Firewall techniques for colored objects on endpoints
Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.
1. A method comprising:
providing an application firewall deployed at a gateway and in communication with an endpoint through a network;
monitoring an application executing on the endpoint;
on the endpoint and in response to a first observed action of the application, coloring the application with a descriptor of a context for the first observed action, the first observed action corresponding to access of a resource of the endpoint, and the descriptor including a target action and a reportable event count of occurrences of the target action;
applying a rule dependent on the descriptor at the endpoint in response to a second observed action of the application to detect a reportable event, the second observed action including a number of occurrences of the target action by the application that exceeds the reportable event count of occurrences indicated by the descriptor;
communicating the reportable event through the network from the endpoint to the application firewall at the gateway; and
limiting access by the application through the gateway to a network resource with the application firewall based on the reportable event.
2. The method of claim 1 , further comprising applying firewall rules based on a reputation of the application when the application launches.
3. The method of claim 1 , further comprising changing an access rule for the endpoint based upon the reportable event.
4. The method of claim 1 , wherein the endpoint is at least one of a web server or a client device.
5. The method of claim 1 , wherein the rule depends on a plurality of observed actions on the endpoint.
6. The method of claim 1 , wherein the application firewall is included on the endpoint.
7. The method of claim 1 , wherein the application firewall is included on a destination server.
8. The method of claim 1 , wherein the application firewall is included as part of a routing of the network.
9. The method of claim 1 , wherein the descriptor includes a category for an object, static threat detection information for the object, and a specific identifier of the object.
10. The method of claim 9 , wherein the object is the application.
11. The method of claim 9 , wherein the object is an item accessed by the application.
12. The method of claim 1 , further comprising coloring data on the endpoint, wherein the transmission of data from the endpoint includes transmission of the colored data.
13. The method of claim 12 , wherein coloring data is in response to the first observed action.
14. A computer program product comprising a non-transitory computer readable medium bearing computer executable code that, when executing on one or more computing devices, performs the steps of:
providing an application firewall deployed at a gateway and in communication with an endpoint through a network;
monitoring an application executing on the endpoint;
on the endpoint and in response to a first observed action of the application, coloring the application with a descriptor of a context for the first observed action, the first observed action corresponding to access of a resource of the endpoint, and the descriptor including a target action and a reportable event count of occurrences of the target action;
applying a rule dependent on the descriptor at the endpoint in response to a second observed action of the application to detect a reportable event, the second observed action including a number of occurrences of the target action by the application that exceeds the reportable event count of occurrences indicated by the descriptor;
communicating the reportable event through the network from the endpoint to the application firewall at the gateway; and
limiting access by the application through the gateway to a network resource with the application firewall based on the reportable event.
15. The computer program product of claim 14 , wherein the computer executable code further performs the step of applying firewall rules based on a reputation of the application when the application launches.
16. The computer program product of claim 14 , wherein the computer executable code further performs the step of changing an access rule for the endpoint based upon the reportable event.
17. The computer program product of claim 14 , wherein the endpoint is one or more of a web server or a client device.
18. The computer program product of claim 14 , wherein the rule depends on a plurality of observed actions on the endpoint.
19. The computer program product of claim 14 , wherein the computer executable code further performs the step of coloring data on the endpoint, and the transmission of data from the endpoint includes transmission of the colored data.
20. A system comprising:
an application firewall deployed at a gateway, the application firewall configured to provide conditional, rule-based access to network resources by applications on endpoints in an enterprise; and
an endpoint of the enterprise in communication with the application firewall through a network, the endpoint having a processor and a memory, the memory storing an application executing on the endpoint, and the processor configured to monitor the application executing on the endpoint, in response to a first observed action, to color the application with a descriptor of a context for the first observed action, the first observed action corresponding to access of a resource of the endpoint, and the descriptor including a target action and a reportable event count of occurrences of the target action, to apply a rule dependent on the descriptor at the endpoint in response to a second observed action of the application to detect a reportable event, the second observed action including a number of occurrences of the target action by the application that exceeds the reportable event count of occurrences indicated by the descriptor, to communicate the reportable event through the network from the endpoint to the application firewall at the gateway, and to limit access by the application through the gateway to a network resource with the application firewall based on the reportable event.