Securing endpoints in a heterogenous enterprise network
Endpoints within a subnet of a heterogeneous network are configured to cooperatively respond to internal or external notifications of compromise in order to protect the endpoints within the subnet and throughout the enterprise network. For example, each endpoint may be configured to self-isolate when a local security agent detects a compromise, and to shun one of the other endpoints in response to a corresponding notification of compromise in order to prevent the other, compromised endpoint from communicating with other endpoints and further compromising other endpoints either within the subnet or throughout the enterprise network.
1. A system comprising:
an enterprise network including a gateway to an external network, the enterprise network separated by routers into a number of logical subnets each having a different routing prefix;
a plurality of endpoints interconnected in a subnet of the enterprise network, each one of the endpoints configured by a local security agent executing on the one of the endpoints to self-isolate in response to a local detection of compromise and to shun one of the other endpoints in the subnet in response to a notification of compromise of the one of the other endpoints; and
a network address translation device coupled in a communicating relationship with the subnet and the gateway, the network address translation device managing communications between the subnet and the enterprise network, and forwarding the notification of compromise from the gateway to the local security agent of one of the plurality of endpoints in the subnet, the notification identifying the one of the other endpoints in the subnet for which a compromise is detected, wherein the gateway identifies the one of the other endpoints in the notification of compromise using local subnet identification information.
2. The system of claim 1 further comprising a threat management facility coupled in a communicating relationship with the gateway, the threat management facility monitoring the plurality of endpoints and creating the notification of compromise when a compromised endpoint is detected.
3. The system of claim 2 wherein the threat management facility is a remote threat management facility accessible to the gateway through the external network.
4. The system of claim 2 wherein the threat management facility is a local threat management facility executing within the enterprise network.
5. A system comprising:
a plurality of endpoints interconnected in a subnet of an enterprise network, each of the endpoints executing a local security agent configured to self-isolate in response to a local detection of compromise and to shun one of the other endpoints in response to a notification of compromise of the one of the other endpoints; and
a network device coupled in a communicating relationship with the subnet and an internetwork, the network device executing code that configures the network device to manage communications between the subnet and the internetwork and to forward the notification of compromise from the internetwork to the local security agent of one of the plurality of endpoints, the notification identifying the one of the other endpoints for which a compromise is detected, wherein the notification of compromise forwarded by the network device identifies the one of the other endpoints in the notification of compromise using local subnet identification information.
6. The system of claim 5 wherein the network device receives the notification of compromise from a firewall for the enterprise network.
7. The system of claim 5 wherein the network device receives the notification of compromise from one of the plurality of endpoints.
8. The system of claim 5 wherein the network device includes a switch.
9. The system of claim 5 wherein the network device includes a router.
10. The system of claim 5 wherein the network device includes a firewall.
11. The system of claim 5 wherein the network device includes a wireless access point.
12. The system of claim 5 wherein the network device includes a network address translation device.
13. The system of claim 5 further comprising a threat management facility coordinating a remediation of the one of the other endpoints for which a compromise is detected.
14. The system of claim 5 further comprising a threat management facility coupled in a communicating relationship with the network device, the threat management facility monitoring the plurality of endpoints and creating the notification of compromise when a compromised endpoint is detected.
15. The system of claim 14 wherein the threat management facility is a remote threat management facility accessible to the network device through an external network.
16. The system of claim 14 wherein the threat management facility is a local threat management facility executing within the enterprise network.
17. The system of claim 14 wherein the threat management facility monitors a heartbeat from each of the plurality of endpoints and detects the compromise based on at least one of contents of the heartbeat or an absence of the heartbeat.
18. The system of claim 5 wherein the subnet is a logical subnet having a different routing prefix than a remaining portion of the enterprise network.
19. The system of claim 5 wherein the subnet is a physical subnet having a different routing prefix than a remaining portion of the enterprise network.
20. The system of claim 5 wherein the endpoints include at least one of a desktop computer, a laptop computer, a mobile phone, and a tablet.