Security appliance
A security appliance may incorporate a touch screen or similar input/output interface, providing command and control over network functionality and configuration, without requiring log in via a network from another computing device. During denial of service attacks, commands from the local interface may be given priority access to processing resources and memory, allowing mitigating actions to be taken, such as shutting down ports, blacklisting packet sources, or modifying filter rules. This may allow the security device to address attacks without having to be manually rebooted or disconnected from the network.
1. An appliance, comprising:
a housing;
a network security device deployed within the housing, coupled to a first network and a second network; and
an input/output device deployed on a surface of the housing, the input/output device providing a user interface of the network security device;
wherein the network security device is configured, responsive to receipt of a network packet matching a predetermined filter, to:
store the network packet in a memory of the network security device,
block transmission of the network packet,
reserve a predetermined amount of memory of the network security device for the user interface provided by the input/output device, and
increase a priority of execution of the user interface, responsive to receipt of the network packet matching the predetermined filter; and
wherein the input/output device is configured to display, via the user interface, a notification of the received network packet.
2. The appliance of claim 1 , wherein the network security device is configured to transmit a notification to a computing device, responsive to receipt of the network packet matching the predetermined filter.
3. The appliance of claim 2 , wherein the network security device is configured, responsive to an absence of a detection of an interaction with the user interface, to discard the network packet.
4. The appliance of claim 1 , wherein the network packet matches a predetermined filter indicating that the network packet is from an unrecognized device, and wherein the input/output device is configured to detect an interaction with the user interface indicating to authorize the unrecognized device.
5. The appliance of claim 4 , wherein the network security device is configured, responsive to detection of the interaction, to retrieve the network packet from the memory of the network security device, and forward the network packet to a destination identified in the network packet.
6. The appliance of claim 1 , wherein the input/output device is a multi-touch screen display.
7. The appliance of claim 1 , further comprising a first network interface coupled to the first network and a second network interface coupled to the second network.
8. The appliance of claim 1 , wherein the network security device is further configured to decrease a priority of execution of one or more packet processing threads, responsive to receipt of the network packet matching the predetermined filter.
9. The appliance of claim 1 , wherein the predetermined filter comprises one or more of a source address, destination address, protocol, payload size, or frequency of packet reception.
10. The appliance of claim 1 , further comprising:
a processor;
a memory device; and
a network interface.
11. An appliance, comprising:
a housing;
a network security device deployed within the housing, coupled to a first network and a second network; and
an input/output device deployed on a surface of the housing, the input/output device providing a user interface of the network security device;
wherein the network security device is configured, responsive to receipt of a network packet matching a predetermined filter, to:
store the network packet in a memory of the network security device,
block transmission of the network packet,
reserve a predetermined amount of memory of the network security device for the user interface provided by the input/output device; and
wherein the input/output device is configured to display, via the user interface, a notification of the received network packet and
wherein the network security device is further configured to transmit a notification to a second device, responsive to receipt of the network packet matching the predetermined filter.
12. An appliance, comprising:
a housing;
a network security device deployed within the housing, coupled to a first network and a second network; and
an input/output device deployed on a surface of the housing, the input/output device providing a user interface of the network security device;
wherein the network security device is configured, responsive to receipt of a network packet matching a predetermined filter, to:
store the network packet in a memory of the network security device,
block transmission of the network packet,
reserve a predetermined amount of memory of the network security device for the user interface provided by the input/output device; and
wherein the input/output device is configured to display, via the user interface, a notification of the received network packet and
wherein the network security device is further configured to:
detect an interaction with the user interface indicating to increase a priority of a second filter matching the network packet, and
increase the priority of the second filter in a rule set of the network security device.
13. The appliance of claim 12 , wherein the network security device is further configured to apply the second filter ahead of one or more lower-priority filters to a second received network packet; and discard the second received network packet prior to applying the one or more lower-priority filters, responsive to the second received network packet matching the second filter.
14. A method, comprising:
receiving, by a network security device deployed within a housing of an appliance, a first packet;
blocking, by the network security device, transmission of the first packet, responsive to the first packet matching a predetermined filter;
reserving, by the network security device, a predetermined amount of memory of the network security device for a user interface provided by an input/output device of the network security device, responsive to the first packet matching the predetermined filter;
increasing, by the network security device, a priority of execution of the user interface, responsive to the first packet matching the predetermined filter; and
displaying a notification of receipt of the first packet, by the input/output device deployed on a surface of the housing, responsive to the first packet matching the predetermined filter.
15. The method of claim 14 , further comprising storing the first packet in a memory of the appliance, by the network security device, responsive to the first packet matching the predetermined filter.
16. The method of claim 15 , further comprising detecting an interaction with the user interface indicating a source of the first packet is an authorized device.
17. The method of claim 16 , further comprising retrieving the first packet from the memory of the appliance, and forwarding the first packet to a destination identified in the first packet, responsive to the detected interaction with the user interface.
18. The method of claim 14 , wherein the first packet matches a predetermined filter indicating that the network packet is from an unrecognized device.
19. The method of claim 14 , further comprising discarding the network packet, by the network security device, responsive to an absence of a detection of an interaction with the user interface.
20. The method of claim 14 , further comprising decreasing a priority of execution of one or more packet processing threads, by the network security device, responsive to the first packet matching the predetermined filter.