Network portion risk assessment
Systems, methods, and related technologies for determining a risk associated with a network portion are described. The determination of risk associated with a network portion may include accessing network traffic from a network and determining an entity type associated with at least one entity communicatively coupled to the network. A network portion associated with the at least one entity can be determined. A risk associated with the at least one entity can be determined. A risk associated with the network portion associated with the at least one entity can be determined based on the risk associated with the at least one entity. The risk associated with the network portion can then be stored.
1. A method comprising:
accessing network traffic from a network;
determining an entity type associated with at least one entity communicatively coupled to the network;
determining a network portion associated with the at least one entity based on a context of the at least one entity, wherein the context comprises at least one of an entity type and an entity function;
determining a risk associated with the at least one entity, wherein the risk associated with the at least one entity is based on an objective associated with minimizing entity sensitivity and an entity types mix within the network portion, wherein the entity sensitivity is based on the sensitivity of data that the entity processes or stores;
determining, by a processing device, a risk associated with the network portion associated with the at least one entity based on the risk associated with the at least one entity, wherein the risk associated with the network portion is based on the entity sensitivity associated with the at least one entity; and
storing the risk associated with the network portion.
2. The method of claim 1 , wherein the network portion is at least one of a virtual local access network (VLAN), a service set identifier (SSID), or a segment.
3. The method of claim 1 further comprising:
performing an action based on the risk associated with the network portion.
4. The method of claim 3 , wherein the action comprises at least one of changing a VLAN associated with the at least one entity, quarantining the at least one entity, initiating an update, tracking traffic of the at least one entity, or sending a notification associated with the at least one entity.
5. The method of claim 1 , wherein the risk associated with the at least one entity is based on at least one of a Common Vulnerabilities and Exposures (CVE) associated with the at least one entity, patch version, software version, security posture, or credentials.
6. The method of claim 1 , wherein the risk associated with the at least one entity is based on a sensitivity associated with the at least one entity.
7. A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
access network traffic from a network;
determine an entity type associated with at least one entity communicatively coupled to the network;
determine a network portion associated with the at least one entity based on a context of the at least one entity, wherein the context comprises at least one of an entity type and an entity function;
determine a risk associated with the at least one entity, wherein the risk associated with the at least one entity is based on an objective associated with minimizing entity sensitivity and an entity types mix within the network portion, wherein the entity sensitivity is based on the sensitivity of data that the entity processes or stores;
determine a risk associated with the network portion associated with the at least one entity based on the risk associated with the at least one entity, wherein the risk associated with the network portion is based on a sensitivity associated with the at least one device; and
store the risk associated with the network portion.
8. The system of claim 7 , wherein the network portion is at least one of a virtual local access network (VLAN), a service set identifier (SSID), or a segment.
9. The system of claim 7 , the processing device further to:
perform an action based on the risk associated with the network portion.
10. The system of claim 9 , wherein the action comprises at least one of changing a VLAN associated with the at least one entity, quarantining the at least one entity, initiating an update, tracking traffic of the at least one entity, or sending a notification associated with the at least one entity.
11. The system of claim 7 , wherein the risk associated with the at least one entity is based on at least one of a Common Vulnerabilities and Exposures (CVE) associated with the at least one entity, patch version, software version, security posture, or credentials.
12. The system of claim 7 , wherein the risk associated with the at least one entity is based on a sensitivity associated with the at least one entity.
13. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
access network traffic from a network;
determine an entity type associated with at least one entity communicatively coupled to the network;
determine a network portion associated with the at least one entity based on a context of the at least one entity, wherein the context comprises at least one of an entity type and an entity function;
determine a risk associated with the at least one entity, wherein the risk associated with the at least one entity is based on an objective associated with minimizing entity sensitivity and an entity types mix within the network portion, wherein the entity sensitivity is based on the sensitivity of data that the entity processes or stores;
determine, by the processing device, a risk associated with the network portion associated with the at least one entity based on the risk associated with the at least one entity, wherein the risk associated with the network portion is based on a sensitivity associated with the at least one device; and
store the risk associated with the network portion.
14. The non-transitory computer readable medium of claim 13 , wherein the network portion is at least one of a virtual local access network (VLAN), a service set identifier (SSID), or a segment.
15. The non-transitory computer readable medium of claim 13 , the processing device further to perform an action based on the risk associated with the network portion.
16. The non-transitory computer readable medium of claim 15 , wherein the action comprises at least one of changing a VLAN associated with the at least one entity, quarantining the at least one entity, initiating an update, tracking traffic of the at least one entity, or sending a notification associated with the at least one entity.
17. The non-transitory computer readable medium of claim 13 , wherein the risk associated with the at least one entity is based on at least one of a Common Vulnerabilities and Exposures (CVE) associated with the at least one entity, a patch version, a software version, a security posture, or one or more credentials.