Managing claiming of unrecognized devices for admission to an enterprise network
A threat management facility detects a device on an enterprise network and determines whether the device is one of a set of managed devices for the enterprise network. When the device is not one of the set of managed devices, the threat management facility may determine whether the device is manageable. When the device is unrecognized and unmanageable, a portal may provide support to a user of the device by listing the device on an unclaimed device page published by the portal and accessible to authorized users of the enterprise network. An authorized user may claim the unrecognized device from the unclaimed device page and, in the process, may provide additional information regarding the unrecognized device. Once claimed, the previously unrecognized device may be permitted to communicate over the enterprise network.
1. A method comprising:
detecting a device on an enterprise network managed by an administrator;
when the device provides, to a threat management facility, a heartbeat that identifies the device as one of a set of managed devices for the enterprise network, permitting the device to communicate over the enterprise network; and
when the device does not provide the heartbeat to the threat management facility, determining manageability of the device and, upon determining that the device is unmanageable by the threat management facility in a manner consistent with a security policy for the enterprise network, listing the device on an unclaimed device page accessible on the enterprise network and published by a portal for admission, by authorized users of the enterprise network in addition to the administrator, of unrecognized devices onto the enterprise network, and receiving information from an authorized user to associate the device with the authorized user.
2. The method of claim 1 , wherein listing the device includes displaying an association of the device with another device.
3. The method of claim 1 , further comprising receiving, from an authorized user of the enterprise network, a claim for the device from the unclaimed device page.
4. The method of claim 3 , wherein receiving the claim for the device includes registering the device in a database stored by the threat management facility.
5. The method of claim 3 , further comprising permitting the device to communicate over the enterprise network based on the claim for the device from the unclaimed device page.
6. The method of claim 1 , wherein determining manageability of the device includes obtaining a fingerprint of the device.
7. The method of claim 6 , wherein the fingerprint of the device is based on one or more of network traffic, packet header information, or status reports obtained from communications by the device.
8. The method of claim 1 , wherein determining manageability of the device includes testing ports of the device and assessing respective responses of the ports to the testing.
9. The method of claim 1 , wherein listing the device on the unclaimed device page includes performing a security scan of the device for compliance with a security policy.
10. A computer program product encoded on one or more non-transitory computer storage media, the computer program product comprising instructions that, when executed by one or more computing devices, cause the one or more computing devices to perform operations comprising:
detecting a device on an enterprise network managed by an administrator;
when the device provides, to a threat management facility, a heartbeat that identifies the device as one of a set of managed devices for the enterprise network, permitting the device to communicate over the enterprise network; and
when the device does not provide the heartbeat to the threat management facility that identifies the device as one of the set of managed devices, determining manageability of the device and, upon determining that the device is unmanageable by the threat management facility in a manner consistent with a security policy for the enterprise network, listing the device on an unclaimed device page accessible on the enterprise network and published by a portal for admission, by authorized users of the enterprise network in addition to the administrator, of unrecognized devices onto the enterprise network, and receiving information from an authorized user to associate the device with the authorized user.
11. The computer program product of claim 10 , the operations further comprising receiving, from an authorized user of the enterprise network, a claim for the device from the unclaimed device page.
12. The computer program product of claim 11 , wherein receiving the claim for the device includes registering the device in a database stored by the threat management facility.
13. The computer program product of claim 11 , the operations further comprising permitting the device to communicate over the enterprise network based on the claim for the device from the unclaimed device page.
14. The computer program product of claim 10 , wherein determining manageability of the device includes obtaining a fingerprint of the device.
15. The computer program product of claim 14 , wherein the fingerprint of the device is based on one or more of network traffic, packet header information, or status reports obtained from communications by the device.
16. The computer program product of claim 10 , wherein determining manageability of the device includes testing ports of the device and assessing respective responses of the ports to the testing.
17. The computer program product of claim 10 , wherein listing the device on the unclaimed device page includes performing a security scan of the device for compliance with a security policy.
18. A system comprising:
a portal for managing admission of unrecognized devices onto an enterprise network managed by an administrator, the portal including a first memory and a first processor, the first memory having stored thereon computer executable instructions for causing the first processor to publish an unclaimed device page accessible on the enterprise network; and
a threat management facility associated with the enterprise network and in communication with the portal, the threat management facility including a second memory and a second processor, the second memory having stored thereon computer executable instructions for causing the second processor to identify a device as one of a set of managed devices for the enterprise network, to permit the device to communicate over the enterprise network when the device is one of the set of managed devices, and, when the device is not one of the set of managed devices, to determine manageability of the device and, upon determining that the device is unmanageable by the threat management facility in a manner consistent with a security policy for the enterprise network, to list the device on the unclaimed device page published by the portal and accessible to authorized users of the enterprise network, in addition to the administrator, for admission of unrecognized devices onto the enterprise network, and to receive information from an authorized user to associate the device with the authorized user.
19. The system of claim 18 , wherein the first memory of the portal has further stored thereon instructions to further cause the first processor to receive, from one or more of the authorized users of the enterprise network, a claim for the device from the unclaimed device page.
20. The system of claim 19 , wherein the second memory of the threat management facility has further stored thereon instructions further cause the second processor to permit the device to communicate over the enterprise network based on the claim for the device from the unclaimed device page.