ONE-CLICK REPUTATION ADJUSTMENT
In an example, there is disclosed a monolithic reputation update on a data exchange layer (DXL). According to one embodiment, designating a set of objects as good or bad can be achieved via a single administrative action by leveraging persistent client initiated connections to the DXL framework. This may enable communication of the reputation updates across a heterogeneous infrastructure, including systems potentially unreachable by the server, such as those behind a firewall or NAT.
1 . A security management console comprising:
a hardware platform, including a processor, a memory, and a data exchange layer (DXL) interface, the DXL interface including a hardware network connection and a software layer, the software layer to provide a two-layer messaging bus, wherein a lower layer is an internet protocol (IP) network, and an upper layer is a publish-subscribe enterprise service bus (ESB);
an interface to a reputation database, the reputation database including cached reputations for a plurality of network objects, the reputations representing a safety metric corresponding to a respective network object within an enterprise serviced by the DXL, the network object representing at least one of a device, a certificate, or a URL; and
instructions encoded within the memory to instruct the processor to:
provide a DXL security console graphical user interface (GUI), the GUI including instructions to provide a graphical representation of the respective network object, including an existing reputation of the respective network object retrieved from the reputation database;
receive a user input to override the existing reputation of the respective network object to a selected reputation, the selected reputation to cause the respective network object to be blocked:
provide an instruction via the reputation database interface to update the existing reputation of the respective network object in the database with the selected reputation; and
publish a DXL message to a domain associated with the object, at least in part based on a determination that the user input was received, the DXL message including the selected reputation.
2 . The security management console of claim 1 , wherein the DXL security console graphical user interface (GUI) is a DXL administrator graphical user interface.
3 . The security management console of claim 1 , wherein the DXL message includes an instruction to cause an endpoint to take an action responsive to the selected reputation.
4 . The security management console of claim 3 , wherein the action is selected from the group consisting of quarantine, block, delete, sandbox, deny permissions, remedy, prompt, and custom action.
5 . One or more tangible, non-transitory computer-readable storage media having stored thereon executable instructions to:
provide a data exchange layer (DXL) bus, the DXL bus including a publish-subscribe enterprise service bus (ESB) layer on top of an internet protocol (IP) network;
receive an identifier for a DXL object, the DXL object representing at least one of a device, a certificate, or a URL;
query an object reputation database for a current reputation for the DXL object;
receive, via an interface, an override reputation for the DXL object, the override reputation to cause the DXL object to be blocked; and
publish the override reputation to the DXL bus via a DXL message at least in part based on a determination that the override reputation was received.
6 . The one or more tangible, non-transitory computer-readable storage media of claim 5 , wherein the instructions are further to cause a database update to update the DXL object with the override reputation.
7 . The one or more tangible, non-transitory computer-readable storage media of claim 5 , wherein the interface is a graphical user interface.
8 . The one or more tangible, non-transitory computer-readable storage media of claim 5 , wherein the interface is a DXL administrator graphical user interface.
9 . The one or more tangible, non-transitory computer-readable storage media of claim 5 , wherein the DXL message includes an instruction to cause an endpoint to take an action responsive to the override reputation.
10 . The one or more tangible, non-transitory computer-readable storage media of claim 9 , wherein the action is selected from the group consisting of quarantine, block, delete, sandbox, deny permissions, remedy, prompt, and custom action.
11 . A computer-implemented method of providing a one-click reputation update of an object via a data exchange layer (DXL), comprising:
establishing a logical connection with the DXL by overlaying a publish-subscribe enterprise service bus (ESB) onto an internet protocol (IP) network;
receiving an identifier for a DXL object, the DXL object to represent at least one of a device, a certificate, or a URL;
accessing an existing reputation for the DXL object;
receiving, via a software interface, an override reputation for the DXL object, the override reputation to cause the object to be blocked; and
publishing a DXL message comprising the override reputation for the DXL object, at least in part based on a determination that a user input was received.
12 . The method of claim 11 , wherein accessing the existing reputation includes receiving the existing reputation from a database.
13 . The method of claim 12 , wherein accessing the existing reputation from the database includes receiving the existing reputation via a DXL message.
14 . The method of claim 11 , wherein the software interface is a graphical user interface.
15 . The method of claim 11 , wherein the DXL message includes an instruction to cause an endpoint to take an action responsive to the override reputation.
16 . The method of claim 15 , wherein the action is selected from the group consisting of quarantine, block, delete, sandbox, deny permissions, remedy, prompt, and custom action.