Cybersecurity system having digital certificate reputation system
A system, method, and computer-readable medium are disclosed for implementing a cybersecurity system having a digital certificate reputation system. At least one embodiment is directed to a computer-implemented method executing operations including receiving a communication having an internet protocol (IP) address and a digital certificate at a device within the secured network; determining whether the IP address is identified as having a high-security risk level; if the IP address has a high-security risk level, assigning a security risk level to the digital certificate based on the security risk level of the IP address; and using the security risk level for the digital certificate in executing the one or more security policies. Other embodiments include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices.
1. A computer-implemented method for executing one or more security policies in a secured network, comprising:
receiving a communication including an Internet protocol (IP) address and a digital certificate at a device within the secured network, the IP address having an IP address security risk level, the digital certification having a digital certificate security risk level;
determining whether the IP address security risk level is identified as having a high-security risk level;
if the IP address has a high-security risk level, assigning a security risk level to the digital certificate based on the security risk level of the IP address;
using the security risk level for the IP address and the security risk level for the digital certificate in executing the one or more security policies, the one or more security policies comprising one or more reputation security policies, executing the one or more reputation security policies is based upon the security risk level for the IP address and the security risk level for the digital certificate; and,
if the digital certificate is associated with an IP address having a high-security risk level,
analyzing the digital certificate to identify one or more digital certificate characteristics; and
analyzing other digital certificates to determine whether other digital certificates have one or more of the same digital certificate characteristics.
2. The computer-implemented method of claim 1 , wherein
the one or more security policies assign different weights to the security risk level of the IP address and the security risk level of the digital certificate to determine an appropriate security response.
3. The computer-implemented method of claim 1 , further comprising:
determining whether the IP address has a high-security risk includes determining whether the IP address is on a blacklist of IP addresses; and
assigning a high-security risk level to the digital certificate if the IP address is on the blacklist of IP addresses.
4. The computer-implemented method of claim 1 , further comprising:
retrieving a user behavior security risk level corresponding to security risk presented by a user, wherein the user is an intended recipient of the communication; and
using the security risk level for the IP address, the security risk level for the digital certificate, and the user behavior security risk level for the user to execute one or more security policies.
5. The computer-implemented method of claim 1 , further comprising:
increasing a security risk level of the IP address if the digital certificate has been previously used with one or more IP addresses presenting an elevated security risks.
6. The computer-implemented method of claim 1 , further comprising:
assigning an elevated security risk level to the other digital certificates having one or more of the same digital certificate characteristics.
7. A system comprising:
one or more information handling systems, wherein the one or more information handling systems include:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus;
wherein the computer program code included in one or more of the information handling systems is executable by the processor of the information handling system so that the information handling system, alone or in combination with other information handling systems, executes operations comprising:
receiving a communication including an Internet protocol (IP) address and a digital certificate at a device within the secured network, the IP address having an IP address security risk level, the digital certification having a digital certificate security risk level;
determining whether the IP address is identified as having a high-security risk level, the determining being based upon the associated reputation of the digital certificate;
if the IP address has a high-security risk level, assigning a security risk level to the digital certificate based on the security risk level of the IP address;
using the security risk level for the IP address and the security risk level for the digital certificate in executing the one or more security policies, the one or more security policies comprising one or more reputation security policies, executing the one or more reputation security policies is based upon the security risk level for the IP address and the security risk level for the digital certificate; and,
if the digital certificate is associated with an IP address having a high-security risk level,
analyzing the digital certificate to identify one or more digital certificate characteristics; and
analyzing other digital certificates to determine whether other digital certificates have one or more of the same digital certificate characteristics.
8. The system of claim 7 , wherein
the one or more security policies assign different weights to the security risk level of the IP address and the security risk level of the digital certificate to determine an appropriate security response.
9. The system of claim 7 , wherein
determining whether the IP address has a high-security risk includes determining whether the IP address is on a blacklist of IP addresses; and
assigning a high-security risk level to the digital certificate if the IP address is on the blacklist of IP addresses.
10. The system of claim 7 , wherein the computer program code is further configured for:
retrieving a user behavior security risk level corresponding to security risk presented by a user, wherein the user is an intended recipient of the communication; and
using the security risk level for the IP address, the security risk level for the digital certificate, and the user behavior security risk level for the user to execute one or more security policies.
11. The system of claim 7 , wherein the computer program code is further configured for:
increasing a security risk level of the IP address if the digital certificate has been previously used with one or more IP addresses presenting elevated security risks.
12. The system of claim 7 , wherein the computer program code is further configured for:
assigning an elevated security risk level to the other digital certificates having one or more of the same digital certificate characteristics.
13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer-executable instructions configured for:
receiving a communication including an Internet protocol (IP) address and a digital certificate at a device within the secured network, the IP address having an IP address security risk level, the digital certification having a digital certificate security risk level;
determining whether the IP address security risk level is identified as having a high-security risk level;
if the IP address has a high-security risk level, assigning a security risk level to the digital certificate based on the security risk level of the IP address;
using the security risk level for the IP address and the security risk level for the digital certificate in executing the one or more security policies, the one or more security policies comprising one or more reputation security policies, executing the one or more reputation security policies is based upon the security risk level for the IP address and the security risk level for the digital certificate; and,
if the digital certificate is associated with an IP address having a high-security risk level, analyzing the digital certificate to identify one or more digital certificate characteristics; and
analyzing other digital certificates to determine whether other digital certificates have one or more of the same digital certificate characteristics.
14. The non-transitory, computer-readable storage medium of claim 13 , wherein
the one or more security policies assign different weights to the security risk level of the IP address and the security risk level of the digital certificate to determine an appropriate security response.
15. The non-transitory, computer-readable storage medium of claim 13 , wherein
determining whether the IP address has a high-security risk includes determining whether the IP address is on a blacklist of IP addresses; and
assigning a high-security risk level to the digital certificate if the IP address is on the blacklist of IP addresses.
16. The non-transitory, computer-readable storage medium of claim 13 , wherein the instructions are further configured for:
retrieving a user behavior security risk level corresponding to security risk presented by a user, wherein the user is an intended recipient of the communication; and
using the security risk level for the IP address, the security risk level for the digital certificate, and the user behavior security risk level for the user to execute one or more security policies.
17. The non-transitory, computer-readable storage medium of claim 13 , wherein the instructions are further configured for:
increasing a security risk level of the IP address if the digital certificate has been previously used with one or more IP addresses presenting an elevated security risk.