Rogue foothold network defense

1. A method, comprising:

detecting a foothold event at a first network segment, wherein the first network segment includes a set of network settings;

analyzing the foothold event upon detecting the foothold event;

determining a severity score based on the analysis of the foothold event;

comparing the severity score to two or more score tiers;

matching the severity score to one score tier of the two or more score tiers based on the comparison;

determining a reconfiguration layer based on the matched score tier;

reconfiguring at least part of the set of network settings of the first network segment based on the determined reconfiguration layer; and

generating a second network segment having the reconfigured set of network settings that replaces the first network segment.

2. The method of claim 1 , wherein the reconfiguration layer determines a subset of network settings of the set of network settings to be reconfigured.

3. The method of claim 1 , comprising:

dismantling the first network segment; and

replacing the first network segment with the second network segment.

4. The method of claim 3 , comprising:

storing node communication information for the first network segment;

rebuilding communication paths between at least two nodes for the second network segment using the node communication information, wherein the at least two nodes originally communicated with each other via the first network segment.

5. The method of claim 1 , wherein the reconfiguring comprises:

receiving a standardized set of network settings from a configuration server.

6. The method of claim 5 , wherein the reconfiguring comprises:

machine learning network settings across a network; and

customizing the set of network settings according to machine learned settings on the configuration server.

7. The method of claim 1 , wherein the first network segment is a virtual network that is part of the network, the virtual network having a set of virtual network settings.

8. The method of claim 1 , wherein the detecting comprises:

monitoring a network for the foothold event, wherein the monitoring is continuous or intermittent.

9. The method of claim 1 , wherein the severity score is based on factors, the factors including at least one of criticality of the network segment, overall threat of the foothold event to compromising network data, extent of the foothold.

10. The method of claim 1 , wherein the matched score tier affects a subset of network settings in the reconfiguration layer for the second network segment.

11. A system, comprising:

a processor coupled to a memory that includes instructions that when executed by the processor cause the processor to:

detect a foothold event at a first network segment, wherein the first network segment includes a set of network settings;

analyze the foothold event upon detecting the foothold event;

determine a severity score based on the analysis of the foothold event;

compare the severity score to two or more score tiers;

match the severity score to one score tier of the two or more score tiers based on the comparison;

determine a reconfiguration layer based on the matched score tier;

reconfigure at least part of the set of network settings of the first network segment based on the determined reconfiguration layer; and

generate a second network segment having the reconfigured set of network settings that replaces the first network segment.

12. The system of claim 11 , wherein the reconfiguration layer determines a subset of network settings of the set of network settings to be reconfigured.

13. The system of claim 11 , comprising:

dismantling the first network segment; and

replacing the first network segment with the second network segment.

14. The system of claim 13 , comprising:

storing node communication information for the first network segment;

rebuilding communication paths between at least two nodes for the second network segment using the node communication information, wherein the at least two nodes originally communicated with each other via the first network segment.

15. The system of claim 11 , wherein the reconfiguring comprises:

receiving a standardized set of network settings from a configuration server.

16. The system of claim 15 , wherein the reconfiguring comprises:

machine learning network settings across a network; and

customizing the set of network settings according to machine learned settings on the configuration server.

17. The system of claim 11 , wherein the matched score tier affects a subset of network settings in the reconfiguration layer for the second network segment.

18. The system of claim 11 , wherein the detecting comprises:

monitoring a network for the foothold event, wherein the monitoring is continuous or intermittent.

19. The system of claim 11 , wherein the severity score is based on factors, the factors including at least one of criticality of the network segment, overall threat of the foothold event to compromising network data, extent of the foothold.

20. A non-transitory computer readable medium having instructions to control one or more processors configured to:

detect a foothold event at a first network segment, wherein the first network segment includes a set of network settings;

analyze the foothold event upon detecting the foothold event;

determine a severity score based on the analysis of the foothold event;

compare the severity score to two or more score tiers;

match the severity score to one score tier of the two or more score tiers based on the comparison;

determine a reconfiguration layer based on the matched score tier;

reconfigure at least part of the set of network settings of the first network segment based on the determined reconfiguration layer; and

generate a second network segment having the reconfigured set of network settings that replaces the first network segment.