Systems and methods for managing endpoint security states using passive data integrity attestations
The disclosed computer-implemented method for managing endpoint security states using passive data integrity attestations may include (i) receiving passively collected network data from an endpoint device of a computing environment, (ii) determining a security state of the endpoint device using the passively collected network data from the endpoint device, (iii) determining that the security state of the endpoint device is below a threshold, and (iv) in response to determining that the security state of the endpoint device is below a threshold, performing a security action to protect the computing environment against malicious actions. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for managing endpoint security states using passive data integrity attestations, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, by a computing device, passively collected network data from an endpoint device of a computing environment;
determining a security state of the endpoint device using the passively collected network data from the endpoint device;
determining that the security state of the endpoint device is below a threshold; and
in response to determining that the security state of the endpoint device is below the threshold, performing a security action to protect the computing environment against malicious actions, wherein the security action comprises:
updating the endpoint device to a reduced trust level; and
displaying a notification to a user of the endpoint device with the reduced trust level.
2. The computer-implemented method of claim 1 , further comprising at least one of:
authorizing access to resources associated with the reduced trust level; or
blocking access to resources of the computing environment.
3. The computer-implemented method of claim 1 ,
wherein the reduced trust level is associated with the user of the endpoint device and the method further comprises:
identifying computing devices associated with the user; and
associating the reduced trust level with the computing devices of the user.
4. The computer-implemented method of claim 1 , wherein the passively collected network data from the endpoint device comprises at least one of:
an encryption level of a network connection;
an indication that personally identifying information has been transmitted in plaintext; or
metadata associated with a network connection of the endpoint device.
5. The computer-implemented method of claim 1 , wherein the passively collected network data from the endpoint device is collected in a user session of the endpoint device.
6. The computer-implemented method of claim 1 , wherein the passively collected network data from the endpoint device is collected using a network filter.
7. A system for managing endpoint security states using passive data integrity attestations, the system comprising:
at least one physical processor;
physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:
receive passively collected network data from an endpoint device of a computing environment;
determine a security state of the endpoint device using the passively collected network data from the endpoint device;
determine that the security state of the endpoint device is below a threshold; and
in response to determining that the security state of the endpoint device is below the threshold, perform a security action to protect the computing environment against malicious actions, wherein the security action comprises:
updating the endpoint device to a reduced trust level; and
displaying a notification to a user of the endpoint device with the reduced trust level.
8. The system of claim 7 , wherein the computer-executable instructions further cause the physical processor to at least one of:
authorize access to resources associated with the reduced trust level; or
block access to resources of the computing environment.
9. The system of claim 7 , wherein the reduced trust level is associated with the user of the endpoint device and wherein the computer-executable instructions further cause the physical processor to:
identify computing devices associated with the user; and
associate the reduced trust level with the computing devices of the user.
10. The system of claim 7 , wherein the passively collected network data from the endpoint device comprises at least one of:
an encryption level of a network connection;
an indication that personally identifying information has been transmitted in plaintext; or
metadata associated with a network connection of the endpoint device.
11. The system of claim 7 , wherein the passively collected network data from the endpoint device is collected in a user session of the endpoint device.
12. The system of claim 7 , wherein the passively collected network data from the endpoint device is collected using a network filter.
13. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
receiving, by a computing device, passively collected network data from an endpoint device of a computing environment;
determining a security state of the endpoint device using the passively collected network data from the endpoint device;
determining that the security state of the endpoint device is below a threshold; and
in response to determining that the security state of the endpoint device is below the threshold, performing a security action to protect the computing environment against malicious actions, wherein the security action comprises:
updating the endpoint device to a reduced trust level; and
displaying a notification to a user of the endpoint device with the reduced trust level.
14. The non-transitory computer-readable medium of claim 13 , wherein the one or more computer-executable instructions further cause the computing device to at least one of:
authorize access to resources associated with the reduced trust level; or
block access to resources of the computing environment.
15. The non-transitory computer-readable medium of claim 13 , wherein the reduced trust level is associated with the user of the endpoint device and wherein the one or more computer-executable instructions further cause the computing device to:
identify computing devices associated with the user; and
associate the reduced trust level with the computing devices of the user.
16. The non-transitory computer-readable medium of claim 13 , wherein the passively collected network data from the endpoint device comprises at least one of:
an encryption level of a network connection;
an indication that personally identifying information has been transmitted in plaintext; or
metadata associated with a network connection of the endpoint device.
17. The non-transitory computer-readable medium of claim 13 , wherein the passively collected network data from the endpoint device is collected in a user session of the endpoint device.
18. The computer-implemented method of claim 1 , wherein the passively collected network data is associated with a trace route from the endpoint device to a target resource.
19. The system of claim 7 , wherein the passively collected network data, wherein the passively collected network data is associated with a trace route from the endpoint device to a target resource.
20. The non-transitory computer-readable medium of claim 13 , wherein the passively collected network data is associated with a trace route from the endpoint device to a target resource.