Adjusting security policies based on endpoint locations

1. A method, comprising:

performing, at a first time, a first authentication of a first device connecting to a resource;

determining addresses of second devices exchanging first data with the first device;

determining first physical locations of the second devices based on the addresses;

determining that at least one of the first physical locations of the second devices is anomalous with respect to second physical locations of third devices that were previously exchanging data with the first device;

determining a reauthentication interval based on determining that at least one of the first physical locations of the second devices is anomalous with respect to second physical locations of third devices that were previously exchanging data with the first device; and

at a second time that is after the first time by the reauthentication interval:

disconnecting the first device from the resource; and

based on disconnecting the first device from the resource, triggering a second authentication of the first device.

2. The method of claim 1 , wherein performing the first authentication comprises:

transmitting, to the first device, a request for a first authentication factor;

receiving, from the first device, the first authentication factor;

transmitting, to the first device or a fourth device, a request for a second authentication factor, the first device and the fourth device being associated with a same user; and

receiving, from the first device or the fourth device, the second authentication factor.

3. The method of claim 1 , wherein determining the addresses of the second devices exchanging first data with the first device comprises receiving, from a monitoring system, a message indicating the addresses of the second devices.

4. The method of claim 1 , wherein determining the reauthentication interval comprises:

defining the reauthentication interval to be shorter than a default interval.

5. The method of claim 1 , wherein the second devices comprise one or more endpoint devices.

6. The method of claim 1 , wherein determining the reauthentication interval based on the first physical locations of the second devices comprises:

identifying a suspicious physical location;

determining that at least one of the first physical locations of the second devices comprises the suspicious physical location; and

based on determining that at least one of the first physical locations of the second devices comprises the suspicious physical location, defining the reauthentication interval to be shorter than a default interval.

7. The method of claim 1 , wherein triggering the second authentication comprises:

transmitting, to the first device or to a fourth device, a request for an authentication factor, the first device and the fourth device being associated with a same user.

8. The method of claim 7 , further comprising:

selecting the authentication factor based on the first physical locations of the second devices.

9. A system, comprising

at least one processor; and

one or more non-transitory media storing instructions that, when executed by the system, cause the system to perform operations comprising:

performing, at a first time, a first authentication of a first device connecting to a resource;

determining addresses of second devices exchanging data with the first device;

determining first physical locations of the second devices based on the addresses;

determining that at least one of the first physical locations of the second devices is anomalous with respect to second physical locations of third devices that were previously exchanging data with the first device; and

selecting an authentication factor based on determining that at least one of the first physical locations of the second devices is anomalous with respect to the second physical locations of the third devices that were previously exchanging data with the first devices; and

at a second time that is after the first time:

disconnecting the first device from the resource; and

based on disconnecting the first device from the resource, triggering a second authentication of the first device by transmitting, to the first device or to a fourth device, a request for the authentication factor.

10. The system of claim 9 , the authentication factor being a first authentication factor, wherein performing the first authentication comprises:

transmitting, to the first device, a request for a second authentication factor;

receiving, from the first device, the second authentication factor;

transmitting, to the first device or the fourth device, a request for a third authentication factor; and

receiving, from the first device or the fourth device, the third authentication factor.

11. The system of claim 9 , wherein determining the addresses of the second devices exchanging data with the first device comprises receiving, from a monitoring system, a message indicating the addresses of the second devices.

12. The system of claim 9 , wherein the first device is one of multiple first devices associated with a security group, and

wherein selecting the authentication factor comprises:

determining whether at least one of the first physical locations of the second devices is anomalous with respect to third physical locations of fifth devices that were previously exchanging data with the first devices; and

selecting the authentication factor based on whether at least one of the first physical locations of the second devices is anomalous with respect to the third physical locations of the fifth devices that were previously exchanging data with the first devices.

13. The system of claim 9 , wherein selecting the authentication factor comprises:

identifying a suspicious physical location;

determining whether at least one of the first physical locations of the second devices comprises the suspicious physical location; and

selecting the authentication factor based on whether at least one of the first physical locations of the second devices comprises the suspicious physical location.

14. The system of claim 9 , wherein the operations further comprise:

determining a reauthentication interval defined between the first time and the second time based on the first physical locations of the second devices.

15. A security system, comprising:

at least one processor; and

one or more non-transitory media storing instructions that, when executed by the system, cause the security system to perform operations comprising:

performing, at a first time, a first authentication of a primary device connecting to a resource by:

transmitting, to the primary device, a request for a first authentication factor;

receiving, from the primary device, the first authentication factor;

based on receiving the first authentication factor, transmitting, to the primary device or to a secondary device, a request for a second authentication factor;

receiving, from the primary device or the secondary device, the second authentication factor; and

based on receiving the second authentication factor, connecting the primary device to the resource;

receiving, from a monitoring system, a message indicating internet protocol (IP) addresses of endpoint devices exchanging data with the primary device;

determining first physical locations of the endpoint devices based on the IP addresses;

determining that at least one of the first physical locations of the endpoint devices is anomalous with respect to second physical locations of other devices that were previously exchanging data with the primary device;

based on determining that at least one of the first physical locations of the endpoint devices is anomalous with respect to the second physical locations of other devices that were previously exchanging data with the primary device:

determining a reauthentication interval; and

selecting a third authentication factor; and

at a second time that is after the first time by the reauthentication interval:

disconnecting the primary device from the resource; and

based on disconnecting the primary device from the resource, triggering a second authentication of the primary device by transmitting, to the primary device or to the secondary device, a request for the third authentication factor.

16. The security system of claim 15 , wherein determining that at least one of the first physical locations of the endpoint devices is anomalous with respect to the second physical locations of other devices that were previously exchanging data with the primary device comprises:

determining that the first physical locations of the endpoint devices comprise greater than a threshold number or percentage of anomalous locations,

wherein determining the reauthentication interval comprises defining the reauthentication interval to be shorter than a default reauthentication interval, and

wherein selecting the third authentication factor comprises selecting a biometric authentication factor that is different than the first authentication factor and the second authentication factor.

17. The security system of claim 15 , wherein the operations further comprise:

selecting a firewall rule based on the first physical locations of the endpoint devices; and

causing a firewall to enforce the firewall rule on data transmitted between the primary device and the resource.

18. The security system of claim 15 , wherein the endpoint devices comprise at least one destination of a data flow, the primary device being a source of the data flow.

19. The security system of claim 15 , wherein the operations further comprise:

determining that the first physical locations of the endpoint devices comprise greater than a threshold number or percentage of suspicious locations,

wherein determining the reauthentication interval comprises defining the reauthentication interval to be shorter than a default reauthentication interval, and

wherein selecting the third authentication factor comprises selecting a biometric authentication factor that is different than the first authentication factor and the second authentication factor.

20. The security system of claim 19 , wherein the suspicious locations are in at least one geographic region where malicious computing activities have been identified or suspected to occur.