Network access control from anywhere
Systems, methods, and related technologies for managing network access control from anywhere are described. A method includes receiving, from a cloud-based security system, information about a device that is coupled to a public network and decoupled from a private network. Based on the information, the method detects risky activity associated with the device. The method sends instructions to a remote agent executing on the device to perform one or more security measures that protect a resource of the device.
1. A method, comprising:
receiving, from a cloud-based security system, information about a device that is coupled to a public network and decoupled from a private network, wherein the information is generated based on network traffic from the device over the public network;
detecting, based on the information, risky activity associated with the device;
determining that the information indicates an application installed on the device is performing the risky activity on the device; and
sending, by a processing device, instructions to a remote agent executing on the device to perform one or more security measures that protect a resource of the device, wherein the instructions instruct the remote agent to prohibit the application installed on the device from accessing the resource on the device.
2. The method of claim 1 , further comprising:
establishing a remote connection with the remote agent over the public network; and
transmitting the instructions over the remote connection to the remote agent.
3. The method of claim 1 , wherein:
the information is generated based on network traffic from the device over a public network connection between the public network and the application; and
the instructions instruct to the remote agent to disconnect the device from the public network connection.
4. The method of claim 2 , wherein the instructions instruct the remote agent to prohibit the device from attempting to connect to the private network.
5. The method of claim 2 , further comprising:
receiving local activity information from the remote agent over the remote connection;
determining that the local activity information indicates a malicious application executing on the device; and
wherein the instructions instruct the remote agent to prohibit the malicious application from accessing the resource.
6. The method of claim 1 , wherein the resource is associated with the private network and the one or more security measures are based on a set of policies that protect the private network from the risky activity.
7. A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
receive, from a cloud-based security system, information about a device that is coupled to a public network and decoupled from a private network;
detect, based on the information, risky activity associated with the device;
determine that the information indicates an application installed on the device is performing the risky activity on the device; and
send instructions to a remote agent executing on the device to perform one or more security measures that protect a resource of the device, wherein the instructions instruct the remote agent to prohibit the application installed on the device from accessing the resource on the device.
8. The system of claim 7 , wherein the processing device is to:
establish a remote connection with the remote agent over the public network; and
transmit the instructions over the remote connection to the remote agent.
9. The system of claim 7 , wherein:
the information is generated based on network traffic from the device over a public network connection between the public network and the application; and
the instructions instruct to the remote agent to disconnect the device from the public network connection.
10. The system of claim 8 , wherein the instructions instruct the remote agent to prohibit the device from attempting to connect to the private network.
11. The system of claim 8 , wherein the processing device is to:
receive local activity information from the remote agent over the remote connection;
determine that the local activity information indicates a malicious application executing on the device; and
wherein the instructions instruct the remote agent to prohibit the malicious application from accessing the resource.
12. The system of claim 7 , wherein the resource is associated with the private network and the one or more security measures are based on a set of policies that protect the private network from the risky activity.
13. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
receive, from a cloud-based security system, information about a device that is coupled to a public network and decoupled from a private network;
detect, based on the information, risky activity associated with the device;
determine that the information indicates an application installed on the device is performing the risky activity on the device; and
send, by the processing device, security measure instructions to a remote agent executing on the device to perform one or more security measures that protect a resource of the device, wherein the instructions instruct the remote agent to prohibit the application installed on the device from accessing the resource on the device.
14. The non-transitory computer readable medium of claim 13 , wherein the processing device is to:
establish a remote connection with the remote agent over the public network; and
transmit the security measure instructions over the remote connection to the remote agent.
15. The non-transitory computer readable medium of claim 13 , wherein:
the information is generated based on network traffic from the device over a public network connection between the public network and the application; and
the security measure instructions instruct to the remote agent to disconnect the device from the public network connection.
16. The non-transitory computer readable medium of claim 14 , wherein the security measure instructions instruct the remote agent to prohibit the device from attempting to connect to the private network.
17. The non-transitory computer readable medium of claim 14 , wherein the processing device is to:
receive local activity information from the remote agent over the remote connection;
determine that the local activity information indicates a malicious application executing on the device; and
wherein the security measure instructions instruct the remote agent to prohibit the malicious application from accessing the resource.