Enhanced client compliancy using database of security sensor data
Security sensor data from intrusion detection system (IDS) sensors, vulnerability assessment (VA) sensors, and/or other security sensors is used to enhance the compliancy determination in a client compliancy system. A database is used to store the security sensor data. In one particular embodiment, a list of device compliance statuses indexed by corresponding identifiers (e.g., IP/MAC addresses) combined from IDS, VA, and/or other security sensing technologies is made available as a non-compliance database for query, so that clients and other compliancy authentication elements can tell that a particular client appears to be out of compliance. A client-side self-policing compliance system is enabled, and can be used in conjunction with automated endpoint compliance policy configuration to reduce system administrator burden.
1. A method for enforcing client compliance on a network, comprising:
storing to a database, identifiers of non-compliant devices on the network detected by security sensors, the security sensors including at least one of an intrusion detection system (IDS) sensor and a vulnerability assessment (VA) sensor;
receiving, over the network, a query from a self-policing target device, the query requesting a compliance status of the self-policing target device from the database of non-compliant devices, and the query including an identifier of the self-policing target device;
comparing the identifier of the self-policing target device in the query against the identifiers of the non-compliant devices in the database;
determining a compliance status of the self-policing target device based on the identifiers of the non-compliant devices stored in the database and the identifier of the self-policing target device, the compliance status indicating whether or not the identifier of the self-policing target device is included in the database of non-compliant devices detected by the security sensors; and
transmitting, over the network, the compliance status to the self-policing target device, wherein in response to the status indicating that the identifier of the self-policing target device is included in the database of non-compliant devices detected by the security sensors, the self-policing target device initiates a remedial action to put itself in compliance with network security policies.
2. The method of claim 1 further comprising:
in response to determining that the self-policing target device is compliant, assigning the target device to a protected network.
3. The method of claim 1 further comprising:
in response to determining that the self-policing target device is non-compliant, assigning the self-policing target device to a quarantined network; and
taking remedial steps to eliminate non-compliancy.
4. The method of claim 1 wherein the identifiers of the non-compliant devices are received from the security sensors at least one of periodically according to a predetermined schedule and on a real-time basis as non-compliances are detected.
5. The method of claim 1 , wherein in response to transmitting a compliance status indicating that the identifier of the self-policing target device is included in the database of non-compliant devices detected by the security sensors, and receiving a request from the self-policing target device, providing to the self-policing target device at least one of a new network lease and remedial processing.
6. The method of claim 5 wherein the request for new network lease causes a proxy to assign the self-policing target device to a quarantine network.
7. The method of claim 1 , further comprising:
removing the self-policing target device listing in the database in response to the self-policing target device placing itself into remediation.
8. The method of claim 1 wherein the identifiers of non-compliant devices are network addresses including at least one of MAC and IP addresses.
9. The method of claim 1 , further comprising:
removing the identifier of the self-policing target device from the database in response to receiving the query from the self-policing target device; and
re-admitting the identifier of the self-policing target device to the database in response to the security sensors subsequently detecting non-compliance of the self-policing target device.
10. The method of claim 1 , wherein the identifier of the self-policing target device comprises a MAC address of the self-policing target device.
11. A non-transitory machine-readable storage medium encoded with instructions, that when executed by a processor, cause the processor to carry out a process for enforcing client compliance on a network, the process comprising:
storing to a database, identifiers of non-compliant devices on the network detected by security sensors, the security sensors including at least one of an intrusion detection system (IDS) sensor and a vulnerability assessment (VA) sensor;
receiving, over the network, a query from a self-policing target device, the query requesting a compliance status of the self-policing target device from the database of non-compliant devices, and the query including an identifier of the self-policing target device;
comparing the identifier of the self-policing target device in the query against the identifiers of the non-compliant devices in the database;
determining a compliance status of the self-policing target device based on the identifiers of the non-compliant devices stored in the database and the identifier of the self-policing target device, the compliance status indicating whether or not the identifier of the self-policing target device is included in the database of non-compliant devices detected by the security sensors; and
transmitting, over the network, the compliance status to the self-policing target device, wherein in response to the status indicating that the identifier of the self-policing target device is included in the database of non-compliant devices detected by the security sensors, the self-policing target device initiates a remedial action to put itself in compliance with network security policies.
12. The non-transitory machine-readable storage medium of claim 11 , the process further comprising:
in response to determining that the self-policing target device is compliant, assigning the target device to a protected network.
13. The non-transitory machine-readable storage medium of claim 11 , the process further comprising:
in response to determining that the self-policing target device is non-compliant, assigning the self-policing target device to a quarantined network; and
taking remedial steps to eliminate non-compliancy.
14. The non-transitory machine-readable storage medium of claim 11 further comprising:
removing the self-policing target device listing in the database in response to the self-policing target device placing itself into remediation.
15. The non-transitory machine-readable storage medium of claim 11 , the process further comprising:
removing the identifier of the self-policing target device from the database in response to receiving the query from the self-policing target device; and
re-admitting the identifier of the self-policing target device to the database in response to the security sensors subsequently detecting non-compliance of the self-policing target device.
16. The non-transitory machine-readable storage medium of claim 11 , wherein the identifier of the self-policing target device comprises a MAC address of the self-policing target device.
17. An apparatus for enforcing client compliance on a network, comprising:
a processor;
a memory comprising a database for storing identifiers of non-compliant devices on the network detected by the security sensors, the security sensors including at least one of an intrusion detection system (IDS) sensor and a vulnerability assessment (VA) sensor; and
a computer-readable storage medium storing a computer-executable program module executable by the processor, the program module including a compliance registration manager that when executed by the processor causes the processor to perform steps of:
receiving, over the network, a query from a self-policing target device, the query requesting a compliance status of the self-policing target device from the database of non-compliant devices, and the query including an identifier of the self-policing target device;
comparing the identifier of the self-policing target device in the query against the identifiers of the non-compliant devices in the database;
determining a compliance status of the self-policing target device based on the identifiers of the non-compliant devices stored in the database and the identifier of the self-policing target device, the compliance status indicating whether or not the identifier of the self-policing target device is included in the database of non-compliant devices detected by the security sensors; and
transmitting, over the network, the compliance status to the self-policing target device, wherein in response to the status indicating that the identifier of the self-policing target device is included in the database of non-compliant devices detected by the security sensors, the self-policing target device initiates a remedial action to put itself in compliance with network security policies.
18. The apparatus of claim 17 wherein the identifiers of the non-compliant devices are received from the security sensors at least one of periodically according to a predetermined schedule and on a real-time basis as non-compliances are detected.
19. The apparatus of claim 17 wherein the compliance registration manager when executed further causes the processor to perform a step of:
removing the self-policing target device listing from the database in response to the self-policing target device placing itself into remediation.
20. The apparatus of claim 17 , wherein the identifier of the self-policing target device comprises a MAC address of the self-policing target device.