Systems, methods, and devices for securely managing network connections
The disclosure relates generally to methods, systems, and apparatuses for managing network connections. A method may include identifying a first state of a first endpoint connection of a first networked machine and a second state of a second endpoint connection of a second network machine, and confirming the first state and the second state based on expected states for the first networked machine and the second network machine, wherein the expected states comprise a list of expected connections.
1. A method comprising:
storing a list of expected connections among a plurality of endpoints, wherein each expected connection In the list defines a first endpoint and a second endpoint between which the expected connection exists; and
for each of the expected connections in the list:
determining, by one or more processors, whether an actual connection exists between the first endpoint of the expected connection and the second endpoint of the expected connection based on a comparison of the expected connection with a configuration file of each of the first and second endpoint of the expected connection;
if the actual connection does not exist, providing a notification indicating either that the expected connection is missing from a configuration file of one or more of the first endpoint and the second endpoint or that an entry in a configuration file of one or more of the first endpoint and the second endpoint is missing from the list of expected connections, wherein a determination of whether one or more of the actual connections maintained by the plurality of endpoints are unauthorized is based on one or more detected differences between the list of expected connections and the actual connections maintained by the plurality of endpoints.
2. The method of claim 1 , further comprising obtaining, for each of one or more of the plurality of endpoints, a configuration file indicating one or more actual connections maintained by the endpoint.
3. The method of claim 2 , wherein the list is stored in human readable data-serialization language format.
4. The method of claim 2 , wherein determining whether the actual connection exists comprises determining whether the expected connection has a matching connection in one or more of the actual connections maintained by the first and second endpoints of the expected connection.
5. The method of claim 2 , wherein each of the one or more actual connections comprises a protocol, a port number, a port number range, or a security group.
6. The method of claim 2 , further comprising determining, based on one or more detected differences between the list of expected connections and the actual connections maintained by the plurality of endpoints, whether the list of expected connections is inaccurate.
7. The method of claim 1 , further comprising providing version tracking and control of the list of expected connections.
8. The method of claim 1 , wherein providing the notification comprises providing a message to an administrator account.
9. The method of claim 1 , wherein the list is managed as a source code artifact.
10. A system comprising:
a memory to store a list of expected connections among a plurality of endpoints, wherein each expected connection in the list defines a first endpoint and a second endpoint between which the expected connection exists; and
one or more hardware processors operatively coupled to the memory, the one or more processors to:
for each of the expected connections in the list:
determine whether an actual connection exists between the first endpoint of the expected connection and a second endpoint of the expected connection based on a comparison of the expected connection with a configuration file of each of the first and second endpoint of the expected connection;
if the actual connection does not exist, provide a notification indicating either that the expected connection is missing from a configuration file of one or more of the first endpoint and the second endpoint, or that an entry in the configuration file of one or more of the first endpoint and the second endpoint is missing from the list of expected connections, wherein a determination of whether one or more of the actual connections maintained by the plurality of endpoints are unauthorized is based on one or more detected differences between the list of expected connections and the actual connections maintained by the plurality of endpoints.
11. The system of claim 10 , wherein the one or more hardware processors are further to obtain, for each of one or more of the plurality of endpoints, a configuration file indicating one or more actual connections maintained by the endpoint.
12. The system of claim 11 , wherein the list is stored in human readable data-serialization language format.
13. The system of claim 11 , wherein to determine whether an actual connection exists, the one or more hardware processors are to determine whether the expected connection has a matching connection in one or more of the actual connections maintained by the first and second endpoints of the expected connection.
14. The system of claim 11 , wherein the one or more hardware processors are further to determine, based on one or more detected differences between the list of expected connections and the actual connections maintained by the plurality of endpoints, whether the list of expected connections is inaccurate.
15. The system of claim 10 , wherein each of the one or more actual connections comprises a protocol, a port number, a port number range, or a security group.
16. The system of claim 10 , wherein the one or more hardware processors are further to provide version tracking and control of the list of expected connections.
17. The system of claim 10 , wherein to provide the notification, the one or more hardware processors are to provide a message to an administrator account.
18. The system of claim 10 , wherein the list is managed as a source code artifact.
19. A non-transitory computer readable storage media storing instructions that, when executed by one or more hardware processors, cause the one or more hardware processors to:
store a list of expected connections among a plurality of endpoints, wherein each expected connection in the list defines a first endpoint and a second endpoint between which the expected connection exists;
for each of the expected connections in the list:
determine, by the one or more processors, whether an actual connection exists between the first endpoint of the expected connection and a second endpoint of the expected connection based on a comparison of the expected connection with a configuration file of each of the first and second endpoint of the expected connection;
if the actual connection does not exist, provide a notification indicating either that the expected connection is missing from a configuration file of one or more of the first endpoint and the second endpoint or that an entry in the configuration file of one or more of the first endpoint and the second endpoint is missing from the list of expected connections, wherein a determination of whether one or more of the actual connections maintained by the plurality of endpoints are unauthorized is based on one or more detected differences between the list of expected connections and the actual connections maintained by the plurality of endpoints.
20. The non-transitory computer readable storage media of claim 19 , wherein the one or more hardware processors are further to obtain, for each of one or more of the plurality of endpoints, a configuration file indicating one or more actual connections maintained by the endpoint.
21. The non-transitory computer readable storage media of claim 20 , wherein the list is stored in human readable data-serialization language format.
22. The non-transitory computer readable storage media of claim 20 , wherein to determine whether an actual connection exists, the one or more hardware processors are to determine whether the expected connection has a matching connection in one or more of the actual connections maintained by the first and second endpoints of the expected connection.
23. The non-transitory computer readable storage media of claim 22 , wherein each of the one or more actual connections comprises a protocol, a port number, a port number range, or a security group.
24. The non-transitory computer readable storage media of claim 20 , wherein the one or more hardware processors are further to determine, based on one or more detected differences between the list of expected connections and the actual connections maintained by the plurality of endpoints, whether the list of expected connections is inaccurate.
25. The non-transitory computer readable storage media of claim 19 , wherein the one or more hardware processors are further to provide version tracking and control or the list of expected connections.
26. The non-transitory computer readable storage media of claim 19 , wherein to provide the notification, the one or more hardware processors are to provide a message to an administrator account.
27. The non-transitory computer readable storage media of claim 19 , wherein the list is managed as a source code artifact.