Systems and methods for continuous fingerprinting to detect session hijacking inside zero trust private networks
Systems and methods include responsive to a user initiating a session with a resource, determining a master fingerprint of a device associated with the user; collecting, at predefined time intervals, one or more additional fingerprints during the session; comparing the one or more additional fingerprints with the master fingerprint; and performing one or more actions based on the comparing.
1 . A method implemented by a cloud-based system, the method comprising steps of:
responsive to a user initiating a session with a resource, collecting a master fingerprint of a device associated with the user, wherein the collecting is performed by the cloud-based system located between the device and the resource;
collecting, at predefined time intervals, one or more additional fingerprints during the session, wherein the master fingerprint and one or more additional fingerprints include any of a location of the device, a browser used to access the resource, and an Operating System (OS) of the device;
comparing the one or more additional fingerprints with the master fingerprint;
dynamically adjusting, based upon the comparing indicating contextual changes exceeding a predetermined threshold, a security policy associated with the session, wherein the security policy is continuously adapted during the session based on a zero trust architecture that re-evaluates user privileges according to changes in one or more contextual attributes including user role, resource sensitivity, or device risk posture; and
enforcing the dynamically adjusted security policy by selectively allowing, limiting, or denying user access to the resource based on the continuously reassessed contextual attributes.
2 . The method of claim 1 , wherein the comparing includes comparing attributes of the one or more additional fingerprints with attributes of the master fingerprint.
3 . The method of claim 2 , wherein the steps further comprise:
receiving a policy profile at the cloud-based system, the policy profile defining which attributes to collect when collecting the one or more additional fingerprints and the master fingerprint; and
collecting one or more attributes of the master fingerprint and collecting one or more attributes of the one or more additional fingerprints based on the policy profile.
4 . The method of claim 3 , wherein the attributes include any of a location of the device, a browser used to access the resource, and an Operating System (OS) of the device, and wherein the comparing includes comparing a location of the device, a browser used to access the resource, and an OS from the master fingerprint to a location of the device, a browser used to access the resource, and an OS from the one or more additional fingerprints.
5 . The method of claim 3 , wherein the policy profile defines the time intervals, and wherein the collecting one or more additional fingerprints during the session is performed based on the time intervals defined by the profile policy.
6 . The method of claim 1 , wherein responsive to identifying no changes between the one or more additional fingerprints and the master fingerprint, the one or more actions include maintaining the session and continuing to collect additional fingerprints during the session.
7 . The method of claim 1 , wherein responsive to identifying changes between the one or more additional fingerprints and the master fingerprint, the one or more actions include any of blocking the user, terminating the session, and sending an alert to an administrator.
8 . The method of claim 1 , wherein the collecting one or more additional fingerprints during the session is performed based on detecting abnormal behavior of the user during the session, wherein abnormal behavior is determined by comparing real time user behavior to historical user behavior vie one or more machine learning models.
9 . The method of claim 1 , wherein the session is initiated responsive to the user accessing an application.
10 . The method of claim 1 , wherein the steps further comprise:
calculating a risk score based on the comparing and performing one or more actions based thereon.
11 . A non-transitory computer-readable storage medium having computer readable code stored thereon for programming at least one processor of a cloud-based system to perform steps of:
responsive to a user initiating a session with a resource, collecting a master fingerprint of a device associated with the user, wherein the collecting is performed by the cloud-based system located between the device and the resource;
collecting, at predefined time intervals, one or more additional fingerprints during the session, wherein the master fingerprint and one or more additional fingerprints include any of a location of the device, a browser used to access the resource, and an Operating System (OS) of the device;
comparing the one or more additional fingerprints with the master fingerprint; and
dynamically adjusting, based upon the comparing indicating contextual changes exceeding a predetermined threshold, a security policy associated with the session, wherein the security policy is continuously adapted during the session based on a zero trust architecture that re-evaluates user privileges according to changes in one or more contextual attributes including user role, resource sensitivity, or device risk posture; and
enforcing the dynamically adjusted security policy by selectively allowing, limiting, or denying user access to the resource based on the continuously reassessed contextual attributes.
12 . The non-transitory computer-readable storage medium of claim 11 , wherein the comparing includes comparing attributes of the one or more additional fingerprints with attributes of the master fingerprint.
13 . The non-transitory computer-readable storage medium of claim 12 , wherein the steps further comprise:
receiving a policy profile at the cloud-based system, the policy profile defining which attributes to collect when collecting the one or more additional fingerprints and the master fingerprint; and
collecting one or more attributes of the master fingerprint and collecting one or more attributes of the one or more additional fingerprints based on the policy profile.
14 . The non-transitory computer-readable storage medium of claim 13 , wherein the attributes include any of a location of the device, a browser used to access the resource, and an Operating System (OS) of the device, and wherein the comparing includes comparing a location of the device, a browser used to access the resource, and an OS from the master fingerprint to a location of the device, a browser used to access the resource, and an OS from the one or more additional fingerprints.
15 . The non-transitory computer-readable storage medium of claim 13 , wherein the policy profile defines the time intervals, and wherein the collecting one or more additional fingerprints during the session is performed based on the time intervals defined by the profile policy.
16 . The non-transitory computer-readable storage medium of claim 11 , wherein responsive to identifying no changes between the one or more additional fingerprints and the master fingerprint, the one or more actions include maintaining the session and continuing to collect additional fingerprints during the session.
17 . The non-transitory computer-readable storage medium of claim 11 , wherein responsive to identifying changes between the one or more additional fingerprints and the master fingerprint, the one or more actions include any of blocking the user, terminating the session, and sending an alert to an administrator.
18 . The non-transitory computer-readable storage medium of claim 11 , wherein the collecting one or more additional fingerprints during the session is performed based on detecting abnormal behavior of the user during the session, wherein abnormal behavior is determined by comparing real time user behavior to historical user behavior vie one or more machine learning models.
19 . The non-transitory computer-readable storage medium of claim 11 , wherein the session is initiated responsive to the user accessing an application.
20 . The non-transitory computer-readable storage medium of claim 11 , wherein the steps further comprise:
calculating a risk score based on the comparing and performing one or more actions based thereon.