Centralized network response to mitigate a data-based security risk
Systems, methods, and related technologies for identifying and reducing security risks on a network are described. Data that is held on each of one or more devices that are connected to a network is determined. A security risk of each of the one or more devices is determined based at least on the data. In response to the security risk of one of the one or more devices satisfying a threshold, the network is segmented such that the one of the one or more devices is placed on a less accessible segment of the network which reduces the security risk of the one of the one or more devices.
1. A method, comprising:
determining data that is held on each of one or more devices that are connected to a respective current segment of a network;
determining a security risk of each of the one or more devices based at least on the data and sensitivity of previously stored data on the one or more devices; and
in response to the security risk of one of the one or more devices satisfying a threshold, segmenting the network such that the one of the one or more devices is placed on a less accessible segment than the respective current segment of the network, wherein being placed on the less accessible segment reduces the security risk of the one of the one or more devices.
2. The method of claim 1 , further comprising: in response to the security risk satisfying the threshold, causing a service or application that is running on the one of the one or more devices to exit.
3. The method of claim 1 , further comprising: in response to the security risk satisfying the threshold, closing a port of the one of the one or more devices.
4. The method of claim 1 , further comprising: in response to the security risk satisfying the threshold, updating an operating system or firewall on the one of the one or more devices.
5. The method of claim 1 , wherein determining the data that is held on each of one or more devices includes accessing an API of the one or more devices to obtain the data.
6. The method of claim 1 , wherein determining the data that is held on each of one or more devices includes accessing a third party server to obtain the data.
7. The method of claim 1 , wherein the security risk of each of the one or more devices is determined as being higher in response to an increase in the sensitivity of the data a respective one of the one or more devices and in response to an increase in a vulnerability of the respective one of the one or more devices.
8. The method of claim 1 , wherein the data is obtained from each of the one or more devices with an agentless interrogation procedure.
9. The method of claim 1 , further comprising keeping the one of the one or more devices on the respective current segment of the network if it does not hold sensitive data.
10. The method of claim 1 , further comprising keeping the one of the one or more devices on the respective current segment of the network if the one or more devices does not currently hold sensitive data, unless the previously stored data on the one of the one or more devices held sensitive data and is determined as vulnerable.
11. A system, comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
determine data that is held on each of one or more devices that are connected to a respective current segment of a network;
determine a security risk of each of the one or more devices based at least on the data and sensitivity of previously stored data on the one or more devices; and
in response to the security risk of one of the one or more devices satisfying a threshold, segment the network such that the one of the one or more devices is placed on a less accessible segment than the respective current segment of the network, wherein being placed on the less accessible segment reduces the security risk of the one of the one or more devices.
12. The system of claim 11 , wherein the processing device is further to: in response to the security risk satisfying the threshold, causing a service or application that is running on the one of the one or more devices to exit.
13. The system of claim 11 , wherein the processing device is further to: in response to the security risk satisfying the threshold, closing a port of the one of the one or more devices.
14. The system of claim 11 , wherein the processing device is further to: in response to the security risk satisfying the threshold, updating an operating system or firewall on the one of the one or more devices.
15. The system of claim 11 , wherein determining the data that is held on each of one or more devices includes accessing an API of the one or more devices to obtain the data.
16. The system of claim 11 , wherein determining the data that is held on each of one or more devices includes accessing a third party server to obtain the data.
17. The system of claim 11 , wherein the security risk of each of the one or more devices is determined as being higher in response to an increase in the sensitivity of the data a respective one of the one or more devices and in response to an increase in a vulnerability of the respective one of the one or more devices.
18. The system of claim 11 , wherein the processing device is further to keep the one of the one or more devices on the respective current segment of the network if the one or more devices does not currently hold sensitive data, unless the previously stored data on the one of the one or more devices held sensitive data and is determined as vulnerable.
19. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
determine data that is held on each of one or more devices that are connected to a respective current segment of a network;
determine, by the processing device, a security risk of each of the one or more devices based at least on the data and sensitivity of previously stored data on the one or more devices; and
in response to the security risk of one of the one or more devices satisfying a threshold, segment, by the processing device, the network such that the one of the one or more devices is placed on a less accessible segment than the respective current segment of the network, wherein being placed on the less accessible segment reduces the security risk of the one of the one or more devices.
20. The non-transitory computer readable medium of claim 19 , wherein the security risk of each of the one or more devices is determined as being higher in response to an increase in the sensitivity of the data a respective one of the one or more devices and in response to an increase in a vulnerability of the respective one of the one or more devices.