Adjusting behavior of an endpoint security agent based on network location
Systems and methods for adjusting the behavior of an endpoint security agent based on a network location are provided. According to an embodiment, an agent of an endpoint device identifies whether a security service of a cloud-based security service is not reachable or is unresponsive. The security service is associated with a particular security function implemented by the agent. When the security service is not reachable or is unresponsive, the agent further determines whether the endpoint device is within a trusted network of multiple trusted networks that have been previously registered with the cloud-based security service by querying a trusted network determination service associated with the cloud-based security service. When the determination is affirmative, the particular security feature is configured for operating inside a trusted network. When the determination is negative, the particular security feature is configured for operating outside a trusted network.
1 . A method performed within an agent running on an endpoint device by a processing resource of the endpoint device, the method comprising:
identifying a security service of a cloud-based security service is not reachable or is unresponsive, wherein the security service is associated with a particular security function implemented by the agent;
when the security service is not reachable or is unresponsive, determining whether the endpoint device is within a trusted network of a plurality of trusted networks that have been previously registered with the cloud-based security service; and
when said determining is affirmative, configuring the particular security feature for operating inside one of the plurality of trusted networks.
2 . The method of claim 1 , wherein the determining whether the endpoint device is within a trusted network of a plurality of trusted networks that have been previously registered with the cloud-based security service is done by querying a trusted network determination service associated with the cloud-based security service.
3 . The method of claim 1 , the method further comprising:
when said determining is negative, configuring the particular security feature for operation outside of the plurality of trusted networks.
4 . The method of claim 1 , wherein the particular security feature comprises micro-segmentation, and wherein the method further comprises:
maintaining a local cache of security rules received from the security service;
intercepting a communication attempt at the endpoint device; and
attempting to determine whether the communication attempt is authorized by the security service by querying the security service;
wherein configuration of the particular security feature for operating inside one of the plurality of trusted networks comprises configuring the micro-segmentation to allow or disallow the communication attempt based on the security rules in the local cache; and
wherein configuration of the particular security feature for operation outside of the plurality of trusted networks comprises configuring the micro-segmentation to allow the communication attempt.
5 . The method of claim 4 , wherein the communication attempt comprises a connection attempt between the endpoint device and a second endpoint device, wherein the security rules comprise Internet Protocol (IP)-based security rules.
6 . The method of claim 5 , wherein the cloud-based security service comprises a Secure Access Service Edge (SASE) platform and wherein the security service comprises a segmentation controller that maintains potentially dynamically changing user-based security rules and IP-based security rules.
7 . The method of claim 6 , wherein the endpoint device comprises a client computer system and the second endpoint device comprises a server computer system and wherein the connection attempt comprises an outbound connection attempt from the client computer system to the server computer system.
8 . The method of claim 6 , wherein the endpoint device comprises a server computer system and the second endpoint device comprises a client computer system and wherein the connection attempt comprises an inbound connection attempt from the client computer system to the server computer system.
9 . A non-transitory computer-readable medium having stored therein instructions that when executed by a processing resource cause the processing resource to:
identify a security service of a cloud-based security service is not reachable or is unresponsive, wherein the security service is associated with a particular security function implemented by the endpoint device;
when the security service is not reachable or is unresponsive, determining, by the agent, whether the endpoint device is within a trusted network of a plurality of trusted networks that have been previously registered with the cloud-based security service; and
when said determining is negative, configuring, by the agent, the particular security feature for operation outside of the plurality of trusted networks.
10 . The non-transitory computer-readable medium of claim 9 , wherein the particular security feature comprises micro-segmentation, and wherein the computer-readable medium further has stored therein instructions that when executed by a processing resource cause the processing resource to:
maintain a local cache of security rules received from the security service;
intercept a communication attempt at the endpoint device; and
attempt to determine whether the communication attempt is authorized by the security service by querying the security service;
wherein configuration of the particular security feature for operating inside one of the plurality of trusted networks comprises configuring the micro-segmentation to allow or disallow the communication attempt based on the security rules in the local cache; and
wherein configuration of the particular security feature for operation outside of the plurality of trusted networks comprises configuring the micro-segmentation to allow the communication attempt.
11 . The non-transitory computer-readable medium of claim 10 , wherein the communication attempt comprises a connection attempt between the endpoint device and a second endpoint device, wherein the security rules comprise Internet Protocol (IP)-based security rules.
12 . The non-transitory computer-readable medium of claim 11 , wherein the cloud-based security service comprises a Secure Access Service Edge (SASE) platform and wherein the security service comprises a segmentation controller that maintains potentially dynamically changing user-based security rules and IP-based security rules.
13 . The non-transitory computer-readable medium of claim 9 , wherein the determining whether the endpoint device is within a trusted network of a plurality of trusted networks that have been previously registered with the cloud-based security service is done by querying a trusted network determination service associated with the cloud-based security service.
14 . The non-transitory computer-readable medium of claim 9 , wherein the non-transitory computer-readable medium further has stored therein instructions that when executed by the processing resource cause the processing resource to:
when said determining is negative, configuring the particular security feature for operation outside of the plurality of trusted networks.
15 . An endpoint device comprising:
a processing resource; and
a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to perform a method comprising:
identifying, by an agent running on the endpoint device, a security service of a cloud-based security service is not reachable or is unresponsive, wherein the security service is associated with a particular security function implemented by the endpoint device;
when the security service is not reachable or is unresponsive, determining, by the agent, whether the endpoint device is within a trusted network of a plurality of trusted networks that have been previously registered with the cloud-based security service; and
when said determining is negative, configuring, by the agent, the particular security feature for operation outside of the plurality of trusted networks.
16 . The endpoint device of claim 15 , wherein the particular security feature comprises micro-segmentation, and wherein the method further comprises:
maintaining, by the agent, a local cache of security rules received from the security service;
intercepting, by the agent, a communication attempt at the endpoint device; and
attempting, by the agent, to determine whether the communication attempt is authorized by the security service by querying the security service;
wherein configuration of the particular security feature for operating inside one of the plurality of trusted networks comprises configuring the micro-segmentation to allow or disallow the communication attempt based on the security rules in the local cache; and
wherein configuration of the particular security feature for operation outside of the plurality of trusted networks comprises configuring the micro-segmentation to allow the communication attempt.
17 . The endpoint device of claim 16 , wherein the communication attempt comprises a connection attempt between the endpoint device and a second endpoint device, wherein the security rules comprise Internet Protocol (IP)-based security rules.
18 . The endpoint device of claim 17 , wherein the cloud-based security service comprises a Secure Access Service Edge (SASE) platform and wherein the security service comprises a segmentation controller that maintains potentially dynamically changing user-based security rules and IP-based security rules.
19 . The endpoint device of claim 18 , wherein the endpoint device comprises a client computer system and the second endpoint device comprises a server computer system and wherein the connection attempt comprises an outbound connection attempt from the client computer system to the server computer system.
20 . The endpoint device of claim 18 , wherein the endpoint device comprises a server computer system and the second endpoint device comprises a client computer system and wherein the connection attempt comprises an inbound connection attempt from the client computer system to the server computer system.
21 . The endpoint device of claim 15 , wherein the determining whether the endpoint device is within a trusted network of a plurality of trusted networks that have been previously registered with the cloud-based security service is done by querying a trusted network determination service associated with the cloud-based security service.
22 . The endpoint device of claim 15 , wherein the non-transitory computer-readable medium, further has stored therein instructions that when executed by the processing resource cause the processing resource to perform a method comprising:
when said determining is negative, configuring the particular security feature for operation outside of the plurality of trusted networks.