Application firewall
A firewall uses information about an application that originates a network request to determine whether and how to forward the request over a network. The firewall may more generally rely on the identity of the originating application, the security state of the originating application, the security state of the endpoint, and any other information that might provide an indication of malicious activity, to make routing and forwarding decisions for endpoint-originated network traffic.
1. A computer program product for operating a firewall to selectively forward network communications between a first network interface of the firewall operable to couple to an endpoint and a second network interface of the firewall operable to couple to a remote resource hosted at a server, the computer program product comprising computer executable code embodied in a non-transitory memory of the firewall that, when executing on the firewall, responds to a request from the endpoint to the remote resource by performing the steps of:
detecting indicia of maliciousness in the request;
in response to the indicia, determining an identity of an application that originated the request on the endpoint based on a packet carrying the request;
determining a security state of the application that originated the request by querying a security data recorder on the endpoint to identify previous events associated with the application; and
conditionally forwarding the request from the firewall to the server only when the identity of the application is recognized and the security state of the application is uncompromised.
2. The computer program product of claim 1 , wherein determining the security state of the application that originated the request includes determining the security state based on a secure heartbeat included in the packet.
3. The computer program product of claim 1 , wherein determining the security state of the application includes traversing a causal chain of events on the endpoint to identify a root cause of the request.
4. The computer program product of claim 1 , wherein conditionally forwarding the request to the server includes conditionally forwarding the request to the server only when a security state of the endpoint is uncompromised.
5. A firewall configured to selectively forward network communications, the firewall comprising:
a first network interface operable to couple to an endpoint;
a second network interface operable to couple to a remote resource hosted at a server; and
a processor configured to respond to a request from the endpoint to the remote resource for a service by performing the steps of:
detecting indicia of maliciousness in the request;
in response to the indicia determining an identity of an application that originated the request on the endpoint based on a packet carrying the request;
determining a security state of the application by querying a security data recorder on the endpoint to identify previous events associated with the application; and
conditionally forwarding the request to the server only when the identity of the application is recognized and the security state of the application is uncompromised.
6. The firewall of claim 5 , wherein determining the identity of the application includes following a causal chain from a nominal originating application to identify a root cause of the request.
7. The firewall of claim 5 , wherein the indicia of maliciousness includes an indication of compromise of the endpoint in a secure heartbeat included in the request.
8. The firewall of claim 5 , wherein querying the security data recorder includes querying the security data recorder to identify a root cause of the request.
9. The firewall of claim 5 , wherein the endpoint and the remote resource are peers coupled together through a peer-to-peer network.
10. The firewall of claim 5 , wherein the indicia of maliciousness includes access to external resources in violation of a security policy.
11. The firewall of claim 5 , wherein the indicia of maliciousness includes use of corporate credentials in violation of a security policy.
12. The firewall of claim 5 , wherein the indicia of maliciousness includes web traffic in violation of a security policy.
13. The firewall of claim 5 , wherein the indicia of maliciousness includes attempted communications through the firewall in violation of a security policy.
14. The firewall of claim 5 , wherein determining the security state of the application includes querying the endpoint from the firewall for indicia of compromise.
15. The firewall of claim 5 , wherein determining the identity of the application includes querying the endpoint from the firewall for the identity.
16. The firewall of claim 5 , wherein the processor is further configured to perform the steps of monitoring a pattern of traffic to the remote resource from a plurality of endpoints and automatically developing a rule for acceptable connections to the server based on the pattern of traffic.
17. The firewall of claim 5 , wherein determining the security state of the application includes querying the endpoint for at least one of credentials authenticating the application to the server, credentials authenticating a user of the endpoint to the server, or an encrypted heartbeat containing information about a state of the endpoint.
18. The firewall of claim 5 , wherein the processor is further configured to transmit a notification to the endpoint when an indication of compromise is detected for the application.
19. A method for operating a firewall to selectively forward network communications between a first network interface of the firewall operable to couple to an endpoint and a second network interface of the firewall operable to couple to a remote resource hosted at a server, the method including responding to a request from the endpoint to the remote resource by performing the steps of:
detecting indicia of maliciousness in the request;
in response to the indicia, determining an identity of an application that originated the request on the endpoint based on a packet carrying the request;
determining a security state of the application by querying a security data recorder on the endpoint to identify previous events associated with the application; and
conditionally forwarding the request to the server only when the identity of the application is recognized and the security state of the application is uncompromised.
20. The method of claim 19 , wherein querying the security data recorder includes querying the security data recorder to identify a root cause of the request.