Systems and methods for managing a need-to-know domain name system

1. A computer-implemented method for managing a need-to-know domain name system, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

intercepting, by an agent of the computing device, network traffic received on the computing device;

generating, by the agent of the computing device, a one-time password based on a unique identifier of the agent of the computing device;

wrapping, by the agent of the computing device, the network traffic with the one-time password; and

pushing, by the agent of the computing device, the wrapped network traffic to a cloud server using a local domain name system (DNS) of the agent of the computing device, wherein the local DNS of the agent comprises a private domain name unpublished in a global DNS.

2. The computer-implemented method of claim 1 , further comprising:

performing a security action, wherein the security action comprises at least one of:

terminating access to the cloud server; or

modifying the local DNS of the agent of the computing device.

3. The computer-implemented method of claim 2 , further comprising:

obtaining, by the agent of the computing device, security context data of the computing device;

encrypting the security context data;

transmitting the security context data with the wrapped network traffic; and

performing the security action based on the security context data.

4. The computer-implemented method of claim 3 , wherein the security context data comprises at least one of:

a number of times of a failed login on an application on the computing device;

a presence of a keystroke logger or a screen grabber;

an identification of a process injection;

geolocation data;

an indication that a webcam or a microphone of the computing device are in use; or

a second indication that a light or the microphone of the webcam have been modified.

5. The computer-implemented method of claim 1 , wherein the agent of the computing device is a dissolvable agent.

6. The computer-implemented method of claim 1 , wherein the agent of the computing device uses in-line hooking or deep-hooking to generate processes to perform actions on the computing device.

7. The computer-implemented method of claim 1 , wherein the local DNS of the agent of the computing device comprises the private domain name associated with a role of a user of the computing device in an organization hierarchy.

8. The computer-implemented method of claim 7 , further comprising:

replacing the role of the user of the computing device with a new role in the organization hierarchy;

removing the local DNS of the agent from the agent of the computing device; and

pushing a new local DNS to the agent of the computing device based on the new role of the user of the computing device, wherein the new local DNS comprises a different private domain name than the local DNS of the agent.

9. A system for managing a need-to-know domain name system, the system comprising:

at least one physical processor;

physical memory comprising computer-executable instructions that, when executed by the at least one physical processor, cause the at least one physical processor to:

intercept, by an agent of a computing device, network traffic received on the computing device;

generate, by the agent of the computing device, a one-time password based on a unique identifier of the agent of the computing device;

wrap, by the agent of the computing device, the network traffic with the one-time password; and

push, by the agent of the computing device, the wrapped network traffic to a cloud server using a local domain name system (DNS) of the agent of the computing device, wherein the local DNS of the agent comprises a private domain name unpublished in a global DNS.

10. The system of claim 9 , wherein the computer-executable instructions further cause the at least one physical processor to:

perform a security action, wherein the security action comprises at least one of:

terminating access to the cloud server; or

modifying the local DNS of the agent of the computing device.

11. The system of claim 10 , wherein the computer-executable instructions further cause the at least one physical processor to:

obtain security context data of the computing device;

encrypt the security context data;

transmit the security context data with the wrapped network traffic; and

perform the security action based on the security context data.

12. The system of claim 11 , wherein the security context data comprises at least one of:

a number of times of a failed login on an application on the computing device;

a presence of a keystroke logger or a screen grabber;

an identification of a process injection;

geolocation data;

an indication that a webcam or a microphone of the computing device are in use; or

a second indication that a light or the microphone of the webcam have been modified.

13. The system of claim 9 , wherein the agent of the computing device is a dissolvable agent.

14. The system of claim 9 , wherein the agent of the computing device uses in-line hooking or deep-hooking to generate processes to perform actions on the computing device.

15. The system of claim 9 , wherein the local DNS of the agent of the computing device comprises the private domain name associated with a role of a user of the computing device in an organization hierarchy.

16. The system of claim 15 , wherein the computer-executable instructions further cause the at least one physical processor to:

replace the role of the user of the computing device with a new role in the organization hierarchy;

remove the local DNS of the agent from the agent of the computing device; and

push a new local DNS to the agent of the computing device based on the new role of the user of the computing device, wherein the new local DNS comprises a different private domain name than the local DNS of the agent.

17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

intercept, by an agent of the computing device, network traffic received on the computing device;

generate, by the agent of the computing device, a one-time password based on a unique identifier of the agent of the computing device;

wrap, by the agent of the computing device, the network traffic with the one-time password; and

push, by the agent of the computing device, the wrapped network traffic to a cloud server using a local domain name system (DNS) of the agent of the computing device, wherein the local DNS of the agent comprises a private domain name unpublished in a global DNS.

18. The non-transitory computer-readable medium of claim 17 , wherein the one or more computer-executable instructions further cause the computing device to:

perform a security action, wherein the security action comprises at least one of:

terminating access to the cloud server; or

modifying the local DNS of the agent of the computing device.

19. The non-transitory computer-readable medium of claim 18 , wherein the one or more computer-executable instructions further cause the computing device to:

obtain security context data of the computing device;

encrypt the security context data;

transmit the security context data with the wrapped network traffic; and

perform the security action based on the security context data.

20. The non-transitory computer-readable medium of claim 19 , wherein the security context data comprises at least one of:

a number of times of a failed login on an application on the computing device;

a presence of a keystroke logger or a screen grabber;

an identification of a process injection;

geolocation data;

an indication that a webcam or a microphone of the computing device are in use; or

a second indication that a light or the microphone of the webcam have been modified.