Port authentication control for access control and information security
A system that includes a threat management server configured to store a port exemption log that identifies ports on a switch configured to bypass authentication and endpoint devices connected the ports configured to bypass authentication. The threat management server interrogates a switch for switch information identifying ports on the switch configured to bypass authentication and endpoint devices connected the ports configured to bypass authentication. The threat management server compares the switch information to the information in the port exemption log. The threat management server identifies a port based on differences between the received switch information and the port exemption log and enables port authentication for the identified port in response to identifying the differences.
1. A system comprising:
a switch comprising a plurality of ports; and
a threat management server operably coupled to the switch, and comprising:
a memory configured to store:
a port exemption log identifying:
ports on the switch configured to bypass authentication; and
device information for endpoint devices connected to the ports on the switch configured to bypass authentication; and
a threat management engine implemented by a processor configured to:
interrogate the switch for switch information identifying:
ports configured to bypass authentication;
device information for endpoint devices connected to the ports on the switch configured to bypass authentication;
compare the switch information with the port exemption log file;
identify a port from among the plurality of ports based on differences between the switch information and the port exemption log; and
enable port authentication on the port in response to identifying the endpoint device;
wherein the threat management engine is further configured to:
receive an exemption request requesting an authentication exemption for a first port;
add the first port to the port exemption log; and
send an exemption command to the switch identifying the first port, wherein the exemption command triggers the switch to bypass authentication for the first port.
2. The system of claim 1 , wherein identifying the port based on differences between the switch information and the port exemption log comprises:
determining the port is present in the switch information; and
determining the port is absent in the port exemption log.
3. The system of claim 1 , wherein identifying the port based on differences between the switch information and the port exemption log comprises:
identifying an endpoint device based on differences between device information in the port exemption log and device information in the switch information; and
determining the endpoint device is connected to the port.
4. The system of claim 1 , wherein the threat management engine is configured to:
identify an endpoint device connected to the port; and
send an alert identifying the endpoint device.
5. The system of claim 1 , wherein the threat management engine is configured to generate a virtual map of endpoint devices connected to ports of the switch based on the switch information.
6. The system of claim 1 , wherein interrogating the switch for switch information comprises sending a system network management protocol (SNMP) query message to the switch.
7. A threat management server comprising:
a memory configured to store:
a port exemption log identifying:
ports on a switch configured to bypass authentication; and
device information for endpoint devices connected to the ports on the switch configured to bypass authentication; and
a threat management engine implemented by a processor configured to:
interrogate the switch for switch information identifying:
ports configured to bypass authentication;
device information for endpoint devices connected to the ports on the switch configured to bypass authentication;
compare the switch information with the port exemption log file;
identify a port from among the plurality of ports based on differences between the switch information and the port exemption log; and
enable port authentication on the port in response to identifying the endpoint device;
wherein the threat management engine is further configured to:
receive an exemption request requesting an authentication exemption for a first port;
add the first port to the port exemption log; and
send an exemption command to the switch identifying the first port, wherein the exemption command triggers the switch to bypass authentication for the first port.
8. The device of claim 7 , wherein identifying the port based on differences between the switch information and the port exemption log comprises:
determining the port is present in the switch information; and
determining the port is absent in the port exemption log.
9. The device of claim 7 , wherein identifying the port based on differences between the switch information and the port exemption log comprises:
identifying an endpoint device based on differences between device information in the port exemption log and device information in the switch information; and
determining the endpoint device is connected to the port.
10. The device of claim 7 , wherein the threat management engine is configured to:
identify an endpoint device connected to the port; and
send an alert identifying the endpoint device.
11. The device of claim 7 , wherein the threat management engine is configured to generate a virtual map of endpoint devices connected to ports of the switch based on the switch information.
12. The device of claim 7 , wherein interrogating the switch for switch information comprises sending a system network management protocol (SNMP) query message to the switch.
13. A method comprising:
interrogating, by a threat management server, a switch for switch information identifying:
ports configured to bypass authentication;
device information for endpoint devices connected to the ports on the switch configured to bypass authentication;
comparing, by the threat management server, the switch information with a port exemption log file identifying:
ports on the switch configured to bypass authentication; and
device information for endpoint devices connected to the ports on the switch configured to bypass authentication;
identifying, by the threat management server, a port from among the plurality of ports based on differences between the switch information and the port exemption log;
enabling, by the threat management server, port authentication on the port in response to identifying the endpoint device;
receiving, by the threat management server, an exemption request requesting to an authentication exemption for a first port;
adding, by the threat management server, the first port to the port exemption log; and
sending, by the threat management server, an exemption command to the switch identifying the first port, wherein the exemption command triggers the switch to bypass authentication for the first port.
14. The method of claim 13 , wherein identifying the port based on differences between the switch information and the port exemption log comprises:
determining the port is present in the switch information; and
determining the port is absent in the port exemption log.
15. The method of claim 13 , wherein identifying the port based on differences between the switch information and the port exemption log comprises:
identifying an endpoint device based on differences between device information in the port exemption log and device information in the switch information; and
determining the endpoint device is connected to the port.
16. The method of claim 13 , further comprising:
identifying, by the threat management server, an endpoint device connected to the port; and
sending, by the threat management server, an alert identifying the endpoint device.
17. The method of claim 13 , further comprising generating, by the threat management server, a virtual map of endpoint devices connected to ports of the switch based on the switch information.