Determining digital trust of a client device and user for access permission
Systems and methods for determining digital trust of a device and a user for access permission include monitoring a client device and its access to a network and to resources connected to the network; analyzing behavior-based factors and posture-based factors to determine a digital trust rating at a given time for the client device, wherein the posture-based factors include a rating of certificates associated with the client device and a rating of a Domain Name System (DNS) server associated with the client device; and providing the digital trust rating at the given time for the client device for use in access permission of the client device to the network and/or to the resources.
1 . A method comprising steps of:
monitoring a client device and its access to a network and to resources connected to the network;
analyzing behavior-based factors and posture-based factors in real-time by continuously combining (1) evaluation of behavior-based factors including illegitimate actions performed by the client device against the network or resources, and (2) posture-based based factors including dynamically scoring certificates associated with the client device based on real-time monitoring of whether the certificated are expired, revoked, or current, a security level of the certificates, and life remaining on the certificates, and dynamically scoring malicious activity patterns associated with a Domain Name System (DNS) server used by the client device, wherein the posture-based factors are continuously updated to reflect real-time changes in certificate state and DNS server malicious activity, and wherein the digital trust rating is continuously updated based on changes to the behavior-based factors and posture-based factors while the client device is accessing the network to determine a digital trust rating at a given time for the client device; and
providing the digital trust rating at the given time for the client device for use in access permission of the client device to the network and/or to the resources.
2 . The method of claim 1 , wherein the steps further include:
evaluating the posture-based factors at the given time and continually evaluating the behavior-based factors over time; and
updating the digital trust rating based on the posture-based factors at the given time and the behavior-based factors as they change over time, wherein the updating includes dynamically adjusting scores based on real-time changes in the certificate state and DNS server malicious activity.
3 . The method of claim 1 , wherein the analyzing behavior-based factors includes:
evaluating behavior of the client device and/or a user associated with the client device against legitimate and illegitimate actions on the network and with the resources, and updating the digital trust rating dynamically based on detected illegitimate actions.
4 . The method of claim 1 , wherein the digital trust rating is for one of (1) the client device and (2) a user on the client device such that the user has a different digital trust rating when using a different client device.
5 . The method of claim 1 , wherein the steps further include:
responsive to the digital trust rating being below a threshold, revoking access to the network and/or the resources by revoking one or more of the certificates associated with the client device, based on real-time evaluation of certificate expiration, revocation, or security level.
6 . The method of claim 1 , wherein the analyzing posture-based factors includes:
scoring the digital trust rating based on whether the client device has previously been seen based on an Internet Protocol (IP) address, a device fingerprint, and a network access technology for the client device, and dynamically updating the digital trust rating as these attributes change.
7 . The method of claim 1 , wherein the analyzing posture-based factors includes:
scoring the digital trust rating based on a rating assigned to a network access technology for the client device.
8 . The method of claim 1 , wherein the analyzing posture-based factors includes:
scoring the digital trust rating based on how a user of the client device is authenticated.
9 . The method of claim 1 , wherein the steps further include:
receiving details of the certificates from a software agent operating on the client device.
10 . The method of claim 1 , wherein the rating of certificates associated with the client device is based on
whether the certificates are expired, revoked, or current,
a security level of the certificates, and
a life left on the certificates.
11 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
monitoring a client device and its access to a network and to resources connected to the network;
analyzing behavior-based factors and posture-based factors in real-time by continuously combining (1) evaluation of behavior-based factors including illegitimate actions performed by the client device against the network or resources, and (2) posture-based factors including dynamically scoring certificates associated with the client device based on real-time monitoring of whether the certificated are expired, revoked, or current, a security level of the certificates, and life remaining on the certificates, and dynamically scoring malicious activity patterns associated with a Domain Name System (DNS) server used by the client device, wherein the posture-based factors are continuously updated to reflect real-time changes in certificate state and DNS server malicious activity, and wherein the digital trust rating is continuously updated based on changes to the behavior-based factors and posture-based factors while the client device is accessing the network to determine a digital trust rating at a given time for the client device; and
providing the digital trust rating at the given time for the client device for use in access permission of the client device to the network and/or to the resources.
12 . The non-transitory computer-readable medium of claim 11 , wherein the steps further include:
evaluating the posture-based factors at the given time and continually evaluating the behavior-based factors over time; and
updating the digital trust rating based on the posture-based factors at the given time and the behavior-based factors as they change over time , wherein the updating includes dynamically adjusting scores based on real-time changes in the certificate state and DNS server malicious activity.
13 . The non-transitory computer-readable medium of claim 11 , wherein the analyzing behavior-based factors includes:
evaluating behavior of the client device and/or a user associated with the client device against legitimate and illegitimate actions on the network and with the resources, and updating the digital trust rating dynamically based on detected illegitimate actions.
14 . The non-transitory computer-readable medium of claim 11 , wherein the digital trust rating is for one of (1) the client device and (2) a user on the client device such that the user has a different digital trust rating when using a different client device.
15 . The non-transitory computer-readable medium of claim 11 , wherein the steps further include:
responsive to the digital trust rating being below a threshold, revoking access to the network and/or the resources by revoking one or more of the certificates associated with the client device, based on real-time evaluation of certificate expiration, revocation, or security leve.
16 . The non-transitory computer-readable medium of claim 11 , wherein the analyzing posture-based factors includes:
scoring the digital trust rating based on whether the client device has previously been seen based on an Internet Protocol (IP) address, a device fingerprint, and a network access technology for the client device, and dynamically updating the digital trust rating as these attributes change.
17 . The non-transitory computer-readable medium of claim 11 , wherein the analyzing posture-based factors includes:
scoring the digital trust rating based on a rating assigned to a network access technology for the client device.
18 . The non-transitory computer-readable medium of claim 11 , wherein the analyzing posture-based factors includes:
scoring the digital trust rating based on how a user of the client device is authenticated.
19 . The non-transitory computer-readable medium of claim 11 , wherein the steps further include:
receiving details of the certificates from a software agent operating on the client device.
20 . The non-transitory computer-readable medium of claim 11 , wherein the rating of certificates associated with the client device is based on
whether the certificates are expired, revoked, or current,
a security level of the certificates, and
a life left on the certificates.