of the set of managed devices, and, when the device is not one of the set of managed devices, to identify a type of the device from among two or more device types, and upon determining that the type includes a user interface and that the type is manageable by the threat management facility by delivery of a local security agent to the device, to direct the device to a landing page of the portal and to cause the portal to interactively guide a user of the device through a network entry procedure using the user interface and to deliver the device management capability to the device by delivering the local security agent that provides a heartbeat to the device for installation on the device.
16. The system of claim 15 , wherein to deliver device management capability to the device includes presenting a landing page to the device, the landing page interactively guiding a user of the device through a network entry procedure.
17. The system of claim 15 , wherein to deliver device management capability to the device includes installing the local security agent on the device.
18. The system of claim 15 , wherein to deliver device management capability to the device includes scanning the device for compliance with a security policy.
19. The system of claim 15 , wherein the two or more device types are distinguishable based at least in part on a user interface of the device.
20. The system of claim 19 , wherein a device that lacks a user interface suitable for interacting with the portal is categorized as an unmanageable type of device.