Automated individualized network security controls for internet of things (IoT) devices
A method, apparatus and computer program product for protecting enterprise Information Technology (IT) infrastructures by automatically instantiating individualized network flow controls and/or network access controls specific to an IoT device. In this approach, an IoT device is identified, e.g., via network scanning or other observational sensors, or by receipt of information from a network administrator. In response to receiving information about the new IoT device, a control component obtains applicable network flow control and/or access control rules for the IoT device. These rules are obtained from one or more authoritative (trusted) sources, e.g., querying a website of the IoT vendor, an industry site, or an enterprise site. In this manner, applicable network flow control and/or access control rules are obtained. The control component then translates those rules into configuration parameters that are consumable by the particular network flow control device that is (or will be) associated with the IoT device.
1. An apparatus to protect an enterprise network that includes a set of one or more network control devices, comprising:
a processor;
computer memory holding computer program instructions executed by the processor, the computer program instructions configured in an automated manner to:
detect a new Internet of Things (IoT) device by observing one or more attributes associated with a communication flow behavior in the enterprise network;
responsive to detecting the new IoT device, associate the new IoT device with an observed Internet Protocol (IP) address in the enterprise network and query an authoritative source to obtain a set of control rules for the new IoT device, the set of control rules representing a normal behavior of the new IoT device as specified by a provider of the new IoT device;
responsive to receipt of the set of control rules from the authoritative source, generate a device configuration comprising a set of one or more configuration parameters for use by a network control device of the set to control network behavior of the new IoT device, the set of configuration parameters being individualized for the new IoT device and based at least in part on the set of control rules and a location of the new IoT device in the enterprise network associated with the observed IP address; and
instantiate the device configuration into the network control device to control network behavior of the new IoT device.
2. The apparatus as described in claim 1 wherein the authoritative source is one of: a vendor of the new IoT device, and a trusted third party source that manages control rules on behalf of vendors of IoT devices.
3. The apparatus as described in claim 1 wherein the computer program instructions configured to detect the new IoT device include program code to receive information that identifies the new IoT device directly.
4. The apparatus as described in claim 1 wherein the computer program instructions configured to detect the new IoT device include program code to observe a message sequence of the communication flow behavior associated the new IoT device, to correlate the observed communication flow behavior in whole or in part with known behaviors for a set of IoT devices, and to identify the new IoT device indirectly based at least in part on the correlation.
5. The apparatus as described in claim 1 wherein the set of configuration parameters are also based at least in part on information derived from the enterprise network.
6. The apparatus as described in claim 5 wherein at least one configuration parameter is a configuration change that is based on the information derived from the enterprise network.
7. The apparatus as described in claim 1 wherein the computer program instructions are further configured to control the at least one of the network control devices to monitor network behavior of the new IoT device against the device configuration.
8. The apparatus as described in claim 1 wherein the set of control rules comprise one of: network flow control rules, and access control rules.
9. A computer program product in a non-transitory computer readable medium for use in a data processing system to protect an enterprise network that includes a set of one or more network control devices, the computer program product holding computer program instructions that, when executed by the data processing system, are configured in an automated manner to:
detect a new Internet of Things (IoT) device by observing one or more attributes associated with a communication flow behavior in the enterprise network;
responsive to detecting the new IoT device, associating the new IoT device with an observed Internet Protocol (IP) address in the enterprise network and querying an authoritative source to obtain a set of control rules for the new IoT device, the set of control rules representing a normal behavior of the new IoT device as specified by a provider of the new IoT device;
responsive to receipt of the set of control rules from the authoritative source, generating a device configuration comprising a set of one or more configuration parameters for use by a network control device of the set to control network behavior of the new IoT device, the set of configuration parameters being individualized for the new IoT device and based at least in part on the set of control rules and a location of the new IoT device in the enterprise network associated with the observed IP address; and
instantiating the device configuration into the network control device to control network behavior of the new IoT device.
10. The computer program product as described in claim 9 wherein the authoritative source is one of: a vendor of the new IoT device, and a trusted third party source that manages control rules on behalf of vendors of IoT devices.
11. The computer program product as described in claim 9 wherein the computer program instructions configured to detect the new IoT device include program code to receive information that identifies the new IoT device directly.
12. The computer program product as described in claim 9 wherein the computer program instructions configured to detect the new IoT device include program code to observe a message sequence of the communication flow behavior associated the new IoT device, to correlate the observed communication flow behavior in whole or in part with known behaviors for a set of IoT devices, and to identify the new IoT device indirectly based at least in part on the correlation.
13. The computer program product as described in claim 9 wherein the set of configuration parameters are also based at least in part on information derived from the enterprise network.
14. The computer program product as described in claim 13 wherein at least one configuration parameter is a configuration change that is based on the information derived from the enterprise network.
15. The computer program product as described in claim 9 wherein the computer program instructions are further configured to control the at least one of the network control devices to monitor network behavior of the new IoT device against the device configuration.
16. The computer program product as described in claim 9 wherein the set of control rules comprise one of: network flow control rules, and access control rules.